i have played with this for a while and finally i have solved the problem.
i have discovered that the $x in the "action...." can be even a word. for ex. if %2 is "State of xxxxxx" then the $3 will be xxxxxx
maybe there is a way to simplify the process ? what will happen when i decide to pass %1 instead of %2 ? will i have to run the agent in debug mode again to discover what params does it get ?

Best Regards,
Lindeamon

All %number macros refers to event-specific event's parameters. They can have different meaning for different events. For example, for threshold violation events %6 refers to "instance" attribute, and for event created from SNMP trap it will be varbind mapping #6. For well-known events you can see exact parameter meaning in event description.

Best regards,
Victor

thank you for your help.
i was aware of this possibilities but it is always good to refresh my memory.
still there is one thing that i do not understand: why %6 ? what %1 refer too ?
what happens if i have 2 parameters to pass ?

Regards,
Lindeamon

The parameters available in event processing are listed here:
http://wiki.netxms.org/wiki/UM:Event_Processing#Macros_for_Event_Processing

You can use up to 99 variables linked to a particular event with the macros %1, %2, ..., %99

I can't seem to find any documentation of parameters for actions, but the principle is the same as parameters for ExternalParameter which are described in a stickied thread in the forums:
https://www.netxms.org/forum/configuration/agent-config-(action-externalparam)/msg3136/#msg3136

Hope this helps,

Kind regards,
bdefloo

so i have to assume that every action that i want the agent to run should be configured both on the agent and the server ?
what type of actions i would typically run on the server ? could i have solved this problem by running a command on the server with reference to the malfunctioned node, assuming that the server is windows and it can run the "sc" command ?
can i have a reference to the $1 and %6 uses ? where and when to use them ?
i hope you will find the time to make some order in the help section to include all of this so we will not have to bother you with the little things.

Best Regards,
Lindeamon

First, you have to create action on agent, like this:

Action = StartService:net start $1

Then you can create action object on server, which will execute agent's action "StartService" on node where service was stopped. You can set node address to %a (it will expand to node's IP address), and action to

StartService %6

assuming that you have service name entered into instance field in appropriate DCI.

Then execute this action from event processing policy in reaction to service stopped event.

Best regards,
Victor