Community
- Command Central
- MVP Program
- Monthly Mission
- Blogs
- Groups
- Events
- Media Vault
Products
- Observability
- Network Management
- Application Management
- IT Security
- IT Service Management
- System Management
- Database Management
Content Exchange
- SolarWinds Platform
- Server & Application Monitor
- Database Performance Analyzer
- Server Configuration Monitor
- Network Performance Monitor
- Network Configuration Manager
- SQL Sentry
- Web Help Desk
Free Tools & Trials
Store

Need help with alert for windows event log monitor

OK, so I scanned the forums here and was able to get most of the following done:

I need to monitor the event logs on a particular server, and when a specific event goes into the log, I need to generate an alert and send an email.

I found the "Errors in Application Event Log" template in the Application Monitor templates and told it I wanted to monitor a particular event and when it found one go into a critical status. Then I went to the Alert Monitor and set up an alert so that when this specific server had statistic data (component alerting) greater than 0 and the component type (component alerting) = 42 (which from my reading means windows event log monitor), that it would create the trigger condition. Then the trigger action was to dump an alert in the NPM event log and send an email that the event was in the event logs on the server (I haven't even figured out how to put a copy of the event entry into the email). The alerts go out to the log just fine, and when I simulate the email alert it looks pretty innocuous and even the test execution works, but the actual email alert itself never goes out. I have even stayed with the default variables for the most part, but did add the variable below to the body of the message. Still no email alert. Any ideas of what I am doing wrong? Thanks for any assistance.

${N=SwisEntity;M=ComponentAlert.WindowsEventMessages}

Find more posts tagged with

Accepted answers

All comments

mesverrum

The variables you put in the alert shouldn't cause it to not go out, they either show up correctly, null out, or if the syntax is wrong it just includes them as a normal string of characters.

Are you saying that the Alert never triggers even when you know it should be? Presumably the component is showing as down/critical but the alert isn't firing?

Instead of setting the alert to monitor the component for a statistic data count I would just set it to monitor this component for status = down or critical, I don't recall off hand which status the event log monitor normally goes into when it sees the event in question. Do you have an AND somewhere that should be an OR in the trigger?

Beside making sure your trigger is functional,

Do you get other alerts from Solarwinds right now?

Is the To: email address correct?

Are the SMTP settings for this Email action correct?

-Marc Netterfield

Loop1 Systems: SolarWinds Training and Professional Services

LinkedIN: Loop1 Systems
Facebook: Loop1 Systems
Twitter: @Loop1Systems

pch

I agree, the variable shouldn't prevent the email from going out. The preview of the email looks good. The alert to the NPM triggers but the email never does. I have those two actions in the alert. I actually copied this from another alert that is working properly, making an entry in the NPM alert and sending out an email (the two trigger actions). The trigger condition is that it must be the specific computer and the statistic data is greater than 0 (maybe I should get rid of this condition, I added it based on other forum discussions of those trying to do what I am doing) AND the component type is equal to 42. That way the trigger isn't just that the system is in a critical state because I want it to focus on the event id entry into the log. If it was an issue with the triggers, you would think the NPM alert entry wouldn't fire, either, but it is just the email that doesn't fire. The smtp and recipient settings are correct. A while back I had an issue with an alert where the NPM alert would fire but the corresponding email wouldn't fire because the object in question was using icmp for monitoring. While that is not the case here, t mentioned this, because there could be something funky along those lines.

pch

OK, so almost a week after I set this up, it just suddenly started working correctly. The mails went out when the alerts got entered into the NPM event logs. No changes were made, no reboots were done, nothing. It just started working.

pch

OK, it looks like it is working correctly SOMETIMES!!!!! The alert always goes out but not the email. Sometimes it goes out and sometimes it doesn't. Any ideas?