Embedding output into an alert email action

Hello everyone,

I'm stuck and I'm not sure what to do next.  First the disclaimer,  I am NOT a programmer, so the majority of my code was inherited by a lot of you in the community or in the Google universe.  

Objective:

Embed output from a batch file into an email alert action.  The output is ping and tracert results from the poller to the device.

Trigger Actions - Configuration Settings:

1st trigger is Execute An External Program:

Network path to external program = c:\Scripts\Ping-TraceRT.bat ${IP_Address} ${NodeName} -alert=${N=Alerting;M=AlertDefID} -alertId=${N=Alerting;M=AlertID} -${N=Alerting;M=Notes}

I'm receiving the expected output (ping and tracert) results in the text file.

2nd trigger is Send An Email/Page:

Message body:

Device Name: ${NodeName}
IP Address: ${N=SwisEntity;M=IP_Address}
Status: ${N=SwisEntity;M=Status}
Group: ${N=SwisEntity;M=CustomProperties.Assignment_Group}
Priority: ${N=SwisEntity;M=CustomProperties.Priority}
Date: ${DateTime}
Polling Engine: ${N=SwisEntity;M=Engine.DisplayName}

Ping & Tracert Information:
${N=Alerting;M=Notes}

The email doesn't contain any of the expected output from the batch file.  My first thought is that I'm missing something in script, but I'm not sure what that is and I'm not sure how I would code it.

Attached is the batch file I'm using.

Ping-TraceRT.bat
@echo off

  cd C:\Scripts

  rem: This sends the Orion variables to a text file for later analysis.  This overwrites existing files of the same name.

  echo %* > %2.txt

  rem: This appends a ping to the text file.  This appends to the current file.

  ping %1 >> %2.txt

  rem: This appends a tracert to the text file.  This appends to the current file.

  tracert %1 >> %2.txt


Parents
  • How is your batch file updating the Notes field?  It doesn't look like there's any mechanism to put the contents of your text file back into the Alert Notes.

  • Thanks !  Last time I saw you was SWUG AZ right before the pandemic.  I hope you and your family are doing well.

    Do you by chance have any examples of what that code should look like in the script or is there some documentation that I can work off of?  In the meantime I'll look online and give it a try.

    Thanks again.

  • OMG - I think I've been leading you down the complete wrong path here.  Let me investigate something...

  • No worries.  Wink Just as an fyi, I did follow the steps above and I did receive output (similar to yours) for the Alert Notes. I ran it in CMD with the service account.

  • After re-reading the names of the verbs and having a come to $diety meeting with myself, I think we need to use the AddNote verb on the Orion.AlertStatus entity.For parameters it takes:

    • [string]alertDefinitionId
    • [string]activeObject
    • [string]objectType
    • [string]note

    Like I said before, I need to dig in a little bit more here and do some testing, but the framework we already have should work.  I'm so, so sorry for the delay.

  • No need to apologize.  I REALLY appreciate your help with this. I'm learning a lot and it's forcing me out of my comfort zone by getting me to learn the code so that I can do this myself going forward. 

  • OK - I think I've got it (but I've said that before haven't I?)

    The files are:

    I've rewritten them to be a little more in line with some best practices, but it's not my best work.

    I also added notes/details in the first one on how to call it.

    After I executed it, this is what appeared on my web console:

    Let's (hopefully) call that part done.  You can validate after you make the edits by running:

    SELECT AlertDefID
         , ActiveObject
         , ObjectType
         , ObjectName
         , AlertMessage
         , Notes
    FROM Orion.AlertStatus
    ORDER BY ObjectName

    In SWQL Studio and looking at the "Notes" field.

    In my environment, the total execution time for the script was 1.39 minutes - so under the 5 minute thing.

  • Verified that this works on two nodes running the script through the command line.  Just like you I received the correct information in the History of this alert on this object and in the Alert Notes field.  Both ran under 2 minutes.

  • Let's count this as step 1 being complete.  The script works and updates the notes.  Hopefully the second part (your email message) picks up the details. Fingers crossed

    Let me know how you fare. (I don't have email enabled in my home lab, so that's one part that I cannot test properly).

  • Seems to only work through the command line and not through the alert action.  I tested six devices and none of them show any of the ping & tracert information.  I checked the Orion.AlertStatus and none of them have a note.  I added the parameters in prior to enabling the alert with the below information.  The interesting thing is that the variable search page does not have an ActiveObject option.  I went ahead and added it manually ${N=Alerting;M=ActiveObject} but that didn't help and also tried "${N=Alerting;M=AlertID}" which was listed in the search options.  That didn't work either.  I also tried putting the IP address, AlertDefID, ActiveObject and Node and that didn't work. Both actions are set with the service account for authentication.  I also tried it with Default System and that didn't fix it.  All the simulation tests have been successfully with no errors.

    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Unrestricted -File "C:\Scripts\Ping-TraceRT.ps1" "${N=SwisEntity;M=IP_Address}" "${N=Alerting;M=AlertDefID}" "${N=Alerting;M=AlertID}" "Node"

  • Line 29 of Ping-TraceRT.ps1 has the syntax for this execution.

  • Sorry about that.  I pasted the correct path and on the alert it shows it runs, but no output in the Alert Notes or emails

