6 Replies Latest reply on Feb 1, 2016 2:14 PM by whpd

    email alerts with more content

    jeffnorton

      All,

         I'm trying to figure out if there is a way to get the email alerts from LEM to have more descriptive content.  For example below is an alert I just got:

       

       

      writing configuration at 2016-01-13 16:26:43.0

       

      The alert doesn't give information on what device it came from.  Other than being able to subscribe or unsubscribe I can't figure out where or how to edit these alerts.  So far I've been able to track them down by going to nDepth and tracking it by the time

        • Re: email alerts with more content
          jhynds

          Hey Jeff,

           

          Please see this video (kudos to curtisi) for steps on how to add more information to e-mail alerts: LEM Resolving Email Alerts with No Information

           

          Any problems let me know.

            • Re: email alerts with more content
              jeffnorton

              So that helped a great deal.  However, now I'm trying to find a listing of all the Event fields like $EventInfo, just so I know what's possible.  I've looked all through the LEM manual and appendices and can't find a listing

                • Re: email alerts with more content
                  curtisi

                  The fields I use in the video are "made up" in the sense that you can put anything in the variable names.  You could have variables called bacon, ham, egg, and potatoes.  If you want to use the same field names that the LEM does, go to Monitor, nDepth or Rules: if you pull up a new filter/search/rule and pull up an event, it'll list all the fields.  Not all events have the same fields, so it's a case-by-case thing.  My example uses what I think are the most common fields.

                    • Re: email alerts with more content
                      jeffnorton

                      Thanks.  Understood.  I had figured out that the email template parameters were just descriptive place holders and I had picked up some of the event parameter variables by looking at various rules.  I was hoping that Solarwinds had done something similar to the admin manual for Orion and had an appendix list all the parameter variables, but that appears not to be the case

                        • Re: email alerts with more content
                          nicole pauls

                          The fields you can assign depend on the event type - there's about a dozen that ALL events have (the ones up to ExtraneousInfo if you're looking in the console), then stuff like source/destination IPs depend on which event ends up firing your rule and being used in the email.

                           

                          The event types are described in the manual, but I don't see anywhere the fields are. If you open something like the filter or rule builder, you can click through the events and see the fields they include to get an idea.

                            • Re: email alerts with more content
                              whpd

                              The best advice I have for you is how I began figuring out what else I could add for more descriptive emails.  Go find the actual instance of the alert that triggered your non-descriptive email.  Once you find that, you'll see all the fields that it has for that type of event.  Go to the event template (clone it to a special one for your specific email if you need) and edit it to add relevant variables, and then find the rule that sends the email and (edit that to send from your new cloned template if you changed it) and fill out all the fields to match your variables.  It is somewhat difficult to figure out at first, but once you get the hang of it it's not too bad.