AD user locked out alert using SAM

I can think of a lot of ways to do this, however if you want to use SAM try this. 

Here is an example. This SAM Template is going to look for an event in the event log on our SQL servers for when it loses connection of it's twin replication server - event ID 1676.

You can use any event you wish, this is the closest I have as an example.

You will see at the bottom of the template I set it to go back 1.5 intervals and look for event ID 1676.

Once you have your SAM template created. Make an alert to trigger for this. If the event ID 1676 is present in the last 1 1/2 polls then the SAM template wil go into a critical state. 

Hi  bobmarley  , 

I tried the same method before posting to Thwack, but I received numerous events in a single alert email. My requirement is to receive an email with a single AD lockout event.

Ok, I'm kind of rusty on this method as I use another tool for this chad.every could you please chime in as well? If you were to use SolarWinds Event Log Forwarder for Windows and forwarded that specific event to Log Analyzer and then set up a rule in Log Analyzer to great a ticket, email or whatever it should do one for each time the event triggers.  

The SolarWinds Platform Agent (same one used to monitor performance metrics) would be the preferred method instead of the SolarWinds Event Log Forwarder for Windows. The latter doesn't normalize the events and collapses everything into a single message, which makes creating rules challenging. The former should retain key aspects of the Windows Events as unique, filterable values, which is easier to work with inside the tool.

 chad.every  On point. SolarWinds should consider this as a feature request. Since it is possible to monitor Windows Events using a SAM template, they should incorporate a feature to filter out unique keywords. This can then be integrated into alerts to send a single message per event, rather than sending a bunch of the same events occurring at the same time.

 chad.every  On point. SolarWinds should consider this as a feature request. Since it is possible to monitor Windows Events using a SAM template, they should incorporate a feature to filter out unique keywords. This can then be integrated into alerts to send a single message per event, rather than sending a bunch of the same events occurring at the same time.