    TEST_+Server_+Device+Down (2).xml
    <AlertDefinition xmlns:i="http://www.w3.org/2001/XMLSchema-instance" xmlns="http://schemas.datacontract.org/2004/07/SolarWinds.Orion.Core.Alerting.Models"><AlertID>1289</AlertID><AlertMessage>${N=Alerting;M=Severity}: ${NodeName} is ${N=SwisEntity;M=Status}</AlertMessage><AlertRefID>276432a5-6fba-4525-8fe1-f7ba30c5931a</AlertRefID><Canned>false</Canned><Category /><CreatedBy>sbolyard</CreatedBy><CustomProperties xmlns:d2p1="http://schemas.microsoft.com/2003/10/Serialization/Arrays" /><Description>SolarWinds monitors the ping response of each device via the ICMP protocol. Alert is configured to send appropriate actions when the device has not made a ping response continuously for 4 minutes.</Description><Enabled>true</Enabled><ExecutionTimePeriods xmlns:d2p1="http://schemas.solarwinds.com/2008/Core" /><Frequency>PT1M</Frequency><LastEdit>2021-07-23T16:41:11.5466667Z</LastEdit><Name>TEST: Server: Device Down</Name><NotificationEnabled>true</NotificationEnabled><NotificationSettings xmlns:d2p1="http://schemas.solarwinds.com/2008/Core"><d2p1:Enabled>true</d2p1:Enabled><d2p1:NetObjectType>Node</d2p1:NetObjectType><d2p1:Severity>Warning</d2p1:Severity><d2p1:Subject>PS_Server Down_NOC_P1</d2p1:Subject><d2p1:_properties xmlns:d3p1="http://schemas.microsoft.com/2003/10/Serialization/Arrays"><d3p1:KeyValueOfstringAlertNotificationProperty9sQWCBBt><d3p1:Key>IP Address</d3p1:Key><d3p1:Value><d2p1:Name>IP Address</d2p1:Name><d2p1:Value>${IP_Address}</d2p1:Value></d3p1:Value></d3p1:KeyValueOfstringAlertNotificationProperty9sQWCBBt><d3p1:KeyValueOfstringAlertNotificationProperty9sQWCBBt><d3p1:Key>Object Sub Type</d3p1:Key><d3p1:Value><d2p1:Name>Object Sub Type</d2p1:Name><d2p1:Value>${ObjectSubType}</d2p1:Value></d3p1:Value></d3p1:KeyValueOfstringAlertNotificationProperty9sQWCBBt><d3p1:KeyValueOfstringAlertNotificationProperty9sQWCBBt><d3p1:Key>Status Description</d3p1:Key><d3p1:Value><d2p1:Name>Status Description</d2p1:Name><d2p1:Value>${StatusDescription}</d2p1:Value></d3p1:Value></d3p1:KeyValueOfstringAlertNotificationProperty9sQWCBBt><d3p1:KeyValueOfstringAlertNotificationProperty9sQWCBBt><d3p1:Key>Node Name</d3p1:Key><d3p1:Value><d2p1:Name>Node Name</d2p1:Name><d2p1:Value>${SysName}</d2p1:Value></d3p1:Value></d3p1:KeyValueOfstringAlertNotificationProperty9sQWCBBt><d3p1:KeyValueOfstringAlertNotificationProperty9sQWCBBt><d3p1:Key>Vendor</d3p1:Key><d3p1:Value><d2p1:Name>Vendor</d2p1:Name><d2p1:Value>${Vendor}</d2p1:Value></d3p1:Value></d3p1:KeyValueOfstringAlertNotificationProperty9sQWCBBt></d2p1:_properties></NotificationSettings><ObjectType>Node</ObjectType><Reset><Conditions><ConditionChainItem><AndThenTimeInterval i:nil="true" /><ChainType>ResetInverseToTrigger</ChainType><Condition xmlns:d5p1="http://schemas.datacontract.org/2004/07/SolarWinds.Orion.Core.Models.Alerting" i:nil="true" /><ConjunctionOperator>None</ConjunctionOperator><IsInvertedMinCountThreshold>false</IsInvertedMinCountThreshold><NetObjectsMinCountThreshold i:nil="true" /><ObjectType i:nil="true" /><SustainTime i:nil="true" /><Type i:nil="true" /></ConditionChainItem></Conditions></Reset><ResetActions xmlns:d2p1="http://schemas.solarwinds.com/2008/Orion" /><Severity>Critical</Severity><Trigger><Conditions><ConditionChainItem><AndThenTimeInterval i:nil="true" /><ChainType>Trigger</ChainType><Condition xmlns:d5p1="http://schemas.datacontract.org/2004/07/SolarWinds.Orion.Core.Models.Alerting" xmlns:d5p2="http://schemas.datacontract.org/2004/07/SolarWinds.Orion.Core.Alerting.Plugins.Conditions.Dynamic" i:type="d5p2:AlertConditionDynamic"><d5p2:ExprTree><d5p1:Child><d5p1:Expr><d5p1:Child><d5p1:Expr><d5p1:Child /><d5p1:NodeType>Field</d5p1:NodeType><d5p1:Value>Orion.Nodes|Status</d5p1:Value></d5p1:Expr><d5p1:Expr><d5p1:Child /><d5p1:NodeType>Constant</d5p1:NodeType><d5p1:Value>2</d5p1:Value></d5p1:Expr></d5p1:Child><d5p1:NodeType>Operator</d5p1:NodeType><d5p1:Value>=</d5p1:Value></d5p1:Expr><d5p1:Expr><d5p1:Child><d5p1:Expr><d5p1:Child i:nil="true" /><d5p1:NodeType>Field</d5p1:NodeType><d5p1:Value>Orion.NodesCustomProperties|Purpose|CustomProperties</d5p1:Value></d5p1:Expr><d5p1:Expr><d5p1:Child i:nil="true" /><d5p1:NodeType>Constant</d5p1:NodeType><d5p1:Value>Server</d5p1:Value></d5p1:Expr></d5p1:Child><d5p1:NodeType>Operator</d5p1:NodeType><d5p1:Value>=</d5p1:Value></d5p1:Expr></d5p1:Child><d5p1:NodeType>Operator</d5p1:NodeType><d5p1:Value>AND</d5p1:Value></d5p2:ExprTree><d5p2:Scope i:nil="true" /><d5p2:TimeWindow i:nil="true" /></Condition><ConjunctionOperator>None</ConjunctionOperator><IsInvertedMinCountThreshold>false</IsInvertedMinCountThreshold><NetObjectsMinCountThreshold i:nil="true" /><ObjectType>Node</ObjectType><SustainTime>PT4M</SustainTime><Type xmlns:d5p1="http://schemas.datacontract.org/2004/07/SolarWinds.Orion.Core.Alerting.Plugins.Conditions.Dynamic" i:type="d5p1:ConditionTypeDynamic" /></ConditionChainItem></Conditions></Trigger><TriggerActions xmlns:d2p1="http://schemas.solarwinds.com/2008/Orion"><d2p1:ActionDefinition xmlns:d3p1="http://schemas.solarwinds.com/2008/Core" i:type="d3p1:ActionDefinitionEx"><d2p1:ActionProperties><d2p1:ActionProperty><d2p1:IsShared>false</d2p1:IsShared><d2p1:PropertyName>EmailBCC</d2p1:PropertyName><d2p1:PropertyValue /></d2p1:ActionProperty><d2p1:ActionProperty><d2p1:IsShared>false</d2p1:IsShared><d2p1:PropertyName>EmailCC</d2p1:PropertyName><d2p1:PropertyValue /></d2p1:ActionProperty><d2p1:ActionProperty><d2p1:IsShared>false</d2p1:IsShared><d2p1:PropertyName>EmailFrom</d2p1:PropertyName><d2p1:PropertyValue>Mail@HH.com</d2p1:PropertyValue></d2p1:ActionProperty><d2p1:ActionProperty><d2p1:IsShared>false</d2p1:IsShared><d2p1:PropertyName>EmailMessage</d2p1:PropertyName><d2p1:PropertyValue>Auto-Ticket created for:
    
    Device Name:  ${NodeName}
    IP Address:  ${N=SwisEntity;M=IP_Address}
    Status:  ${N=SwisEntity;M=Status}
    Group:  ${N=SwisEntity;M=CustomProperties.Assignment_Group}
    Priority:  ${N=SwisEntity;M=CustomProperties.Priority}
    Date:      ${DateTime}
    Polling Engine:  ${N=SwisEntity;M=Engine.DisplayName}
    
