25 Replies Latest reply on Mar 17, 2016 10:27 AM by sans

    Alert Reset Actions not firing


      It seems that when an alert fires, it is not firing off the reset actions. The action gets triggered and the triggered action fires. Once the reset condition happens, the alert resets, but no action fires.


      I have tried this with the built in alerts and i have created an alert from scratch. Before I place a ticket, anyone have ideas on what else I could do?

        • Re: Alert Reset Actions not firing

          Can you give us a screen shot of the reset condition and the reset trigger?

          • Re: Alert Reset Actions not firing

            see configurations.

            1 of 1 people found this helpful
            • Re: Alert Reset Actions not firing

              Sounds like you've not filled out the Reset Actions tab.


              This screenshot is from non web based Advanced Alert Manager.



              • Re: Alert Reset Actions not firing

                You can export the entire alert definition and attach to the discussion. Without looking at the alert definition, difficult to say what's going on

                • Re: Alert Reset Actions not firing

                  You can copy your action trigger to your reset trigger also.

                  • Re: Alert Reset Actions not firing

                    7. Summary of Alert Configuration


                    Please review the alert configuration before saving...


                    Name of alert:

                    Alert me when a node goes down

                    Description of alert:

                    This alert will write to the SolarWinds event log when a node goes down and when a node comes back up again.



                    Type of Property to monitor






                    Evaluation Frequency of alert:

                    Every minute


                    Severity of alert:




                    Alert Custom Properties: (1)



                    Alert Limitation Category

                    No Limitation


                    Trigger Condition:

                    Reset Condition:

                    Time of Day schedule:

                    Trigger Action:

                    Reset Action:

                    • Re: Alert Reset Actions not firing

                      It's probably *not* this, but it could be some issue with Orion trying to send the email (email recipients not existing in email system you are sending to, address formatting issue, some sort of block on the email side, etc.).  You can look for failed email alerts with the MS SQL query example below (If you're comfortable querying the Orion database directly). The error is in  "'Message" column of the query,  I'm using NPM 11.0.1 so it will probably work against the 11.x versions.


                      SELECT TOP 100 [MsgID]








                        FROM [SolarWindsOrion].[dbo].[AlertLog]

                        where message like 'Failed%'

                      1 of 1 people found this helpful
                        • Re: Alert Reset Actions not firing

                          I ran it and didn't pull up anything from this year.

                            • Re: Alert Reset Actions not firing

                              The only other gotcha I can think of is if you are using the "Test" button to test the alerting.  This button is not to actually test alerting as its more of a "test to make sure the trigger condition and SMTP server are working" and not much else.

                              If you are *not* using this button and letting Orion itself trigger the alerting, then I'd say it's in the alert rule configuration or you've found a bug/condition within Orion itself.


                              If you hit the "Export" button on the rule and post the *.AlertDefinition" file as file attachment to this post (as some others above have suggested) then the alert rule can be examined/imported by others and the issue might be found.  If you do this you will be exposing any IP addresses/email addresses/hostnames, etc. defined  in the rule.  It's a small XML file so you could remove that info from the file by hand.

                          • Re: Alert Reset Actions not firing

                            Just an update, it seems to be working on its own now.


                            Also, since this post, I am receiving notices for nodes that I do not have. I believe someone (at solarwinds) has taken my alerts to look at, and failed to change the server (because I forgot to edit them out.) I will post the email header.


