Showing results for 
Search instead for 
Did you mean: 
Create Post
Level 9

Alerting on group components

Hi all,

I'd appreciate some help with a scenario I have.

2 x Windows Server 2012 R2 web servers being polled using WMI, and I have put them in a group called Test and assigned to two servers call Test-Web-01 and Test-Web-02 to the group.

I have made a custom Application Monitor Template called IIS Service Monitor that has a Windows Service Monitor component monitor that checks the status of the World Wide Web Publishing Service.

I have assigned this template to the group.

I know I could have used AppInsight or some other OOB template but all the others seem to monitor more than this and I simply want to monitor this particular service.

Can someone explain how I can set up email alerts so that I receive an email when the service on any of the servers goes down, and have that email contain the name of the individual server that is involved.

i currently have successfully set an alert that triggers when the service goes down, but I can't seem to be able to get the server involved.


Currently, my messy email body  (from trying many variables) looks like this

Root Cause: ${GroupStatusRootCause}

There is a problem with the IIS World Wide Web service on ${NodeName} in  ${N=SwisEntity;M=Name} monitoring group.

Alert Name                    ${N=Alerting;M=AlertName}

Group member Display Name            ${N=SwisEntity;M=EntityDisplayName}

Group member full name         ${N=SwisEntity;M=FullName}

Group member name            ${N=SwisEntity;M=Name}

Group Name                                            ${N=SwisEntity;M=Container.Name}

${N=SwisEntity;M=Application.ApplicationAlert.ApplicationAvailability}An issue on an object you are monitoring occurred at ${N=Alerting;M=AlertTriggerTime;F=DateTime}.

View full object details here: ${N=SwisEntity;M=DetailsUrl}.

View full alert details here: ${N=Alerting;M=AlertDetailsUrl}

Click here to acknowledge the alert: ${N=Alerting;M=AcknowledgeUrl}

This message was brought to you by the alert named: ${N=Alerting;M=AlertName}

0 Kudos
2 Replies
Level 12

I worked down this path but eventually had to change tactics. 

Problem 1:

Service on Server1 goes down, so the group status changes to down.

Service on Server2 goes down, and at the same time or soon after Service on Server1 is fixed.  Group status didn't change, no new alert for server2 will be sent.

Problem 2:

You want to monitor (but not alert on) another service.  That service can now affect the node/group status, but you don't want it to. 

There was a 3rd problem, I don't even remember now.

Tactic Change:

I eventually switched to alerting on the application, and set custom properties to filter in the alert condition.  If the users want to see them in groups, you can create a dynamic group based on that custom property.  In the alert condition I could easily add the application or node custom properties to the condition filters, but I could not find a place to filter based on group membership.  Over all I have not regretted using custom properties, and I feel that it's one of the great powers of Orion.

Hi anglia-admin,

Here is what we currently use in our Group alerts.

ALERT: ${N=SwisEntity;M=Name} is ${N=SwisEntity;M=Status;F=Status}


${N=SwisEntity;M=Name}'s status has currently been ${N=SwisEntity;M=Status;F=Status} for ${N=Alerting;M=DownTime} minutes.


Root Cause:



Which looks like this....

ALERT: "Group Name" is "Status"

"Group Name"'s status has currently been Up for "Time" minutes.

Root Cause:

"Monitored component/service on "GroupName" on "ServerName" is "Status""

You should be able to combine the two to get what you need the e-mail to provide.
I think the GroupStatusRootCause is the key.

0 Kudos