    Ping &amp; Tracert Information:
    ${N=Alerting;M=Notes}
    
    Alert URL: ${N=Alerting;M=AlertDetailsUrl}  
    Alert Name: ${N=Alerting;M=AlertName}</d2p1:PropertyValue></d2p1:ActionProperty><d2p1:ActionProperty><d2p1:IsShared>false</d2p1:IsShared><d2p1:PropertyName>EmailTo</d2p1:PropertyName><d2p1:PropertyValue>user@HH.com</d2p1:PropertyValue></d2p1:ActionProperty><d2p1:ActionProperty><d2p1:IsShared>false</d2p1:IsShared><d2p1:PropertyName>EscalationLevel</d2p1:PropertyName><d2p1:PropertyValue>5</d2p1:PropertyValue></d2p1:ActionProperty><d2p1:ActionProperty><d2p1:IsShared>false</d2p1:IsShared><d2p1:PropertyName>executionIfAknowledge</d2p1:PropertyName><d2p1:PropertyValue>False</d2p1:PropertyValue></d2p1:ActionProperty><d2p1:ActionProperty><d2p1:IsShared>false</d2p1:IsShared><d2p1:PropertyName>executionRepeatTimeSpan</d2p1:PropertyName><d2p1:PropertyValue>0</d2p1:PropertyValue></d2p1:ActionProperty><d2p1:ActionProperty><d2p1:IsShared>false</d2p1:IsShared><d2p1:PropertyName>MessageContentType</d2p1:PropertyName><d2p1:PropertyValue>1</d2p1:PropertyValue></d2p1:ActionProperty><d2p1:ActionProperty><d2p1:IsShared>false</d2p1:IsShared><d2p1:PropertyName>Priority</d2p1:PropertyName><d2p1:PropertyValue>0</d2p1:PropertyValue></d2p1:ActionProperty><d2p1:ActionProperty><d2p1:IsShared>false</d2p1:IsShared><d2p1:PropertyName>Sender</d2p1:PropertyName><d2p1:PropertyValue>SolarWinds Monitoring</d2p1:PropertyValue></d2p1:ActionProperty><d2p1:ActionProperty><d2p1:IsShared>false</d2p1:IsShared><d2p1:PropertyName>SmtpServerID</d2p1:PropertyName><d2p1:PropertyValue>4</d2p1:PropertyValue></d2p1:ActionProperty><d2p1:ActionProperty><d2p1:IsShared>false</d2p1:IsShared><d2p1:PropertyName>Subject</d2p1:PropertyName><d2p1:PropertyValue>${N=Alerting;M=Severity}: ${N=SwisEntity;M=Caption} is ${N=SwisEntity;M=Status}</d2p1:PropertyValue></d2p1:ActionProperty></d2p1:ActionProperties><d2p1:ActionTypeID>Email</d2p1:ActionTypeID><d2p1:Description>To: user@HH.com &lt;br/&gt;From: mail@HH.com&lt;br/&gt;Subject: ${N=Alerting;M=Severity}: ${N=SwisEntity;M=Caption} is ${N=SwisEntity;M=Status}</d2p1:Description><d2p1:Enabled>true</d2p1:Enabled><d2p1:ID i:nil="true" /><d2p1:IconPath i:nil="true" /><d2p1:IsShared>false</d2p1:IsShared><d2p1:Order>1</d2p1:Order><d2p1:TimePeriods /><d2p1:Title>TEST Notification: Service desk, NOC and OSC supervisors</d2p1:Title><d2p1:TransitiveID i:nil="true" /><d3p1:BackUpSmtpServer i:nil="true" /><d3p1:SmtpServer><d3p1:Address>mail.HH.com</d3p1:Address><d3p1:BackupServerID>0</d3p1:BackupServerID><d3p1:Credentials i:nil="true" /><d3p1:EnableSSL>false</d3p1:EnableSSL><d3p1:IsDefault>false</d3p1:IsDefault><d3p1:Port>25</d3p1:Port><d3p1:ProtectionHash i:nil="true" /><d3p1:ProtectionIV i:nil="true" /><d3p1:ServerID>4</d3p1:ServerID></d3p1:SmtpServer></d2p1:ActionDefinition><d2p1:ActionDefinition><d2p1:ActionProperties><d2p1:ActionProperty><d2p1:IsShared>false</d2p1:IsShared><d2p1:PropertyName>Credentials</d2p1:PropertyName><d2p1:PropertyValue>65</d2p1:PropertyValue></d2p1:ActionProperty><d2p1:ActionProperty><d2p1:IsShared>false</d2p1:IsShared><d2p1:PropertyName>EscalationLevel</d2p1:PropertyName><d2p1:PropertyValue>0</d2p1:PropertyValue></d2p1:ActionProperty><d2p1:ActionProperty><d2p1:IsShared>false</d2p1:IsShared><d2p1:PropertyName>executionIfAknowledge</d2p1:PropertyName><d2p1:PropertyValue>True</d2p1:PropertyValue></d2p1:ActionProperty><d2p1:ActionProperty><d2p1:IsShared>false</d2p1:IsShared><d2p1:PropertyName>executionRepeatTimeSpan</d2p1:PropertyName><d2p1:PropertyValue>0</d2p1:PropertyValue></d2p1:ActionProperty><d2p1:ActionProperty><d2p1:IsShared>false</d2p1:IsShared><d2p1:PropertyName>ProgramPath</d2p1:PropertyName><d2p1:PropertyValue>"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Unrestricted -File "C:\Scripts\Ping-TraceRT.ps1" "${N=SwisEntity;M=IP_Address}" "${N=Alerting;M=AlertDefID}" "${N=SwisEntity;M=NodeID}" "${N=Alerting;M=ObjectType}"</d2p1:PropertyValue></d2p1:ActionProperty></d2p1:ActionProperties><d2p1:ActionTypeID>ExecuteExternalProgram</d2p1:ActionTypeID><d2p1:Description>Execute a program when the Alert is Triggered or Reset</d2p1:Description><d2p1:Enabled>true</d2p1:Enabled><d2p1:ID>4674</d2p1:ID><d2p1:IconPath i:nil="true" /><d2p1:IsShared>false</d2p1:IsShared><d2p1:Order>1</d2p1:Order><d2p1:TimePeriods xmlns:d4p1="http://schemas.solarwinds.com/2008/Core" /><d2p1:Title>Ping and tracert</d2p1:Title><d2p1:TransitiveID i:nil="true" /></d2p1:ActionDefinition></TriggerActions><Uri>swis://SolarWinds.Test.com/Orion/Orion.AlertConfigurations/AlertID=1289</Uri></AlertDefinition>

Reply
  • Sorry about that.  I pasted the correct path and on the alert it shows it runs, but no output in the Alert Notes or emails