                            Received: from ocsemps2.state.mo.us ( by SDEXHUBP002.state.mo.us

                            ( with Microsoft SMTP Server (TLS) id; Wed, 16 Mar

                            2016 22:07:42 -0500

                            Received: from localhost.localdomain (localhost []) by

                            ocsemps2.state.mo.us (Postfix) with SMTP id 3qQYFB6cfxz2BwWm for

                            <chris.boillot@oa.mo.gov>; Wed, 16 Mar 2016 22:07:42 -0500 (CDT)

                            Received: from harrier.mo.gov (unknown []) by

                            ocsemps2.state.mo.us (Postfix) with ESMTPS id 3qQYFB2792z2BwWj for

                            <chris.boillot@oa.mo.gov>; Wed, 16 Mar 2016 22:07:42 -0500 (CDT)

                            Received: from pps.filterd (momail3.mo.gov []) by momail3.mo.gov

                            ( with SMTP id u2H34Y3N031149 for

                            <chris.boillot@oa.mo.gov>; Wed, 16 Mar 2016 22:07:42 -0500

                            Received: from adfcim02.solarwinds.com (adfcim02.solarwinds.com

                            []) by momail3.mo.gov with ESMTP id 21qer80vx1-1

                              (version=TLSv1/SSLv3 cipher=RC4-SHA bits=128 verify=NOT) for

                            <chris.boillot@oa.mo.gov>; Wed, 16 Mar 2016 22:07:41 -0500

                            X-IronPort-AV: E=Sophos;i="5.24,347,1454997600";


                            Received: from unknown (HELO mail.solarwinds.com) ([])  by

                            ADFCIM02.solarwinds.com with ESMTP/TLS/AES256-SHA; 16 Mar 2016 22:07:40 -0500

                            Received: from AUSEX01.tul.solarwinds.net ( by

                            AUSEX01.tul.solarwinds.net ( with Microsoft SMTP Server (TLS)

                            id 15.0.1130.7; Wed, 16 Mar 2016 22:07:39 -0500

                            Received: from DEV-AUS-CIM-01.swdev.local ( by

                            mail.solarwinds.com ( with Microsoft SMTP Server id 15.0.1130.7

                            via Frontend Transport; Wed, 16 Mar 2016 22:07:39 -0500

                            X-IronPort-AV: E=McAfee;i="5700,7163,8106"; a="426396"

                            X-IronPort-AV: E=Sophos;i="5.24,347,1454997600";


                            Received: from sup-aus-mtul-01.swdev.local (HELO supausmtul01)

                            ([])  by DEV-AUS-CIM-01.swdev.local with SMTP; 16 Mar 2016

                            22:06:26 -0500

                            thread-index: AdF/+ipUPIlmX5fGTGKsqligdR+now==

                            Thread-Topic: Alert me when a node goes down (reset)

                            X-FireEye: Clean

                            From: orion - Network Performance Monitor <no-reply-OrionTest@oa.mo.gov>

                            To: <chris.boillot@oa.mo.gov>


                            Subject: Alert me when a node goes down (reset)

                            Date: Wed, 16 Mar 2016 22:07:39 -0500

                            Message-ID: <94AA10B15D3C49BC8123F0048F9FC738@supausmtul01>

                            MIME-Version: 1.0

                            Content-Type: text/plain; charset="utf-8"

                            Content-Transfer-Encoding: 7bit

                            X-Mailer: Microsoft CDO for Windows 2000

                            Content-Class: urn:content-classes:message

                            Importance: normal

                            Priority: normal

                            X-MimeOLE: Produced By Microsoft MimeOLE V6.3.9600.18231

                            X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10432:5.15.96,1.0.38,0.0.0000

                            definitions=2016-03-17_02:2016-03-16,2016-03-17,1970-01-01 signatures=0

                            X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 spamscore=0 suspectscore=1 phishscore=0

                            adultscore=0 bulkscore=0 classifier=spam adjust=0 reason=mlx scancount=1

                            engine=7.0.1-1601100000 definitions=main-1603170038

                            Return-Path: prvs=87721119d=no-reply-OrionTest@oa.mo.gov

                            X-MS-Exchange-Organization-AuthSource: SDEXHUBP002.state.mo.us

                            X-MS-Exchange-Organization-AuthAs: Anonymous

                            X-MS-Exchange-Organization-AVStamp-Mailbox: SMEXw]nP;1240500;0;This mail has

                            been scanned by Trend Micro ScanMail for Microsoft Exchange;

                            X-MS-Exchange-Organization-SCL: 0