Network Management

Cannot execute an external program in Orion

A customer cannot run or execute a script on his alerts. Execute an external program fails, Execute an external program not working. Execute batch file, Execute the script, execute PowerShell not working.

First published date

10/21/2018 11:42 PM

Last published date

8/9/2022 6:36 AM

Overview

The alert Trigger Action called Execute an External Program is failing and never runs. This article suggests what is likely and most commonly the cause.

Product section

Orion Platform

Cause

Script is executed by the Orion Module Engine service and therefore the user that service is running as (i.e. SYSTEM account).

Resolution

  1. Make sure that the script actually runs outside of our product by testing it from the command line on the machine hosting the Orion server: 
    runas /user:<username> <fully-qualified command>
    The command structure above prompts for a password. If the fully-qualified command has embedded blanks, use double quotes around the full command request.
  2. If it is working, check if the actual trigger condition is correct.
  3. Check the Alerting Service log file (c:\ProgramData\SolarWinds\Logs\Orion\Alerting.Service.V2.log) and see if you get any of these error messages:

    ERROR SolarWinds.Orion.Core.Actions.Utility.ProcessExecutor - Exception login user DOMAIN\user, error code: 1326

    ERROR SolarWinds.Orion.Core.Actions.Utility.ProcessExecutor - Exception create process by CreateProcessWithLogonW method command: WScript.exe //B "E:\Scripts\SolarWinds\PowerShellVBWrapper.vbs" "E:\Scripts\Running\DeleteNode.ps1" "$

    {N=SwisEntity;M=NodeID}", username:DOMAIN\user error code: 5

Notice that it is complaining about the users login. The customer then tells you that he already defined a local admin – god like user account in the alert trigger condition.

(Screenshot property of © 2019 Microsoft)
 

The red squared option on the screenshot above does not work and there is a known reported bug about it.

The only workaround you can do is to follow these steps:

Go to services.msc:

  1. Highlight SolarWinds Orion Module Engine and go to ‘Properties’.
  2. Add a Log On account.
  3. Restart the Orion Module.


Under "Network path to external program" check to make sure that the script/program your trying to run has the full path to the application/script:

For example, use c:\somedirectory\test.bat, where c:\ is the disk on your main Orion poller.
You can also use the network address, such as \\machine-name\somedirectory\test.bat or \\127.0.0.1\someshare\test.bat