LI to vROPS more detailed alerts

[Hoelzeli]

Hello All

I wonder if its possible to define the LI alerts a little more detailed?

I use the LI-Agent on my DomainController to Forward the ActiveDirectory Eventlog. When a User-Account has been locked-out I generate an alert in vrops.

So far so good, this works well. But... how can I integrate details from the Windows Event into the alert?

As an example, the username of the locked-out account would be very fine, or the caller-station where the lock is generated from.

All Information are contained in the Event itself.

In vROPS the alert should look like "User [Username] has been locked out on Machine [caller-station] "

Has anyone realized this ? I haven't found a way to do this.

Kind regards

Christoph

[sflanders]

Hey Christoph,

Unfortunately, vR Ops does not allow events to be included in the alert like LI email alerts do. In addition, using variables within the title of a LI alert is not supported today (you can vote for the feature here: User Alert Enhancements). This means from the vR Ops side there is not much you can do today. On the LI side you can use email or you could parse the alert.log file on the LI CLI and then do whatever you want with it (e.g. http://sflanders.net/2014/09/24/log-insight-alerts-snmp-scripts/). I hope this helps!