    TEST_+Server_+Device+Down (2).xml
    <AlertDefinition xmlns:i="http://www.w3.org/2001/XMLSchema-instance" xmlns="http://schemas.datacontract.org/2004/07/SolarWinds.Orion.Core.Alerting.Models"><AlertID>1289</AlertID><AlertMessage>${N=Alerting;M=Severity}: ${NodeName} is ${N=SwisEntity;M=Status}</AlertMessage><AlertRefID>276432a5-6fba-4525-8fe1-f7ba30c5931a</AlertRefID><Canned>false</Canned><Category /><CreatedBy>sbolyard</CreatedBy><CustomProperties xmlns:d2p1="http://schemas.microsoft.com/2003/10/Serialization/Arrays" /><Description>SolarWinds monitors the ping response of each device via the ICMP protocol. Alert is configured to send appropriate actions when the device has not made a ping response continuously for 4 minutes.</Description><Enabled>true</Enabled><ExecutionTimePeriods xmlns:d2p1="http://schemas.solarwinds.com/2008/Core" /><Frequency>PT1M</Frequency><LastEdit>2021-07-23T16:41:11.5466667Z</LastEdit><Name>TEST: Server: Device Down</Name><NotificationEnabled>true</NotificationEnabled><NotificationSettings xmlns:d2p1="http://schemas.solarwinds.com/2008/Core"><d2p1:Enabled>true</d2p1:Enabled><d2p1:NetObjectType>Node</d2p1:NetObjectType><d2p1:Severity>Warning</d2p1:Severity><d2p1:Subject>PS_Server Down_NOC_P1</d2p1:Subject><d2p1:_properties xmlns:d3p1="http://schemas.microsoft.com/2003/10/Serialization/Arrays"><d3p1:KeyValueOfstringAlertNotificationProperty9sQWCBBt><d3p1:Key>IP Address</d3p1:Key><d3p1:Value><d2p1:Name>IP Address</d2p1:Name><d2p1:Value>${IP_Address}</d2p1:Value></d3p1:Value></d3p1:KeyValueOfstringAlertNotificationProperty9sQWCBBt><d3p1:KeyValueOfstringAlertNotificationProperty9sQWCBBt><d3p1:Key>Object Sub Type</d3p1:Key><d3p1:Value><d2p1:Name>Object Sub Type</d2p1:Name><d2p1:Value>${ObjectSubType}</d2p1:Value></d3p1:Value></d3p1:KeyValueOfstringAlertNotificationProperty9sQWCBBt><d3p1:KeyValueOfstringAlertNotificationProperty9sQWCBBt><d3p1:Key>Status Description</d3p1:Key><d3p1:Value><d2p1:Name>Status Description</d2p1:Name><d2p1:Value>${StatusDescription}</d2p1:Value></d3p1:Value></d3p1:KeyValueOfstringAlertNotificationProperty9sQWCBBt><d3p1:KeyValueOfstringAlertNotificationProperty9sQWCBBt><d3p1:Key>Node Name</d3p1:Key><d3p1:Value><d2p1:Name>Node Name</d2p1:Name><d2p1:Value>${SysName}</d2p1:Value></d3p1:Value></d3p1:KeyValueOfstringAlertNotificationProperty9sQWCBBt><d3p1:KeyValueOfstringAlertNotificationProperty9sQWCBBt><d3p1:Key>Vendor</d3p1:Key><d3p1:Value><d2p1:Name>Vendor</d2p1:Name><d2p1:Value>${Vendor}</d2p1:Value></d3p1:Value></d3p1:KeyValueOfstringAlertNotificationProperty9sQWCBBt></d2p1:_properties></NotificationSettings><ObjectType>Node</ObjectType><Reset><Conditions><ConditionChainItem><AndThenTimeInterval i:nil="true" /><ChainType>ResetInverseToTrigger</ChainType><Condition xmlns:d5p1="http://schemas.datacontract.org/2004/07/SolarWinds.Orion.Core.Models.Alerting" i:nil="true" /><ConjunctionOperator>None</ConjunctionOperator><IsInvertedMinCountThreshold>false</IsInvertedMinCountThreshold><NetObjectsMinCountThreshold i:nil="true" /><ObjectType i:nil="true" /><SustainTime i:nil="true" /><Type i:nil="true" /></ConditionChainItem></Conditions></Reset><ResetActions xmlns:d2p1="http://schemas.solarwinds.com/2008/Orion" /><Severity>Critical</Severity><Trigger><Conditions><ConditionChainItem><AndThenTimeInterval i:nil="true" /><ChainType>Trigger</ChainType><Condition xmlns:d5p1="http://schemas.datacontract.org/2004/07/SolarWinds.Orion.Core.Models.Alerting" xmlns:d5p2="http://schemas.datacontract.org/2004/07/SolarWinds.Orion.Core.Alerting.Plugins.Conditions.Dynamic" i:type="d5p2:AlertConditionDynamic"><d5p2:ExprTree><d5p1:Child><d5p1:Expr><d5p1:Child><d5p1:Expr><d5p1:Child /><d5p1:NodeType>Field</d5p1:NodeType><d5p1:Value>Orion.Nodes|Status</d5p1:Value></d5p1:Expr><d5p1:Expr><d5p1:Child /><d5p1:NodeType>Constant</d5p1:NodeType><d5p1:Value>2</d5p1:Value></d5p1:Expr></d5p1:Child><d5p1:NodeType>Operator</d5p1:NodeType><d5p1:Value>=</d5p1:Value></d5p1:Expr><d5p1:Expr><d5p1:Child><d5p1:Expr><d5p1:Child i:nil="true" /><d5p1:NodeType>Field</d5p1:NodeType><d5p1:Value>Orion.NodesCustomProperties|Purpose|CustomProperties</d5p1:Value></d5p1:Expr><d5p1:Expr><d5p1:Child i:nil="true" /><d5p1:NodeType>Constant</d5p1:NodeType><d5p1:Value>Server</d5p1:Value></d5p1:Expr></d5p1:Child><d5p1:NodeType>Operator</d5p1:NodeType><d5p1:Value>=</d5p1:Value></d5p1:Expr></d5p1:Child><d5p1:NodeType>Operator</d5p1:NodeType><d5p1:Value>AND</d5p1:Value></d5p2:ExprTree><d5p2:Scope i:nil="true" /><d5p2:TimeWindow i:nil="true" /></Condition><ConjunctionOperator>None</ConjunctionOperator><IsInvertedMinCountThreshold>false</IsInvertedMinCountThreshold><NetObjectsMinCountThreshold i:nil="true" /><ObjectType>Node</ObjectType><SustainTime>PT4M</SustainTime><Type xmlns:d5p1="http://schemas.datacontract.org/2004/07/SolarWinds.Orion.Core.Alerting.Plugins.Conditions.Dynamic" i:type="d5p1:ConditionTypeDynamic" /></ConditionChainItem></Conditions></Trigger><TriggerActions xmlns:d2p1="http://schemas.solarwinds.com/2008/Orion"><d2p1:ActionDefinition xmlns:d3p1="http://schemas.solarwinds.com/2008/Core" i:type="d3p1:ActionDefinitionEx"><d2p1:ActionProperties><d2p1:ActionProperty><d2p1:IsShared>false</d2p1:IsShared><d2p1:PropertyName>EmailBCC</d2p1:PropertyName><d2p1:PropertyValue /></d2p1:ActionProperty><d2p1:ActionProperty><d2p1:IsShared>false</d2p1:IsShared><d2p1:PropertyName>EmailCC</d2p1:PropertyName><d2p1:PropertyValue /></d2p1:ActionProperty><d2p1:ActionProperty><d2p1:IsShared>false</d2p1:IsShared><d2p1:PropertyName>EmailFrom</d2p1:PropertyName><d2p1:PropertyValue>Mail@HH.com</d2p1:PropertyValue></d2p1:ActionProperty><d2p1:ActionProperty><d2p1:IsShared>false</d2p1:IsShared><d2p1:PropertyName>EmailMessage</d2p1:PropertyName><d2p1:PropertyValue>Auto-Ticket created for:
    
