New to SAM and bogged down by email alerts.

lokean13

Hello, I just got my SAM install up and running and I'm getting a million alerts and I'm not sure what they all mean.  For example:

The application Windows Server 2008-2012 Domain Controller Security on ******** is currently in a state of "Down". This application was last seen in an "Up" status on 2/1/2016 7:53:33 AM. The following is a list of components in this application presently in distress.

Logon: Attempted logon using explicit credentials(Down)

Click the link below for more information related to this application:

Can anyone tell me what this means and why I keep getting notified about it?  Should I use an agent instead of WMI?  The other thing is, when someones account is locked out because of an incorrect password it sends me a cryptic email and I have to log into SAM to see who it is rathe rthan just sending me an email saying: "This user just got locked out"  Is there a way to change that?

Thanks for the newb help.

aLTeReGo

The "Windows Server 2008-2012 Domain Controller Security on ******** is currently in a state of "Down" alert is being generated as a result of a match having been found in the monitor. The "Down" status is simply reflecting this needs attention. This is a generic out-of-the-box alert entitled "Alert me when an application goes down", which can be configured to exclude specific templates if so desired.

If you would like the WIndows Event Log Message details in the email body text, edit the "Alert me when a component goes down" alert and  add the ${N=SwisEntity;M=ComponentAlert.WindowsEventMessages} macro to the email alert trigger action.