I am getting lots of alarms from LEM and I don't know how to modify them. The alarms say:
the start type of the background intelligent transfer service service was changed from demand start to auto start. at 2019-02-06 10:59:20.0
Can someone please tell me where to find the source of the alarms? I tried looking in nDepth and Monitor, but I still don't see them.
Thanks in advance.
This is how I dealt with tracking which rule triggered an alert or an email.
1. Edit all the Email templates (around 30 of them in my case) and add a new field: $Rule
(for extra emphasis, I also added which events were triggering the alerts too)
2. Edit all the active rules, and on the Actions section at the Send Email fields, populate this field with: a text constant that has the Rule name or fill it with Interference Rule
This was one of the big problems that I had when using LEM at beginning, so I hope this helps.
So it sounds like you may have turned on an alert to notify you regarding any changes to services?
Tracing an alert event back to the rule that triggered your message is kind of a beast in LEM, you might be able to figure it out by looking at the internal lem events filter on the monitor tab to see when the alert fired and i think it lists the ruleid, but i suspect I would just go directly to the rules and hunt through them looking for anything that looks like it would be tracking windows service audits.
If you've got the console open while the alert fires you should see it under the Rule Fired filter on the Monitor tab.
Otherwise you can go to nDepth and look for the InternalRuleFired event for a period of time and review those for rules that are firing.
You would then need to modify or disable the rule to reduce or stop those e-mails coming in.
SolarWinds solutions are rooted in our deep connection to our user base in the THWACK® online community. More than 150,000 members are here to solve problems, share technology and best practices, and directly contribute to our product development process.