Keith is right on the money here. Use the state() function is pre-processing scripts to evaluate a trigger state. I believe this is still in the documentation for the nas probe. However, I have not reviewed the latest doc for accuracy or completness to be able to say that conclusivley.
From the 4.20 nas docs......
Custom Pre-Processing
The event table is placed into the LUA context prior to executing the "custom" pre-processing rule. You may alter (launder) the event by setting the fields message, sid, source, hostname, user_tag1, user_tag2, visible and origin.
EDIT note: missing from this list are the custom 1 - 5 fields which can also be altered.
The following fields are present for the script to use:
.source - source of the alarm (typically ip-address)
.hostname - resolved name (robotname or ip-address to name resolution)
.level - severity level (0-5)
.sid - subsystem identification.
.message - alarm message text.
.origin - origin of the alarm (stamped by nearest hub, or in some cases the robot.)
.domain - name of originating Nimsoft domain.
.robot - name of the sending robot.
.hub - name of the nearest hub to the sending robot.
.prid - name of probe issuing the alarm.
.user_tag1 - user tag 1 (as set by robot).
.user_tag2 - user tag 2 (as set by robot).
.supp_key - suppression identification key.
.visible - flag for visibility (true = visible)
The script is expected to return the event (modified or not) or nil. A nil indicates that the event is to be skipped.
Note that the user_tag1 and user_tag2 fields will be stored in the database when the inbound alarm translates into a new event.
Note that all pre-processing handling will, by nature, slow down the processing of inbound alarms.
Note that only a subset of the lua methods are available to the pre-processing script. The trigger.state method, through the state method, is available. These classes and methods are not available:
■ exit
■ sleep
■ nimbus
■ pds
■ trigger
■ action
■ database
■ alarm
■ note.