How to retrieve the event type that triggered an event-rule

[kawalex]

Hi,
I have a custom script that is triggered by an event rule each time an IP Address is created, modified or deleted.

In the script, I'd like to retrieve the type of event that triggered it, meaning if it was a creation, a modification or a deletion.

Today in the data argument of the script I only retrieve the IP Address object but not enough information:

• For the creation I get:

{'log': [], 'tests': {}, 'output': "data={'id': 244, 'url': '/api/ipam/ip-addresses/244/', 'display_url': '/ipam/ip-addresses/244/', 'display': '198.19.120.2/32', 'family': {'value': 4, 'label': 'IPv4'}, 'address': '198.19.120.2/32', 'vrf': None, 'tenant': None, 'status': {'value': 'active', 'label': 'Active'}, 'role': None, 'assigned_object_type': 'dcim.interface', 'assigned_object_id': 7558, 'assigned_object': {'id': 7558, 'url': '/api/dcim/interfaces/7558/', 'display': 'Loopback99', 'device': {'id': 462, 'url': '/api/dcim/devices/462/', 'display': 'OB-C008', 'name': 'OB-C008', 'description': 'Ex BLOS401'}, 'name': 'Loopback99', 'description': '', 'cable': None, '_occupied': False}, 'nat_inside': None, 'nat_outside': [], 'dns_name': '', 'description': '', 'comments': '', 'tags': [], 'custom_fields': {}, 'created': '2025-05-13T15:20:12.316849Z', 'last_updated': '2025-05-13T15:20:12.316860Z'}"}
In this case I can guess it is a creation if 'created' and 'last_updated' are almost the same.

• For the modification I get:

{'log': [], 'tests': {}, 'output': "data={'id': 244, 'url': '/api/ipam/ip-addresses/244/', 'display_url': '/ipam/ip-addresses/244/', 'display': '198.19.120.2/32', 'family': {'value': 4, 'label': 'IPv4'}, 'address': '198.19.120.2/32', 'vrf': None, 'tenant': None, 'status': {'value': 'active', 'label': 'Active'}, 'role': None, 'assigned_object_type': 'dcim.interface', 'assigned_object_id': 7558, 'assigned_object': {'id': 7558, 'url': '/api/dcim/interfaces/7558/', 'display': 'Loopback99', 'device': {'id': 462, 'url': '/api/dcim/devices/462/', 'display': 'OB-C008', 'name': 'OB-C008', 'description': 'Ex BLOS401'}, 'name': 'Loopback99', 'description': '', 'cable': None, '_occupied': False}, 'nat_inside': None, 'nat_outside': [], 'dns_name': '', 'description': 'Test', 'comments': '', 'tags': [], 'custom_fields': {}, 'created': '2025-05-13T15:20:12.316849Z', 'last_updated': '2025-05-13T15:21:57.999324Z'}"}
In this case I can guess it is a modification as 'created' and 'last_updated' are not the same.

• But for the deletion I get:

{'log': [], 'tests': {}, 'output': "data={'id': 244, 'url': '/api/ipam/ip-addresses/244/', 'display_url': '/ipam/ip-addresses/244/', 'display': '198.19.120.2/32', 'family': {'value': 4, 'label': 'IPv4'}, 'address': '198.19.120.2/32', 'vrf': None, 'tenant': None, 'status': {'value': 'active', 'label': 'Active'}, 'role': None, 'assigned_object_type': 'dcim.interface', 'assigned_object_id': 7558, 'assigned_object': {'id': 7558, 'url': '/api/dcim/interfaces/7558/', 'display': 'Loopback99', 'device': {'id': 462, 'url': '/api/dcim/devices/462/', 'display': 'OB-C008', 'name': 'OB-C008', 'description': 'Ex BLOS401'}, 'name': 'Loopback99', 'description': '', 'cable': None, '_occupied': False}, 'nat_inside': None, 'nat_outside': [], 'dns_name': '', 'description': 'Test', 'comments': '', 'tags': [], 'custom_fields': {}, 'created': '2025-05-13T15:20:12.316849Z', 'last_updated': '2025-05-13T15:21:57.999324Z'}"}
In this case, we get same data as after a modification, no sign of deletion. So I cannot guess the IP address was deleted (without checking if it still exists which may be a workaround).

Does someone know how I can retrieve the event action type from Netbox ?

[llamafilm]

This is not possible today. It might be addressed by this proposal: #14884

[llamafilm]

One possibility is like this, but I'm not sure if this is a reliable method 100% of the time.

try:
    ip = IPAddress.objects.get(id=data["id"])
    self.log_info("model was created or updated")
except IPAddress.DoesNotExist:
    self.log_info("model was deleted")

[rfdrake]

I don't think this will work, but I'm saying this without having tested it. From what I remember in a shallow dive of the event rules documentation, the delete rule is fired right before deletion, so the object will still exist when you are running your script. In fact, depending on what your script does it could stop the object from being deleted (protecting critical objects).

I thumbs upped #14884 because I really want the username that fired an event, to help prevent loops. Knowing the event type would also be extremely handy.

Super sketchy idea that I haven't experimented with and don't have any code for: What if you dived into the redis queue looking for a job that matches the object you're looking for? This would still have the potential of going wrong, but if you only see one job that is related to the IPAddress object, you could reason that it is your job.