I have tagged the template 'Errors in Application Event Log' for few devices and i get mail stating that error has detected but it doesnt display the error message which is detected ?
Ia it possible to include it in the alert mail ?
You'd probably have to create a customer alert specific to this type of event.
Then in the Alert Body of the email, you'd have to send over a custom SWQL Query (or maybe not, as I don't have any errors in my event logs and might be doing this the hard way)
SELECT TOP 1 CONCAT('Error ID ', [CompStat].PortEvidence.ErrorCode, ': ', [CompStat].PortEvidence.ErrorMessage) AS [ErrorBody]FROM Orion.APM.ComponentStatus AS [CompStat]WHERE [CompStat].ComponentID = ${N=SwisEntity;M=ComponentID}ORDER BY [CompStat].ObservationTimestamp DESC
Thanks
let me check and confirm you
If you are using a Component alert, you should be able to use the WindowsEventMessages variable to show the detected events for an Event Log component monitor.
${N=SwisEntity;M=ComponentAlert.WindowsEventMessages}