This discussion has been locked. The information referenced herein may be inaccurate due to age, software updates, or external references.
You can no longer post new replies to this discussion. If you have a similar question you can start a new discussion in this forum.

What logs should I check for Alert Action troubleshooting?

I am trying to see why I am not getting emails for alerts. What log or logs should I be checking? In the ProgramData\SolarWinds\Logs\Orion folder I see several logs with Alert in the name, but which one am I looking for?

By the way, if I am using a node custom property for the alert email address, what happens to an alert notification if that custom property is left blank? Will an error message be logged?

Thanks for any help.

  • You should have a log file called ActionExecutionalert.log in the directory, but this will by default populate when there are issues with the action.

    Therefore, you need to adjust the logging level to get greater visibility, with the following KB explaining how

    https://support.solarwinds.com/SuccessCenter/s/article/Adjust-logging-levels-with-the-Orion-Log-Adjuster

    For the second part of your question, the email will be sent to a blank email address, as that is what the variable will populate - nothing.

    For this, you could create a new alert, which looks for the Custom Property field to be empty and if so and has been for x hours, then use the Custom Property action to auto populate a default value in to this field. I suggest using the delay, so you can give the admin time to populate this data if they have added a new device.

  • You can also get a full log from the API via a SWQL Query

    SELECT TOP 1000 [History].AlertObjects.EntityCaption AS [Triggering Entity]
         , [History].AlertObjects.EntityDetailsUrl AS [Triggering Deatils]
         , [History].EventType
         , [Actions].Description
         , [History].Message
         , [History].TimeStamp
    FROM Orion.AlertHistory AS [History]
    LEFT JOIN Orion.Actions AS [Actions]
         ON [History].ActionID = [Actions].ActionID
    ORDER BY [History].TimeStamp DESC