Community
- Command Central
- MVP Program
- Monthly Mission
- Blogs
- Groups
- Events
- Media Vault
Products
- Observability
- Network Management
- Application Management
- IT Security
- IT Service Management
- System Management
- Database Management
Content Exchange
- SolarWinds Platform
- Server & Application Monitor
- Database Performance Analyzer
- Server Configuration Monitor
- Network Performance Monitor
- Network Configuration Manager
- SQL Sentry
- Web Help Desk
Free Tools & Trials
Store

Active response tool

How does it works... ive enabled the tool on one of the servers ... where does it store the log file i mean in which directory ???????

Find more posts tagged with

Accepted answers

FormerMember

You can create a rule that says if you see this event type from this agent send an email or append to text file, yes.

All comments

FormerMember

Any time an active response is initiated, events will be generated and stored on the appliance. If you search for InternalCommands alerts in nDepth (or with a filter) or use the "SolarWinds Actions Report" you should be able to find anything an active response connector has done.

crishna

HI Nicole

Thanks for replying

I'm still bemused with this .. .. is it like .. ( if i installed this tool ) ....

is it possible to create aa rule or filter an agent .. like (if this alert occurs from this agent ... do this actions append to a particular TXT file or CSV file ??? can i do like this ... ?????????

FormerMember

You can create a rule that says if you see this event type from this agent send an email or append to text file, yes.

crishna

i'm having problem with this( append txt file ) rule when trying to create a rule for a particular alert i'm trying to write detection time to the txt but its not allowing me to do that its saying incompatible parameter

any help ???

crishna

can somebody shed some light on it pleaseeeeeee ???? this is very essential thing for me to implement on my project

FormerMember

That message is a warning - it is possible the rule and action will fire even though it's there. (It's also possible the rule will fire but the action will fail, but I haven't reproduced this myself to be sure one way or the other.)

What I'd do:

Use an email or other action to confirm the rule is in fact firing as expected, before adding the append to text file action.
If the rule is firing with another action (i.e. rule is correct), add the append to text file action, making sure the Agent value is a valid agent name (or the InsertionIP field from the alert, if you want it to go where the event was originally generated).
If the rule doesn't fire at all with the Append to Text, or if nothing is written to the text file:
1. Make sure the agent is correct - it needs to match the name of an agent in the Manage>Nodes area. If you want it to be written on the node that detected the original event, use InsertionIP.
2. Make sure the file path is correct.
3. Try using a different field for the Text rather than DetectionTime - test with something like EventInfo to see if it is written.

If you never see data in the text file even after doing those things, chances are something else is wrong. You may need to open a support case to get this diagnosed faster.

crishna

Thanks nicole for replying

1. i cant use email because there is no mail sever in my network

2 i've doubled checked it it the appropriate parameter

3 i've use rest of the categories like eventinfo , etc... they are working but when i tried detection time .. it says incompatible parameter??

crishna

ive raised a case for this today .. they said they gonna send this issue to the development team, but they have gave me a timeline for it ?? can you push this forward

Thanks in advance

FormerMember

Have you ignored the warning, saved anyway, and verified it does not work, or are you just reporting the warning? The warning is just a warning, but I cannot say for sure what effect that has. Before I check, I want to be clear what you're experiencing.

danielleh

crishna - Unfortunately, we cannot give specific timelines for such requests. Did you create an Idea for this on the LEM Feature Request forum? The community can then vote on your feature request and show that this feature is widely needed.