Hi!
These 40 EEP rules are there just for demonstration, in real production situation there might be more rules.
Systems logic is the following
Events are created when something happens. There are many source of events - DCI threshold violation/restore, node status change, log parser, SNMP traps, etc.
Each event stores a number of parameter with it, e.g. DCI parameter name, threshold and actual values, etc. The number of parameters is different for different events.
There are "event prototypes" where we can configure event name and user message, which can have macros (they are expanded when event is created).
Events are processed by EPP. It could be that some events are not configured in EPP at all - in this case the event would be just recorded to event log, nothing else would happen.
EPP rules can be very flexible - e.g. one rule can handle multiple events, it can work only for nodes in specific container (or except for some nodes/containers) - check conditions in EPP rule properties.
EPP can create an alarm - it's sort of a bug-tracker built in netxms that shows list of current problems. It's also possible to terminate alarms automatically when some other event comes. In order for this to work alarms have alarm key, which is made of some text and macros. Macros can have, e.g. ID of node and ID of a DCI - see default rules 19 and 20.
Now it depends on what exactly hardware checks do you need. Node connectivity and status of network interfaces is checked once per minute via status poll - if it's down, corresponding event will be generated. Other checks are usually configured as DCIs, e.g. cpu temperature, that DCI has threshold and an event specified in in DCI properties is generated on threshold violation. You can use generic SYS_THRESHOLD_REACHED event, but usually it's more convenient to have separate events for various groups of thresholds, e.g. something like DC_SERVER_TEMPERATURE, etc.