    Device Name:  ${NodeName}
    IP Address:  ${N=SwisEntity;M=IP_Address}
    Status:  ${N=SwisEntity;M=Status}
    Group:  ${N=SwisEntity;M=CustomProperties.Assignment_Group}
    Priority:  ${N=SwisEntity;M=CustomProperties.Priority}
    Date:      ${DateTime}
    Polling Engine:  ${N=SwisEntity;M=Engine.DisplayName}
    
    Ping &amp; Tracert Information:
    ${N=Alerting;M=Notes}
    
    Alert URL: ${N=Alerting;M=AlertDetailsUrl}  
    Alert Name: ${N=Alerting;M=AlertName}</d2p1:PropertyValue></d2p1:ActionProperty><d2p1:ActionProperty><d2p1:IsShared>false</d2p1:IsShared><d2p1:PropertyName>EmailTo</d2p1:PropertyName><d2p1:PropertyValue>user@HH.com</d2p1:PropertyValue></d2p1:ActionProperty><d2p1:ActionProperty><d2p1:IsShared>false</d2p1:IsShared><d2p1:PropertyName>EscalationLevel</d2p1:PropertyName><d2p1:PropertyValue>5</d2p1:PropertyValue></d2p1:ActionProperty><d2p1:ActionProperty><d2p1:IsShared>false</d2p1:IsShared><d2p1:PropertyName>executionIfAknowledge</d2p1:PropertyName><d2p1:PropertyValue>False</d2p1:PropertyValue></d2p1:ActionProperty><d2p1:ActionProperty><d2p1:IsShared>false</d2p1:IsShared><d2p1:PropertyName>executionRepeatTimeSpan</d2p1:PropertyName><d2p1:PropertyValue>0</d2p1:PropertyValue></d2p1:ActionProperty><d2p1:ActionProperty><d2p1:IsShared>false</d2p1:IsShared><d2p1:PropertyName>MessageContentType</d2p1:PropertyName><d2p1:PropertyValue>1</d2p1:PropertyValue></d2p1:ActionProperty><d2p1:ActionProperty><d2p1:IsShared>false</d2p1:IsShared><d2p1:PropertyName>Priority</d2p1:PropertyName><d2p1:PropertyValue>0</d2p1:PropertyValue></d2p1:ActionProperty><d2p1:ActionProperty><d2p1:IsShared>false</d2p1:IsShared><d2p1:PropertyName>Sender</d2p1:PropertyName><d2p1:PropertyValue>SolarWinds Monitoring</d2p1:PropertyValue></d2p1:ActionProperty><d2p1:ActionProperty><d2p1:IsShared>false</d2p1:IsShared><d2p1:PropertyName>SmtpServerID</d2p1:PropertyName><d2p1:PropertyValue>4</d2p1:PropertyValue></d2p1:ActionProperty><d2p1:ActionProperty><d2p1:IsShared>false</d2p1:IsShared><d2p1:PropertyName>Subject</d2p1:PropertyName><d2p1:PropertyValue>${N=Alerting;M=Severity}: ${N=SwisEntity;M=Caption} is ${N=SwisEntity;M=Status}</d2p1:PropertyValue></d2p1:ActionProperty></d2p1:ActionProperties><d2p1:ActionTypeID>Email</d2p1:ActionTypeID><d2p1:Description>To: user@HH.com &lt;br/&gt;From: mail@HH.com&lt;br/&gt;Subject: ${N=Alerting;M=Severity}: ${N=SwisEntity;M=Caption} is ${N=SwisEntity;M=Status}</d2p1:Description><d2p1:Enabled>true</d2p1:Enabled><d2p1:ID i:nil="true" /><d2p1:IconPath i:nil="true" /><d2p1:IsShared>false</d2p1:IsShared><d2p1:Order>1</d2p1:Order><d2p1:TimePeriods /><d2p1:Title>TEST Notification: Service desk, NOC and OSC supervisors</d2p1:Title><d2p1:TransitiveID i:nil="true" /><d3p1:BackUpSmtpServer i:nil="true" /><d3p1:SmtpServer><d3p1:Address>mail.HH.com</d3p1:Address><d3p1:BackupServerID>0</d3p1:BackupServerID><d3p1:Credentials i:nil="true" /><d3p1:EnableSSL>false</d3p1:EnableSSL><d3p1:IsDefault>false</d3p1:IsDefault><d3p1:Port>25</d3p1:Port><d3p1:ProtectionHash i:nil="true" /><d3p1:ProtectionIV i:nil="true" /><d3p1:ServerID>4</d3p1:ServerID></d3p1:SmtpServer></d2p1:ActionDefinition><d2p1:ActionDefinition><d2p1:ActionProperties><d2p1:ActionProperty><d2p1:IsShared>false</d2p1:IsShared><d2p1:PropertyName>Credentials</d2p1:PropertyName><d2p1:PropertyValue>65</d2p1:PropertyValue></d2p1:ActionProperty><d2p1:ActionProperty><d2p1:IsShared>false</d2p1:IsShared><d2p1:PropertyName>EscalationLevel</d2p1:PropertyName><d2p1:PropertyValue>0</d2p1:PropertyValue></d2p1:ActionProperty><d2p1:ActionProperty><d2p1:IsShared>false</d2p1:IsShared><d2p1:PropertyName>executionIfAknowledge</d2p1:PropertyName><d2p1:PropertyValue>True</d2p1:PropertyValue></d2p1:ActionProperty><d2p1:ActionProperty><d2p1:IsShared>false</d2p1:IsShared><d2p1:PropertyName>executionRepeatTimeSpan</d2p1:PropertyName><d2p1:PropertyValue>0</d2p1:PropertyValue></d2p1:ActionProperty><d2p1:ActionProperty><d2p1:IsShared>false</d2p1:IsShared><d2p1:PropertyName>ProgramPath</d2p1:PropertyName><d2p1:PropertyValue>"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Unrestricted -File "C:\Scripts\Ping-TraceRT.ps1" "${N=SwisEntity;M=IP_Address}" "${N=Alerting;M=AlertDefID}" "${N=SwisEntity;M=NodeID}" "${N=Alerting;M=ObjectType}"</d2p1:PropertyValue></d2p1:ActionProperty></d2p1:ActionProperties><d2p1:ActionTypeID>ExecuteExternalProgram</d2p1:ActionTypeID><d2p1:Description>Execute a program when the Alert is Triggered or Reset</d2p1:Description><d2p1:Enabled>true</d2p1:Enabled><d2p1:ID>4674</d2p1:ID><d2p1:IconPath i:nil="true" /><d2p1:IsShared>false</d2p1:IsShared><d2p1:Order>1</d2p1:Order><d2p1:TimePeriods xmlns:d4p1="http://schemas.solarwinds.com/2008/Core" /><d2p1:Title>Ping and tracert</d2p1:Title><d2p1:TransitiveID i:nil="true" /></d2p1:ActionDefinition></TriggerActions><Uri>swis://SolarWinds.Test.com/Orion/Orion.AlertConfigurations/AlertID=1289</Uri></AlertDefinition>

Children
  • Yeah - there's something else wonky going on here.  I'm still checking on my end.

