Community
- Command Central
- MVP Program
- Monthly Mission
- Blogs
- Groups
- Events
- Media Vault
Products
- Observability
- Network Management
- Application Management
- IT Security
- IT Service Management
- System Management
- Database Management
Content Exchange
- SolarWinds Platform
- Server & Application Monitor
- Database Performance Analyzer
- Server Configuration Monitor
- Network Performance Monitor
- Network Configuration Manager
- SQL Sentry
- Web Help Desk
Free Tools & Trials

Email alert logging

I have been asked to check whether an e-mail alert went out for one of the alerts we have configured. Where can I find this information? There is a post from about 7 years ago mentioning "swalert.log" but I can't seem to find this file or any like it.

Find more posts tagged with

Accepted answers

All comments

brandon.blaze

You should be able to go to the Alerts section of NPM. Click on the alert that was triggered and it will show you all events that were triggered from that alert. In the list you'll see if the e-mail was generated by NPM. If you're looking to find out if the e-mail hit your server, you may want to check your logs on the server itself to see if it's maybe an authentication or destination address issue.

If you're checking the functionality of e-mails generated from alerts in general, you can always edit the alert and go to the "Trigger Conditions" section, simulate the alert condition of sending the e-mail and determine if it ever reaches you. If not, you'll know that you need to check the account/SMTP settings/etc. associated with NPM and your mail server.

Not sure if any of that is relevant to your question/situation, but it's the first thing that came to mind.

-Brandon

ttl

Thanks. Unfortunately the Alerts section only shows current alerts; the system has since been rebooted and come back up, so the alert is no longer in effect and doesn't show up.

rkavanagh

I'm not sure about logging whether an email has succeeded, but it is definitely logged when an email fails. Go to Event Viewer and expand the Applications and Services Logs. There will be a whole log dedicated exclusively to SolarWinds. If an email fails to send, it will be logged here as an error with the AlertingEngine as a source.

superfly

Maybe you could do a feature request to get "Historical Alerts" added to NPM views. It would be a good idea so see this if looking at a device as it shows a quick history of what has been going on for say the last 7 days.

rkavanagh

There's always events if you needed this sort of information. We tend to set up a custom table resource on a morning checklist summary page that will show events from the last 16 hours meeting the "alert triggered" type. You could set up a similar resource on the node details view to show alert triggered events for just that node, and from the last 7 days.

Going back to ttl's query though, this unfortunately doesn't give any indication about whether an email was successfully delivered - only that the alert was triggered.

superfly

Yeah I'm aware of events but not all events trigger an alert. And yes you could get crafty and display some events but that still doesn't guarantee if an alert was generated. I think it would be handy to see historical alerts.

smp

You can generate a report using Report writer for Event Type like 1000, 1001 & 1002 which will tell you if any errors are there in alert triggering. If any email alerts failed it will be shown in this events.

Another option is to check the ActionsExecutionAlert text document in C:\ProgramData\Solarwinds\Logs\Orion. Also check AlertHistory table in database.

300

Hi ttl,

I am trying to find the same.

Were you able to find a way to check whether and email alert was sent or not for a monitor?

yaquaholic

300 Have a look at your AlertHistoryView in your DB, you can uses this SQL in SQL studio or adapt for a report:

SELECT TOP (50) [AlertHistoryID],[AlertID],[TimeStamp],[EventTypeWord],[Name],[ObjectType],[AlertEnabled],[Frequency]

,[Message],[AccountID],[AlertActiveID],[AlertObjectID],[ActionID],[ActionTypeID],[Title],[RealEntityType],[TriggeredCount]

,[EntityNetObjectId],[EntityCaption],[EntityDetailsUrl],[RelatedNodeCaption],[RelatedNodeDetailsUrl],[RelatedNodeId]

,[LastTriggeredDateTime],[AlertNote],[AlertRefID],[BlockUntil],[NotifyEnabled],[LastEdit],[CreatedBy],[Canned],[Category],[Severity]

FROM [SolarWinds].[dbo].[AlertHistoryView]

WHERE ActionTypeID LIKE 'Email'

Name is the Alert Name, Title is the Alert Action name.

That should get you started

300

Thank you yaquaholic
I'll start from there