Community
- Command Central
- MVP Program
- Monthly Mission
- Blogs
- Groups
- Events
- Media Vault
Products
- Observability
- Network Management
- Application Management
- IT Security
- IT Service Management
- System Management
- Database Management
Content Exchange
- SolarWinds Platform
- Server & Application Monitor
- Database Performance Analyzer
- Server Configuration Monitor
- Network Performance Monitor
- Network Configuration Manager
- SQL Sentry
- Web Help Desk
Free Tools & Trials
Store

Help creating alert on back of Powershell Component Monitor

I have created a SAM application monitor with a Powershell monitor to check for a status of a registry key, and now want to create an alert based on the output of the script. I can't see how to do this and have been going round in circles for some time.

It's probably something simple but not finding it. The KB Create a Windows PowerShell monitor doesn't state how to create an alert off the back of that.

Unfortunately this is something I've not done before so any help appreciated.

Thanks!

Find more posts tagged with

Accepted answers

All comments

brscott

Here's a nice PDF.

http://cdn.swcdn.net/creative/pdf/techtips/how_to_create_intelligent_alerts_with_npm.pdf

That PDF comes from this page: Success Center

This example alerts on components, I prefer to alert on the application, but it's all about preference. Unfortunately there are several ways to do anything. That can make it confusing at first.

Play around with new alerts and actions. You'll be back with a LOT more questions.

tobyw7

Hi Brian

Thank you, so it looks like I was doing the alert slightly wrong and needed to assign the powershell script to a node too.

Problem now is I don't know how to parse the result of the powershell script to the alert. I'll do some more digging.

adam.beedell

Create application monitor with a component with whatever the check is
Create alert, alert on Application or Component (recommend the former)
If Application Name = [Whatever you called it]

AND

Application Status = Down/Warning/Crit/Unknown

Alert accordingly

tobyw7

Thanks Adam!

After a couple of coffees this morning I figured that much out. I was pretty tired on Friday and just couldn't work it out how to get it to alert but then went back and figured out how to have it flag as critical or warning based on the script output.

sturdyerde

Can you post what you have so far in your script monitor? (Leaving out specific user credentials and hostnames.)

tobyw7

I have this at the minute in the script -

Argument:

HKLM:\Software\Wow6432Node\Bond International Software\Adapt\ESS_001\,DEMON,Y

Script:

param(

[string]$reg,

[string]$Key,

$target_value

)

$reg_value = Get-ItemProperty $reg -name $Key

Write-Host "Message: '$reg' is currently set to '$reg_value'"

if ($reg_value -match "$key=$target_value") {

Write-Host "Statistic: 0"

} else {

Write-Host "Statistic: 1"

}

Exit 0

For the script output I currently have this,

I only really want it to alert if critical. Can I leave the warning field blank?

sturdyerde

So is the script currently giving you the output that you want?
If so, is a value of '0' or '1' critical and the other a warning? Or to word it differently, what condition would be considered critical?

adam.beedell

Warning and critical as the same number will make it critical so no changes needed on that front.

Your powershell is missing a 'Targeting' section, so when it runs it asks the server it's assigned to rather than the polling engine, use ${IP} or similar to feed it in the server details. (unless you're using 'Execution mode: remote host'?)

I havn't checked the rest of the code, seems legit, right at the end of a shift here, there's one good article around here somewhere about getting powershell monitors to work, it can be fiddly.

tobyw7

I have it set that if the registry key doesn't match the correct value alert with an output of 1, and for the rest of the time remain with 0. With the current settings, the alert does fire. I just need it to be critical if the value doesn't match.

tobyw7

Thanks again for the help!

The execution mode is set to local host but it is the assigned server where we want to get the result from, so that's correct isn't it?

Like you say it's been a bit of a steep learning curve with this one but good to try something new

tobyw7

Okay, so we had a problem where this actually did alert but didn't fire any emails out. I've gone over the alert but for now can't see why it hasn't alerted?

We've tested by switching the registry key and it shows as critical from the node screen in Solarwinds

But after 10 minutes the alert is not triggering the email and it isn't showing in the list of active alerts

Note: when submitting the alert and saving, the alert says it will trigger on one object, but we have tested and it doesn't seem to work.

Anything wrong? I have set the component instance to the registry check component on the node.

adam.beedell

That alert logic looks weird but probably fine (the 3 conditions could all be alone without the extra "AND" blocks, and a single nodename under an OR condition is odd)

Is it that the alert didn't fire, or the email didn't arrive?

The event you've listed suggests the powershell is fine

The "will trigger on one object" sounds like the alert logic is fine

Assuming you dont have additional rules setup about it needing to last for a long time before triggering it should go off almost immediately after you hit save. You should be able to test removing conditions and seeing if the predicted/actual triggers change

I'd guess it might be something with the Component Availability rule (try Status instead) if the alert itself isnt going off.

Maybe just name the application instead of using Instance

If the alert is going off but the email isnt arriving check if the DL/mailbox its going to allows unauthenticated senders (if your email isnt bouncing through a mailbox). Your exchange admins might need to assist

tobyw7

Hi Adam

Thanks for the quick reply.

I think it's a bit of both, both the alert didn't fire (not visible in Alerts view) and the email didn't send because the alert didn't fire?

We have the registry key set to the value where it should alert and it shows the component status as Critical. I have changed the alert to trigger by Status = Critical, and it shows that it will trigger.

I have also changed it to read "Application Instance is" and then choose then name of the check as below. Is that what you meant?

I've unticked the "condition must exist for more than xx minutes" so like you say it should fire straight away....

This is what is displayed -

tobyw7

Ah, just went back and changed the alert trigger conditions to the following and it's fired straight away.

Thanks!!

tobyw7

To follow on, the alert only seemed to fire if I removed the must exist for xx minutes. Not sure why But that is working now. Thanks for your help adam.beedell