  • Hey , just wanted to see if you had time to look at this any further?  Or anyone else that may have a recommendation is also appreciated.  Thanks!

  • Sorry - got distracted with other work priorities, but I got it working (at least in my own lab environment).

    func_PingTrace.ps1Ping-TraceRT.ps1

    Node+is+down+(with+updates).xml
    <AlertDefinition xmlns:i="http://www.w3.org/2001/XMLSchema-instance" xmlns="http://schemas.datacontract.org/2004/07/SolarWinds.Orion.Core.Alerting.Models">
    	<AlertID>187</AlertID>
    	<AlertMessage>Node '${N=SwisEntity;M=Caption}' is down (with updates)</AlertMessage>
    	<AlertRefID>93fb68fb-95cd-4018-9a4a-a8072a8dd347</AlertRefID>
    	<Canned>false</Canned>
    	<Category/>
    	<CreatedBy i:nil="true"/>
    	<CustomProperties xmlns:d2p1="http://schemas.microsoft.com/2003/10/Serialization/Arrays">
    		<d2p1:KeyValueOfstringanyType>
    			<d2p1:Key>ResponsibleTeam</d2p1:Key>
    			<d2p1:Value xmlns:d4p1="http://schemas.datacontract.org/2004/07/System" i:type="d4p1:DBNull"/>
    		</d2p1:KeyValueOfstringanyType>
    	</CustomProperties>
    	<Description>This alert will write to the SolarWinds event log when a node goes down and when a node comes back up again.
    		This should run the ping thing.</Description>
    	<Enabled>false</Enabled>
    	<ExecutionTimePeriods xmlns:d2p1="http://schemas.solarwinds.com/2008/Core"/>
    	<Frequency>PT1M</Frequency>
    	<LastEdit>2021-07-23T16:04:33.6833333Z</LastEdit>
    	<Name>Node is down (with updates)</Name>
    	<NotificationEnabled>false</NotificationEnabled>
    	<NotificationSettings xmlns:d2p1="http://schemas.solarwinds.com/2008/Core">
    		<d2p1:Enabled>false</d2p1:Enabled>
    		<d2p1:NetObjectType>Node</d2p1:NetObjectType>
    		<d2p1:Severity>Notice</d2p1:Severity>
    		<d2p1:Subject/>
    		<d2p1:_properties xmlns:d3p1="http://schemas.microsoft.com/2003/10/Serialization/Arrays">
    			<d3p1:KeyValueOfstringAlertNotificationProperty9sQWCBBt>
    				<d3p1:Key>IP Address</d3p1:Key>
    				<d3p1:Value>
    					<d2p1:Name>IP Address</d2p1:Name>
    					<d2p1:Value>${IP_Address}</d2p1:Value>
    				</d3p1:Value>
    			</d3p1:KeyValueOfstringAlertNotificationProperty9sQWCBBt>
    			<d3p1:KeyValueOfstringAlertNotificationProperty9sQWCBBt>
    				<d3p1:Key>Object Sub Type</d3p1:Key>
    				<d3p1:Value>
    					<d2p1:Name>Object Sub Type</d2p1:Name>
    					<d2p1:Value>${ObjectSubType}</d2p1:Value>
    				</d3p1:Value>
    			</d3p1:KeyValueOfstringAlertNotificationProperty9sQWCBBt>
    			<d3p1:KeyValueOfstringAlertNotificationProperty9sQWCBBt>
    				<d3p1:Key>Status Description</d3p1:Key>
    				<d3p1:Value>
    					<d2p1:Name>Status Description</d2p1:Name>
    					<d2p1:Value>${StatusDescription}</d2p1:Value>
    				</d3p1:Value>
    			</d3p1:KeyValueOfstringAlertNotificationProperty9sQWCBBt>
    			<d3p1:KeyValueOfstringAlertNotificationProperty9sQWCBBt>
    				<d3p1:Key>Node Name</d3p1:Key>
    				<d3p1:Value>
    					<d2p1:Name>Node Name</d2p1:Name>
    					<d2p1:Value>${SysName}</d2p1:Value>
    				</d3p1:Value>
    			</d3p1:KeyValueOfstringAlertNotificationProperty9sQWCBBt>
    			<d3p1:KeyValueOfstringAlertNotificationProperty9sQWCBBt>
    				<d3p1:Key>Vendor</d3p1:Key>
    				<d3p1:Value>
    					<d2p1:Name>Vendor</d2p1:Name>
    					<d2p1:Value>${Vendor}</d2p1:Value>
    				</d3p1:Value>
    			</d3p1:KeyValueOfstringAlertNotificationProperty9sQWCBBt>
    		</d2p1:_properties>
    	</NotificationSettings>
    	<ObjectType>Node</ObjectType>
    	<Reset>
    		<Conditions>
    			<ConditionChainItem>
    				<AndThenTimeInterval i:nil="true"/>
    				<ChainType>ResetCustom</ChainType>
    				<Condition xmlns:d5p1="http://schemas.datacontract.org/2004/07/SolarWinds.Orion.Core.Models.Alerting" xmlns:d5p2="http://schemas.datacontract.org/2004/07/SolarWinds.Orion.Core.Alerting.Plugins.Conditions.Dynamic" i:type="d5p2:AlertConditionDynamic">
    					<d5p2:ExprTree>
    						<d5p1:Child>
    							<d5p1:Expr>
    								<d5p1:Child>
    									<d5p1:Expr>
    										<d5p1:Child/>
    										<d5p1:NodeType>Field</d5p1:NodeType>
    										<d5p1:Value>Orion.Nodes|Status</d5p1:Value>
    									</d5p1:Expr>
    									<d5p1:Expr>
    										<d5p1:Child/>
    										<d5p1:NodeType>Constant</d5p1:NodeType>
    										<d5p1:Value>2</d5p1:Value>
    									</d5p1:Expr>
    								</d5p1:Child>
    								<d5p1:NodeType>Operator</d5p1:NodeType>
    								<d5p1:Value>!=</d5p1:Value>
    							</d5p1:Expr>
    						</d5p1:Child>
    						<d5p1:NodeType>Operator</d5p1:NodeType>
    						<d5p1:Value>AND</d5p1:Value>
    					</d5p2:ExprTree>
    					<d5p2:Scope i:nil="true"/>
    					<d5p2:TimeWindow i:nil="true"/>
    				</Condition>
    				<ConjunctionOperator>None</ConjunctionOperator>
    				<IsInvertedMinCountThreshold>false</IsInvertedMinCountThreshold>
    				<NetObjectsMinCountThreshold i:nil="true"/>
    				<ObjectType>Node</ObjectType>
    				<SustainTime>PT5M</SustainTime>
