SAM Alert emails and how to include windows Event Viewer ID

Question

Hello,

So a little background first. I am a complete noob when it comes to Solarwinds and SQL queries. I am not however a noob to google and have not been able to find an answer to this particular set of questions and would greatly appreciate input from more seasoned SW users.

1.) How are the components of exchange actually monitored?

2.) If the answer to number one is based off of the Windows Event Viewer, how can I include the Event ID tied to what caused the component monitor to fire out an email into the email itself?

I've seen some old posts about doing SQL queries to get the information but seeing as how I know nothing about SQL other than its a database technology I don't see myself as being able to get what we need set up in any timely fashion. I really appreciate any input y'all can give on this matter.

Thank you.

jangliss · Accepted Answer

1. I'd think that entirely depends on which components you are referring to. For example, the service status components are goign to use WMI to see if the windows service is running, where as the "RPC Requests" will be using WMI to query the Exchange performance counters. Other statistics will be monitored the same way. There are other stuffs that do fall into the event log monitoring though.

2. Depending on the version of SAM you are using, and which alerts are triggering. If it is an event log trigger, and are using SAM 6.2, you can use the variable ${N=SwisEntity;M=ComponentAlert.WindowsEventMessages} to put the event log data into the notification (note this is the full event log information, not just the ID, so may be a bit verbose). I don't recall the old variable name because all my alerts were upgraded.