Community
- Command Central
- MVP Program
- Monthly Mission
- Blogs
- Groups
- Events
- Media Vault
Products
- Observability
- Network Management
- Application Management
- IT Security
- IT Service Management
- System Management
- Database Management
Content Exchange
- SolarWinds Platform
- Server & Application Monitor
- Database Performance Analyzer
- Server Configuration Monitor
- Network Performance Monitor
- Network Configuration Manager
- SQL Sentry
- Web Help Desk
Free Tools & Trials

Send email alert on eventID, but do not mark server as down

Hi all - quite new to solarwinds - finding it i little confusing to navigate.... not sure if its due to newness or the product, or a bit of both.

In short, i would like to send an email alert whenever an eventID 4732 or 4733 occurs on a DC.... (notifying when a privileged group has had a group member added or removed - pretty standard stuff for a monitoring solution i would have thought) below is a screenshot of what i initially came up with.... but i have no idea if im going down the right path. I have seen other forum posts talking about stuff that doesnt seem to be in my console - and i dont know if its due to age and the interface changing or modules or ?

The reason i backed away from the below is two fold:

- This component monitor required me to put the resource in solarwinds (in this case a DC) in a down or up state after the event occured. Its not up or down - i simply want to email based on this event... not change the state of the object in SW

- There was a warning and error threshold.... this implies that a certain number of events will need to be hit, to put in a state (which as per above, i dont want) - but also that additional events of the same type will be missed (as the object is already in a warning state for example). this defeats the purpose of the alert.

These two points above make me think im using the "wrong" part of solarwinds.... it doesn't seem to "fit" the requirement. Can anyone out here assist me with achieving my goal within SW ? How is the best way to do this ?

I am on version 2024.2 with a number of licensed modules... (but most the acronyms mean little to me) - if there is maybe a specific module im missing - im happy to look it up in our license details... but at the moment i "dont know what i dont know"

Find more posts tagged with

Accepted answers

All comments

SteveK

So you are in the right area utilizing SAM. SAM would do the monitoring of the object, then you would need to build out an alert to trigger the email. I'm not aware of a way to alert off of a new entry with the standard alert (SWQL maybe?).

So path of least resistance would be to build out the SAM monitor as you have it there. Then on "Number of past polling intervals to search for events" set that to "1", Then for "If a match is found in a polling period, component status is" set that to "Based on Event Count." Then set your statistic threshold warning to greater than 0. This would end up putting your node in a warning state for approximately 5 minutes whenever this specific event does occur. After a polling window has passed without that event occuring, it would shift back to an up state. Then you could set your email alert to occur when that specific monitor (or template) goes to a warning state. I know you said you didn't want the status of the node to change, but it would honestly be a bit easier and reliable to do it that way.

Without doing the state, this is purely theory. You could set those values to be exteremly high so it never changes status. You would still want the polling intervales to search for events to be 1. Then in the alert you could set it to alert on Component, and then pick "Multiple Statistic Data" and set "Statstic Data (Numeric)" to be greater than 0. You would still be in then 5 minute window. I don't have too many event log monitors setup, so that part is purely speculation and would need to be tested out.

Ben76

Hey steveK - thanks for the reply.

The issue with what you mention above, i believe (and correct me if im wrong) is that once the server is in a warning state,,,, if another user is added/removed to a privileged AD group, that the server wont go into a "warning" state again - and therefore we will not receive an email for any additional group changes during that period.... or at least thats the way im reading it... is that correct ? If yes, then it means its not fit for that purpose.

SteveK

That is correct in that instance. The monitor would go into a warning state, then if there are no further changes over the next 5 minutes it would revert back to up. Your summary page for the monitor would be able to show you all of the events related to those IDs though.

If you are needing an email per event, then yeah I don't know of a good way to accomplish that in SW. In my experiences SW is more of a snap or moment in time monitor where you are getting the data at that precise time. It sounds like you are probably looking for something that is scanning logs real time and reacting on each instance.

Ben76

Yer... i come from a SCOM world... and while i am not in any way saying SCOM is great (or even good... because overall it is not!) - something like this is a 2 minute job... so i was thinking SW would have something equivalent.... but if not, then fair enough, ill find another way!

thanks for your help!