Community
- Command Central
- MVP Program
- Monthly Mission
- Blogs
- Groups
- Events
- Media Vault
Products
- Observability
- Network Management
- Application Management
- IT Security
- IT Service Management
- System Management
- Database Management
Content Exchange
- SolarWinds Platform
- Server & Application Monitor
- Database Performance Analyzer
- Server Configuration Monitor
- Network Performance Monitor
- Network Configuration Manager
- SQL Sentry
- Web Help Desk
Free Tools & Trials
Store

Issue Executing External Program via Alert

So I have been banging my head on this one all day... My goal was to create an alert action that executes a script that would activate a firewall rule on a remote machine and do an IIS Reset. I was able to get this to work in our Stage Solarwinds environment by following some of the articles here mentioning to set the "Orion Module Engine" to run as a domain account. What is baffling to me is I recreated all of this in our Prod environment and it DOES NOT work! In fact I had a very simple "Execute an External Program" action that ran a PowerShell script to send a message to a HipChat room and that worked great up until I updated the "Orion Module Engine" on the main polling server to use the domain admin account in Prod. The only real difference between our Stage and Prod environments is we have 4 additional Pollers... Would I need to update the accounts on every one of those as well? Or any other ideas?

Thanks!

Find more posts tagged with

Accepted answers

drockh

So I finally have a conclusion to this issue!!! We had found that there were a bunch of PowerShell Processes stuck in running state for my alert action. Once we closed these out I was able to execute a bat file that created a txt file. We added exits at the end of all the PowerShell Scripts and this seems to have resolved the issue going forward... What is most baffling is how this works fine without them in our Windows 2012 R1 environment but not in our Windows 2012 R2 One... It also had no issues while I was running services as Local System.

All comments

aLTeReGo

The Web Based Alert Manager supports impersonation for executing external applications and scripts using elevated privileges. There should no longer be any need to run the alerting under another user account like there was with the legacy Win32 Advanced Alert Manager.

Alert Action Impersonation.png

drockh

I have tried executing as a defined user and no matter what account I used I received "Test Failed". SW Support stated this is a bug with the Web Console and to run the Orion Module Engine with the domain account I would like to execute the script as... I think what is most confusing to me is how I lost functionality by updating the service to run as a domain account instead of local system.

aLTeReGo

The bug support is referencing is tracked internally under CORE-4678 and should be resolved in SAM 6.3 currently in beta. You can sign-up here and try it yourself. As an alternative workaround you will need to change not only the account the 'SolarWinds Alerting Service V2' runs under to a privileged user, but also the 'SolarWinds Orion Module Engine' service. Both services should use the same privileged account.

drockh

We had already set SolarWinds Alerting Engine, SolarWinds Alerting Service V2, and SolarWinds Orion Module Engine all to run as the same domain account on the main poller and still no good. Do we need to do this on all of the pollers? On our Stage server same SAM Version 6.2.2 I only updated the Orion Module Engine and could execute scripts with invoke commands for remote servers. I just can't seem to get any consistencies between the two! =(

Thanks for your responses!

drockh

I just tried creating a batch file that runs the command with test parameters to rule out something funky with PowerShell and that didn't work either... I can just click it on C:\ and it runs fine and in our Stage environment executes fine from alerts

chad.every

Yeah, scripts wont run in the root of C:\ due to permissions. Try moving the .bat file into a folder like C:\Solarwinds\.

You can also redirect the output of the .bat file to capture the console output as shown below. This is what the Execute an external program line would look like.

"C:\SolarWinds\test.bat" > C:\SolarWinds\test_log.txt 2>&1

drockh

Moved everything to a Solarwinds folder on C:\ and still nothing happening and no log getting created. This is definitely giving some clues... It writes nothing to the log file but I can do this same action in Stage and it writes to the file.

drockh

Still banging my head on this one... I loaded up Procmon on Stage where it works and Prod where it doesn't and I am not able to find any differences . I also today tried to just use a very simple command both in the action to create a test file in a directory and via a batch file and that doesn't work either... So it seems Execute an External Program is not working at all with Domain account set for the services. I was able to create a log file in the same directory using the "Log Alert to file" Action so not sure if that rules out some permission thing.

muckman

So the new user impersonation function was released that does't work at all. Did anybody test it?

drockh