Event Alert Question

Use properties and variables in SAM application monitors and component monitors in alerts

Have you tried these:

${ComponentMessage}

${WindowsEventMessages}

${StatusOrError

Description}

I will give those a try and see what comes up.  Thank you.

Yeah that did not pull anything into the alert.   

Here is the event log in Orion -

I wonder if some SWSQL magic would work. 

martian monster​ Are you actually pulling, or sending, those events to Orion, or are you just having Orion check them and return and yes/no?

wluther     I am not sending the events to Orion. I have the monitor checking the event log and then returning a yes/no to Orion.  Judging by your statement because I am not sending the actual events to Orion I probably can't add them to an alert? This is my first time working with the Event Log monitoring/alerting so I am learning a bit as I go here.  Thanks

martian monster​ If your logs are there, for that Windows Server, you should be able to see them in the "Orion.APM.WindowsEvent" table with this SWQL query.

SELECT
EventCode
,TOLOCAL(TimeGeneratedUtc) AS TimeStamp
,ComputerName
,SourceName
,User
,Message
FROM Orion.APM.WindowsEvent
WHERE EventCode = 10028

Well, I'm pretty sure you have the logs, as long as that last screenshot was from a SAM app/component monitor page. At least I think you should.

That worked!! I have just dabbled in SWQL a little bit but more and more I am thinking I need to try to work on SWQL a bit more.  If I put this query in the alert when it fires it will add that information to the alert and I can edit what I would like in the alert?

That worked!! I have just dabbled in SWQL a little bit but more and more I am thinking I need to try to work on SWQL a bit more.  If I put this query in the alert when it fires it will add that information to the alert and I can edit what I would like in the alert?

martian monster​ I think you would probably be better off, if possible, to simply add that specific event to its own component monitor. That should allow you to pull all the data via the variables.

I THINK that should dump all the info you need into a component which you can then reference within the alert.

Is this how you already have it setup, or are you monitoring it a different way?

I have the monitor setup like above - one component to one event ID to make things simple. 

And I cannot thank you enough for this.  I have a dashboard setup to report on DC 'things' and added a widget to it and put that SWQL query on it and made it searchable. 

Thank You wluther​ you made my Friday afternoon and everyone else here that was using the old hunt and peck game for account lockouts!! 

Could you include a screen shot of your alert configuration for that specific event id in this post?  The summary page would be great!