    				<Type xmlns:d5p1="http://schemas.datacontract.org/2004/07/SolarWinds.Orion.Core.Alerting.Plugins.Conditions.Dynamic" i:type="d5p1:ConditionTypeDynamic"/>
    			</ConditionChainItem>
    		</Conditions>
    	</Reset>
    	<ResetActions xmlns:d2p1="http://schemas.solarwinds.com/2008/Orion">
    		<d2p1:ActionDefinition>
    			<d2p1:ActionProperties>
    				<d2p1:ActionProperty>
    					<d2p1:IsShared>false</d2p1:IsShared>
    					<d2p1:PropertyName>executionIfAknowledge</d2p1:PropertyName>
    					<d2p1:PropertyValue>False</d2p1:PropertyValue>
    				</d2p1:ActionProperty>
    				<d2p1:ActionProperty>
    					<d2p1:IsShared>false</d2p1:IsShared>
    					<d2p1:PropertyName>executionRepeatTimeSpan</d2p1:PropertyName>
    					<d2p1:PropertyValue>0</d2p1:PropertyValue>
    				</d2p1:ActionProperty>
    				<d2p1:ActionProperty>
    					<d2p1:IsShared>false</d2p1:IsShared>
    					<d2p1:PropertyName>Message</d2p1:PropertyName>
    					<d2p1:PropertyValue>Node ${NodeName} is ${Status}.</d2p1:PropertyValue>
    				</d2p1:ActionProperty>
    			</d2p1:ActionProperties>
    			<d2p1:ActionTypeID>WriteToNPMEventLog</d2p1:ActionTypeID>
    			<d2p1:Description>Log the Alert in the Network Performance Monitor Event Log</d2p1:Description>
    			<d2p1:Enabled>true</d2p1:Enabled>
    			<d2p1:ID>246</d2p1:ID>
    			<d2p1:IconPath i:nil="true"/>
    			<d2p1:IsShared>false</d2p1:IsShared>
    			<d2p1:Order>1</d2p1:Order>
    			<d2p1:TimePeriods xmlns:d4p1="http://schemas.solarwinds.com/2008/Core"/>
    			<d2p1:Title>NetPerfMon Event Log : Node ${NodeName} is ${Status}.</d2p1:Title>
    			<d2p1:TransitiveID i:nil="true"/>
    		</d2p1:ActionDefinition>
    	</ResetActions>
    	<Severity>Critical</Severity>
    	<Trigger>
    		<Conditions>
    			<ConditionChainItem>
    				<AndThenTimeInterval i:nil="true"/>
    				<ChainType>Trigger</ChainType>
    				<Condition xmlns:d5p1="http://schemas.datacontract.org/2004/07/SolarWinds.Orion.Core.Models.Alerting" xmlns:d5p2="http://schemas.datacontract.org/2004/07/SolarWinds.Orion.Core.Alerting.Plugins.Conditions.Dynamic" i:type="d5p2:AlertConditionDynamic">
    					<d5p2:ExprTree>
    						<d5p1:Child>
    							<d5p1:Expr>
    								<d5p1:Child>
    									<d5p1:Expr>
    										<d5p1:Child/>
    										<d5p1:NodeType>Field</d5p1:NodeType>
    										<d5p1:Value>Orion.Nodes|Status</d5p1:Value>
    									</d5p1:Expr>
    									<d5p1:Expr>
    										<d5p1:Child/>
    										<d5p1:NodeType>Constant</d5p1:NodeType>
    										<d5p1:Value>2</d5p1:Value>
    									</d5p1:Expr>
    								</d5p1:Child>
    								<d5p1:NodeType>Operator</d5p1:NodeType>
    								<d5p1:Value>=</d5p1:Value>
    							</d5p1:Expr>
    						</d5p1:Child>
    						<d5p1:NodeType>Operator</d5p1:NodeType>
    						<d5p1:Value>AND</d5p1:Value>
    					</d5p2:ExprTree>
    					<d5p2:Scope i:nil="true"/>
    					<d5p2:TimeWindow i:nil="true"/>
    				</Condition>
    				<ConjunctionOperator>None</ConjunctionOperator>
    				<IsInvertedMinCountThreshold>false</IsInvertedMinCountThreshold>
    				<NetObjectsMinCountThreshold i:nil="true"/>
    				<ObjectType>Node</ObjectType>
    				<SustainTime i:nil="true"/>
    				<Type xmlns:d5p1="http://schemas.datacontract.org/2004/07/SolarWinds.Orion.Core.Alerting.Plugins.Conditions.Dynamic" i:type="d5p1:ConditionTypeDynamic"/>
    			</ConditionChainItem>
    		</Conditions>
    	</Trigger>
    	<TriggerActions xmlns:d2p1="http://schemas.solarwinds.com/2008/Orion">
    		<d2p1:ActionDefinition>
    			<d2p1:ActionProperties>
    				<d2p1:ActionProperty>
    					<d2p1:IsShared>false</d2p1:IsShared>
    					<d2p1:PropertyName>EscalationLevel</d2p1:PropertyName>
    					<d2p1:PropertyValue>0</d2p1:PropertyValue>
    				</d2p1:ActionProperty>
    				<d2p1:ActionProperty>
    					<d2p1:IsShared>false</d2p1:IsShared>
    					<d2p1:PropertyName>executionIfAknowledge</d2p1:PropertyName>
    					<d2p1:PropertyValue>False</d2p1:PropertyValue>
    				</d2p1:ActionProperty>
    				<d2p1:ActionProperty>
    					<d2p1:IsShared>false</d2p1:IsShared>
    					<d2p1:PropertyName>executionRepeatTimeSpan</d2p1:PropertyName>
    					<d2p1:PropertyValue>0</d2p1:PropertyValue>
    				</d2p1:ActionProperty>
    				<d2p1:ActionProperty>
    					<d2p1:IsShared>false</d2p1:IsShared>
    					<d2p1:PropertyName>Message</d2p1:PropertyName>
    					<d2p1:PropertyValue>Node ${NodeName} is ${Status}.</d2p1:PropertyValue>
    				</d2p1:ActionProperty>
    			</d2p1:ActionProperties>
    			<d2p1:ActionTypeID>WriteToNPMEventLog</d2p1:ActionTypeID>
    			<d2p1:Description>Log the Alert in the Network Performance Monitor Event Log</d2p1:Description>
    			<d2p1:Enabled>true</d2p1:Enabled>
    			<d2p1:ID>248</d2p1:ID>
    			<d2p1:IconPath i:nil="true"/>
    			<d2p1:IsShared>false</d2p1:IsShared>
    			<d2p1:Order>1</d2p1:Order>
    			<d2p1:TimePeriods xmlns:d4p1="http://schemas.solarwinds.com/2008/Core"/>
    			<d2p1:Title>NetPerfMon Event Log : Node ${NodeName} is ${Status}.</d2p1:Title>
