Feature Request: Alerting re-write and Windows Event Log

Having been a former user of WhatsUp Gold, I must say that the alerting engine in SolarWinds is cumbersome and very limited. I would like to see the alerting become node based rather than having to write SQL statements for every single possible instance. For example, in WhatsUp Gold, all application, WMI, SNMP, ping monitors are assoicated at the node level. You then have alerting templates that you assign to the node so that if the node goes down, then a group of actions occurs such as emailing a group. You can assign multiple alerting actions to the same node. I have found that with SolarWinds, since we have five groups within IT that all have servers that they are responsible for, and some of those servers, then it is extremely time consuming to write all of the custom rules for the alerting. For example, if the SolarWinds database server has an issue, I have a rule for the DBA group and a rule of the Network Group. Plus there are rules for application status, node status, and a ton of other custom items as well. I have about 30 rules altogether and it's darn near unmanageable.

Also, there doesn't seem to be a way to moniotor event log events. I can do an event log to syslog and then export it to the SolarWinds NPM server, but that gets really messy. I'd rather have a way to directly monitor the Windows Event Logs on servers for critical events directly.

Find more posts tagged with

Alert

Accepted answers

All comments

jeff.stewart

You can use the basic alerts to select nodes for different alerts. Have you looked into that?

freak523

We manage that level of alerting through custom properties that we assign to each of the nodes. While it isn't as clean or as easy as I would like from the alerting standpoint at least using custom properties in my alerts I am able to setup 4 node alerts one for each team in our organization and setup properties to look for just the specific custom property (Owner1 and Owner2 for us). That way if a new node comes up you just have to assign owners to that node and it will automatically be included in the correct alerts.

-David

bmg4357

We have done quite a bit with the custom properties as well, but after a point it gets really ugly. As you add different possiblities for your custom properties, the more rules you have. For example, if John gets all of the node status alerts and application status alerts for the firewalls, spam filters, and network forensic boxes, but Peter wants only the firewalls, but the network group wants to monitor all of those devices, but the DBA group wants to see only the database server for the fornsic boxes, etc. It becomes a spaghetti string very quickly. The way IPSWITCH does it makes perfect sense and it is very much managable.

Yes, I have looked at the basic monitors. It's been a while but I don't think that they were as granular as I needed.

FormerMember

Also, there doesn't seem to be a way to moniotor event log events. I can do an event log to syslog and then export it to the SolarWinds NPM server, but that gets really messy. I'd rather have a way to directly monitor the Windows Event Logs on servers for critical events directly.

As you mentioned, you can do this with the Windows Event Forwarder, but you can also do it with the Application Performance Monitor module.

bmg4357

How do you do this with APM?

FormerMember

APM had a Windows Event log monitor that will look for Windows events. It returns the number of events with a target ID.

I'm also curious: In what way is the Windows Event Log Forwarder "messy"? Is it because you have to install a service on a each device? Do you just not want to send that much data to the Orion syslog?

bmg4357

I know that in the past with other monitoring applications, when a Windows Event Log is forwarded, it is forwarded as a syslog. My experience has been that these applications are generally not very good at interpreting the priority level of the syslog being generated, and usually they have no intelligence at all, so you get everything. I like to have priroity events sent to my pager, but I don't want informational junk.

I saw the Event Log counter in the APM templates, but I don't want to "count" the event ID's. I want the critical items sent in an email to me, and logged away in a database for future reference.