Powershell Script Execution from Alert

I have a powershell script which I am triggering on an alert which I want to run against the remote system from which the alert was generated. From other articles on here I believe I have the syntax correct, and the alert says the script ran, but clearly it hasn't done what it's meant to. Where do I find the SolarWinds log file which should contain the script execution to see if it has correctly passed the node name for the script? I am passing.. C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Invoke-Command -ComputerName ${N=SwisEntity;M=Node.SysName} "C:\Utils\Scripts\C-Cleanup-Script.ps1" I have also updated the Orion Module Engine service to run as a domain account with the correct permissions to the remote machine.

Find more posts tagged with

remote

PowerShell

Alerts

Accepted answers

All comments

sturdyerde

You should be able to pass the variable ${N=SwisEntity;M=Node.Caption} to your PowerShell command line parameters or into a PowerShell script as a parameter.

If you need the FQDN, then try using ${N=SwisEntity;M=Node.DNS}. Your reference to the SysName will probably work sometimes, but a lot of us have found it to be less consistent than the node caption attribute.

While troubleshooting, you may also have success with the following command line parameters for your alert action configuration (assuming that the scripts exists on the Orion server that is running the Orion module service). Please note one important difference here: Invoke-Command is a PowerShell commandlet, but -Command is a usable parameter for running the PowerShell executable.

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe -ExecutionPolicy Bypass -NoLogo -NonInteractive -NoProfile -Command {Invoke-Command -ComputerName ${N=SwisEntity;M=Node.Caption} -FilePath "C:\Utils\Scripts\C-Cleanup-Script.ps1"}

Invoke-Command

about_PowerShell_exe - PowerShell | Microsoft Docs

This certainly does get hard to wrap your head around when considering which identity the script is being run as (is it set by the alert action, or is it run under the identity of the Orion module service?)!

lufffunk

So turns out this might be a bug. First you need to set the Orion Engine service to run as an account that has the correct permissions to the nodes - once you do this the job works correctly... However, if you have an APE the nodes monitored by this wont work. In our environment we use APE on isolated networks where the MPE can't access the nodes (we don't need them for capacity reasons). And this is where things don't work. We have a ticket in now with development team.

sturdyerde

Interesting. Please share the results of this ticket.

lufffunk

Sorry, I should have explained that I had a support Web session and ran through this. It's deffo a limitation with the APE, only the MPE has the alert functionality in it - so it's not telling alerts to run via the APE therefore will never work. The trigger itself works fine... just the action.

sturdyerde

Oh, interesting. So alerts won't run on an APE, even if the node in question is being monitored by the APE and the Orion engine service is running on both PEs?

lufffunk

Response from SolarWinds support... "Be informed that Dev Team confirmed that the issue is not a limitation and this is by own design. Alerting only executes on the main server, action will not execute because the main server can't physically reach node which is assigned to an APE." I have said this is not acceptable, if an APE is able to detect node issues then they should be able to run execute jobs from them as well. Our APE is on a separate network to the MPE therefore needs to be able to do this. They have put a request to their development team using but I will log the feature request for voting as well as it doesn't make sense.