Community
- Command Central
- MVP Program
- Monthly Mission
- Blogs
- Groups
- Events
- Media Vault
Products
- Observability
- Network Management
- Application Management
- IT Security
- IT Service Management
- System Management
- Database Management
Content Exchange
- SolarWinds Platform
- Server & Application Monitor
- Database Performance Analyzer
- Server Configuration Monitor
- Network Performance Monitor
- Network Configuration Manager
- SQL Sentry
- Web Help Desk
Free Tools & Trials

Making alert for user lockouts with user details

I’ve been trying to setup an alert in Orion (I have SAM as well) that will tell me when a user is locked out and what user it is. I have the alert looking at the correct component and the right server but when I enter ${N=SwisEntity;M=ComponentAlert.WindowsEventMessages} I don’t get any results. Can anyone point me in the right direction?

Here is my alert

Only following set of objects

-Node display name is equal to MYPDC

Trigger
Componet Componet name is equal to Account was locked out

No reset

Send message to ME

[Message Body] ${N=SwisEntity;M=ComponentAlert.WindowsEventMessages}

But when I get the email it is blank. What am I missing

Find more posts tagged with

Accepted answers

mesverrum

So looking at the message you have the correct variable, and it works fine for me in my lab. On the alert are you setting the object of the alert to be a component or something else?

All comments

steffen.gutzeit

Hello.

That's where the Log Analyzer module would come in handy. As soon as a certain Windows event is being triggered, you'll be able to see it easily via tags and to also have an alert being created that could have the trigger action of sending you an email.

Log Analyzer demo: https://oriondemo.solarwinds.com/ui/orionlog/logviewer/

Cheerio,

Steffen

wdecatur

Well currently I am using SEM\LEM and that generates the alert with the user's name but I want to use SAM. I have SAM sending me an alert when a user locks themselves out, at the moment it sends me that alert every 30 seconds so that's a problem but that I believe I can solve. But that alert from SAM just says there is a user locked out, nothing more. I also have another SAM alert that tells me that the "Domain controller security" went down and that also includes user lockouts, but again that doesn't display the user either.

I am trying to avoid using LEM as I want Orion to be the primary console people log into and at some point I want to have everything in LEM appear in Orion (Syslog page). If I HAVE TO I'll stick with the LEM alert but I don't like it.

I've been looking through Thwack and it appears that this is possible but none of those suggestions I've found work for me.

mesverrum

So looking at the message you have the correct variable, and it works fine for me in my lab. On the alert are you setting the object of the alert to be a component or something else?

wdecatur

Because this wasn't doing what I wanted I decided that I would just stick with LEM as that was easy enough to configure and has been running well for the last couple weeks. I just disabled this entirely within SAM, seems pointless to have a monitor built in that displays locked users but won't tell you who and will label the entire server as being down