    			<d2p1:TransitiveID i:nil="true"/>
    		</d2p1:ActionDefinition>
    		<d2p1:ActionDefinition>
    			<d2p1:ActionProperties>
    				<d2p1:ActionProperty>
    					<d2p1:IsShared>false</d2p1:IsShared>
    					<d2p1:PropertyName>Credentials</d2p1:PropertyName>
    					<d2p1:PropertyValue/>
    				</d2p1:ActionProperty>
    				<d2p1:ActionProperty>
    					<d2p1:IsShared>false</d2p1:IsShared>
    					<d2p1:PropertyName>EscalationLevel</d2p1:PropertyName>
    					<d2p1:PropertyValue>0</d2p1:PropertyValue>
    				</d2p1:ActionProperty>
    				<d2p1:ActionProperty>
    					<d2p1:IsShared>false</d2p1:IsShared>
    					<d2p1:PropertyName>executionIfAknowledge</d2p1:PropertyName>
    					<d2p1:PropertyValue>True</d2p1:PropertyValue>
    				</d2p1:ActionProperty>
    				<d2p1:ActionProperty>
    					<d2p1:IsShared>false</d2p1:IsShared>
    					<d2p1:PropertyName>executionRepeatTimeSpan</d2p1:PropertyName>
    					<d2p1:PropertyValue>0</d2p1:PropertyValue>
    				</d2p1:ActionProperty>
    				<d2p1:ActionProperty>
    					<d2p1:IsShared>false</d2p1:IsShared>
    					<d2p1:PropertyName>FilePath</d2p1:PropertyName>
    					<d2p1:PropertyValue>C:\Scripts\LoggedFile.txt</d2p1:PropertyValue>
    				</d2p1:ActionProperty>
    				<d2p1:ActionProperty>
    					<d2p1:IsShared>false</d2p1:IsShared>
    					<d2p1:PropertyName>FileSizeMb</d2p1:PropertyName>
    					<d2p1:PropertyValue>0</d2p1:PropertyValue>
    				</d2p1:ActionProperty>
    				<d2p1:ActionProperty>
    					<d2p1:IsShared>false</d2p1:IsShared>
    					<d2p1:PropertyName>Message</d2p1:PropertyName>
    					<d2p1:PropertyValue>{N=SwisEntity;M=IP_Address}: ${N=SwisEntity;M=IP_Address}
    						{N=Alerting;M=AlertDefID}: ${N=Alerting;M=AlertDefID}
    						{N=Alerting;M=ObjectType}: ${N=Alerting;M=ObjectType}
    						{N=SwisEntity;M=NodeID}: ${N=SwisEntity;M=NodeID}</d2p1:PropertyValue>
    				</d2p1:ActionProperty>
    			</d2p1:ActionProperties>
    			<d2p1:ActionTypeID>WriteToFile</d2p1:ActionTypeID>
    			<d2p1:Description>Logs the Alert to a text file</d2p1:Description>
    			<d2p1:Enabled>true</d2p1:Enabled>
    			<d2p1:ID>255</d2p1:ID>
    			<d2p1:IconPath i:nil="true"/>
    			<d2p1:IsShared>false</d2p1:IsShared>
    			<d2p1:Order>2</d2p1:Order>
    			<d2p1:TimePeriods xmlns:d4p1="http://schemas.solarwinds.com/2008/Core"/>
    			<d2p1:Title>Write to a Log for Variables</d2p1:Title>
    			<d2p1:TransitiveID i:nil="true"/>
    		</d2p1:ActionDefinition>
    		<d2p1:ActionDefinition>
    			<d2p1:ActionProperties>
    				<d2p1:ActionProperty>
    					<d2p1:IsShared>false</d2p1:IsShared>
    					<d2p1:PropertyName>Credentials</d2p1:PropertyName>
    					<d2p1:PropertyValue/>
    				</d2p1:ActionProperty>
    				<d2p1:ActionProperty>
    					<d2p1:IsShared>false</d2p1:IsShared>
    					<d2p1:PropertyName>EscalationLevel</d2p1:PropertyName>
    					<d2p1:PropertyValue>0</d2p1:PropertyValue>
    				</d2p1:ActionProperty>
    				<d2p1:ActionProperty>
    					<d2p1:IsShared>false</d2p1:IsShared>
    					<d2p1:PropertyName>executionIfAknowledge</d2p1:PropertyName>
    					<d2p1:PropertyValue>True</d2p1:PropertyValue>
    				</d2p1:ActionProperty>
    				<d2p1:ActionProperty>
    					<d2p1:IsShared>false</d2p1:IsShared>
    					<d2p1:PropertyName>executionRepeatTimeSpan</d2p1:PropertyName>
    					<d2p1:PropertyValue>0</d2p1:PropertyValue>
    				</d2p1:ActionProperty>
    				<d2p1:ActionProperty>
    					<d2p1:IsShared>false</d2p1:IsShared>
    					<d2p1:PropertyName>ProgramPath</d2p1:PropertyName>
    					<d2p1:PropertyValue>"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Unrestricted -File "C:\Scripts\Ping-TraceRT.ps1" "${N=SwisEntity;M=IP_Address}" "${N=Alerting;M=AlertDefID}" "${N=SwisEntity;M=NodeID}" "${N=Alerting;M=ObjectType}"</d2p1:PropertyValue>
    				</d2p1:ActionProperty>
    			</d2p1:ActionProperties>
    			<d2p1:ActionTypeID>ExecuteExternalProgram</d2p1:ActionTypeID>
    			<d2p1:Description>Execute a program when the Alert is Triggered or Reset</d2p1:Description>
    			<d2p1:Enabled>true</d2p1:Enabled>
    			<d2p1:ID>256</d2p1:ID>
    			<d2p1:IconPath i:nil="true"/>
    			<d2p1:IsShared>false</d2p1:IsShared>
    			<d2p1:Order>3</d2p1:Order>
    			<d2p1:TimePeriods xmlns:d4p1="http://schemas.solarwinds.com/2008/Core"/>
    			<d2p1:Title>Do the Ping Thing</d2p1:Title>
    			<d2p1:TransitiveID i:nil="true"/>
    		</d2p1:ActionDefinition>
    	</TriggerActions>
    	<Uri>swis://KMSORION01v.kmsigma.local/Orion/Orion.AlertConfigurations/AlertID=187</Uri>
    </AlertDefinition>

    These are the two scripts and an export of the alert.

  • It's working GREAT!  Thank you so much !  Once  I finish up my HTML/CSS alert (via another thing you provided everyone) I'm building, then this will look great inside of it.  Now that I have a template of how this is done, I'm going to be able to do apply the same logic with other scripts.  Thanks!  I owe you at the next SWUG. 

  • We'll both raise glasses to each other when we next meet IRL.