Community
- Command Central
- MVP Program
- Monthly Mission
- Blogs
- Groups
- Events
- Media Vault
Products
- Observability
- Network Management
- Application Management
- IT Security
- IT Service Management
- System Management
- Database Management
Content Exchange
- SolarWinds Platform
- Server & Application Monitor
- Database Performance Analyzer
- Server Configuration Monitor
- Network Performance Monitor
- Network Configuration Manager
- SQL Sentry
- Web Help Desk
Free Tools & Trials

Advanced alerts writting to Text file

Hi everyone,

Need some help and some sanity please

We're trying to send alerts from our Orion NPM server to an incident management system server on a different domain (no trusts, only IP) for incident management automation/creation.

We have tried creating mapped drives using domain and local accounts to the server from Orion and we can write to this location (domain and with local login credentials). However, when we try to extend this to Advanced alerts we either get a bad username and passwords (for UNC) or an error (when using a mapped drive). We suspect this is due to the Orion services running as local system, and therefore doesn't use local and/or domain accounts to write the file when using advanced alerts. Which is a frustration for us as this is integral part of our monitoring solution.

On the event log of the remote server (where we are writing the text file) when UNC fails we see errors with the machine name being used as the logon account! <machinename>$ with the following error 0xC0000064

This is how we came up with the assumption local system is part of the problem. Parallel to this I have raised a trouble ticket directly but I wanted to see if anyone else has experienced this problem and if they have been able to resolve.

Many thanks

Find more posts tagged with

Accepted answers

sean.martinez

In order for the Alerting Service to write files and logs successfully, you will need to change the Service to use a Service Account account that has permissions to write to the Share Folder and has Administrative Access to the Server.

This is for Advanced Alerts only, Basic Alerts will need the Solarwinds Network Perfomance Monitor Service for 10.1.3 and below, or the Solarwinds Collector Service for 10.2 and higher:

1. Go into Services.msc

2. Select the Service you want to modify, in this case the Solarwinds Alerting Service

3. Right click and select Properties

4. Click on the Log On Tab and select the Radio Button for This Account

5. Enter in the Service account that has permissions to the Share Folder.

6. Press OK

7. Right Click on the Service you just Modified and select Restart

(This will change the Running service to the new Account)

All comments

tinTim_MTB

Surprised no one has come across this before.... then again most instances maybe all within trusts. Not so great for MSP's though.

Anyway for the benefit of the community I have included output from a controlled VM test using advanced alerts to a machine on a different domain.

Mapped drive error

11/28/2011 2:12:23 PM: An error was encountered writing to log file('Y:\Mapped_Drive.txt') for alert High Packet Loss Monitoring. - Could not find a part of the path 'Y:\Mapped_Drive.txt'.

UNC error

11/28/2011 2:12:23 PM: An error was encountered writing to log file('\\192.168.10.50\Orion\UNC_TEXT.tx') for alert High Packet Loss Monitoring. - Logon failure: unknown user name or bad password.