Sending an Alert Acknowledgement Into Orion via Email - Script?

Marek

Hi,

Longtime fan of Orion, but one area of weakness in NPM is the acknowledgement methods available natively - Use of the console directly and somewhat recently, having an email alert sent containing a URL.  Unfortunately, neither of these offer the flexibility or accessibility we need for on-call support - We're not sitting at a console 24/7 nor is web access always an option (where as email and/or "SMS" is).

What would be very helpful, as we already have some similar processes in place on existing systems, is the ability to reply to an incoming email alert or simply send a new message / email back in to a email address with a "code" to validate it that is then processed (by a script / program) and acknowledges the alert or all active alerts; thus stopping any escalations (the issue may still exist of course).  Note: I use "SMS" generically, since often emails are sent to or from phones and translated to SMS/email by the provider (e.g. 1234567890@myprovider.com).

rmashall has a great post on here regarding "Acknowledge Solarwinds Orion alerts by email (using Splunk)", which is close to what I'm looking for in concept, only I'm not using Splunk, python, and would prefer to run something on the same Windows server as Orion using PERL (or perhaps VBscript/Powershell) or an executable application to do the work.

Hoping someone might have a solution or can point me in a good direction.  Thank you.

Marek

I probably should have come back to this some time ago.... But while there wasn't really any discussion here by people (thanks though svigano on agreeing on the need), this topic has been viewed quite a bit (several hundred times at least) - So I thought I'd share briefly what I did for a solution, in the event it helps.

Essentially, to accomplish the matter as described it required custom programming unfortunately (not merely a simple script, though I'm sure it could be done in some variation).  The program was written & compiled in C# - just what was done in my case; and runs as a service on the server hosting NPM.  It polls a mailbox periodically, checks any new messages for specific & applicable content (provisions were put in place to weed out spam or non-applicable emails), parses the content, and then updates the SQL database appropriately for a single alert or group of alerts to be acknowledged.  In conjunction with this, custom properties were used on Nodes for some of the grouping (helps to distinguish Server alerts from Network alerts from Security alerts, etc. in terms of which IT support group is responsible for a particular device since some servers may be managed by a different group for instance), and that along with the acknowledgements being picked up by the Advanced Alert Manager (e.g. how the alerts are defined), handles the escalation or halting thereof, without having to access the Web Console or NPM server directly, which is extremely handy when you're not on the network / external.  i.e. A simple email reply to an alert now handles it, right from your smartphone, no matter where you are.

Some enhancements have also been done, such as the ability to send a new email message in (again, specific info/format needed), and the custom program will query the database for the information & send back an email with it.  For instance, it will tell us if there are any nodes down at that particular time - a handy way to check if something is still down / forgotten, despite any alerts going out previously.

Hope that sparks some solution ideas for your own environment & needs. Good luck!