Network Management

Log filter is not triggering alert

Filter for trap rule is not triggered. Filter for syslog rule is not triggered. Log filter not triggering alert, alert not firing. Admin account is disabled. Exception during StringFormat: Input string was not in a correct format. One or more errors occurred. User account is disabled. Fault Detail is equal to InfoServiceFaultContract SolarWinds.Data.AccessDeniedException.

First published date

5/11/2020 12:54 PM

Last published date

5/26/2021 8:46 PM

Overview

There is an existing issue on Orion 2019.4 and Orion 2020.2. When working with Orion Log Viewer, alerts may not be triggering as expected. The known issue is that the default 'Admin' account is disabled. 

Known behavior
  • Go to Manage Accounts and create Orion account (give it administrator rights)
  • Login under the newly created user and Edit Orion admin account (Account Enabled -> No)
  • Go to Log Viewer -> Configure Rules and create a rule + alert action.

Results

  • Rule is Triggered + Alert is NOT Triggered

 


Alerting Service log file should indicate 
ERROR SolarWinds.MessageBus.RabbitMQ.EasyNetQLogger - <log4net.Error>Exception during StringFormat: Input string was not in a correct format. <format>Exception thrown by subscription callback.
	Exchange:    ''
	Routing Key: 'Core.ConditionEvaluatorSwsllNC10gIMgH2NznT22CBv1fRYcDQ=.Engine@Engine_1/SolarWinds.Alerting.Service_1_SolarWinds.Alerting.Service.exe'
	Redelivered: 'False'
Message:
{"SubscriptionId":"7e71199c-a4ab-48ff-b4ea-e6971e88fa94","IndicationType":"Orion.OLM.AlertMessage","IndicationProperties":{"IndicationId":{"t":"System.Guid","v":"e673ef9a-f629-4af5-813e-caaf924a4ce9"},"IndicationTime":{"t":"System.DateTime","v":"2019-08-07T12:16:04.7210057Z"},"SequenceNumber":{"t":"System.Int64","v":48},"AccountId":{"t":"System.String","v":"SYSTEM"},"SourceInstanceType":{"t":"System.String","v":"Orion.OLM.AlertMessage"},"RuleDefinitionId":{"t":"System.Guid","v":"3d2841cc-ffac-4630-a53e-8f054d2d066a"},"NodeID":{"t":"System.Int32","v":1},"EventMessage":{"t":"System.String","v":"This is a test message generated by Kiwi SyslogGen"},"HitCount":{"t":"System.Int32","v":2},"LogEntryId":{"t":"System.Int64","v":845828284624142337},"SourceType":{"t":"System.String","v":"Syslog"}},"SourceInstanceProperties":{"InstanceType":{"t":"System.String","v":"Orion.OLM.AlertMessage"},"RuleDefinitionId":{"t":"System.Guid","v":"3d2841cc-ffac-4630-a53e-8f054d2d066a"},"NodeID":{"t":"System.Int32","v":1},"Uri":{"t":"System.String","v":"swis://<server>./Orion/Orion.Nodes/NodeID=1"},"DisplayName":{"t":"System.String","v":"<server>"}}}
BasicProperties:
ContentType=NULL, ContentEncoding=NULL, Headers=[], DeliveryMode=2, Priority=0, CorrelationId=66467e3f-4d4a-4143-9b24-9724e0945fa8, ReplyTo=NULL, Expiration=NULL, MessageId=NULL, Timestamp=0, Type=SolarWinds.MessageBus.Models.Indication:SolarWinds.MessageBus, UserId=NULL, AppId=NULL, ClusterId=NULL
Exception:
System.AggregateException: One or more errors occurred. ---> System.ServiceModel.FaultException`1[SolarWinds.InformationService.Contract2.InfoServiceFaultContract]: User account is disabled.
   at SolarWinds.InformationService.InformationServiceClient.InformationServiceCommand.CreateFaultException(Message message)
   at SolarWinds.InformationService.InformationServiceClient.InformationServiceCommand.HandleQueryResponse(Message message)
   at SolarWinds.InformationService.InformationServiceClient.InformationServiceCommand.ExecuteReader(CommandBehavior behavior)
   at SolarWinds.InformationService.InformationServiceClient.InformationServiceCommand.ExecuteDbDataReader(CommandBehavior behavior)
   at System.Data.Common.DbCommand.System.Data.IDbCommand.ExecuteReader(CommandBehavior behavior)
   at System.Data.Common.DbDataAdapter.FillInternal(DataSet dataset, DataTable[] datatables, Int32 startRecord, Int32 maxRecords, String srcTable, IDbCommand command, CommandBehavior behavior)
   at System.Data.Common.DbDataAdapter.Fill(DataTable[] dataTables, Int32 startRecord, Int32 maxRecords, IDbCommand command, CommandBehavior behavior)
   at System.Data.Common.DbDataAdapter.Fill(DataTable dataTable)
   at SolarWinds.Orion.Core.Common.InformationService.InformationServiceProxy.<>c__DisplayClass8_0.<Query>b__0(InfoServiceProxy n)
   at SolarWinds.Orion.Core.Common.ChannelProxy`1.CallMethodWithPool[TResult](Func`2 fnc, Boolean retryCall)
   at SolarWinds.Orion.Core.Common.ChannelProxy`1.Invoke[TResult](Func`2 fnc, ChannelProxyBehavior behavior, String methodName)
   at SolarWinds.Orion.Core.Common.ChannelProxy`1.Invoke[TResult](Func`2 fnc, ChannelProxyBehavior behavior)
   at SolarWinds.Orion.Core.Common.InformationService.InformationServiceProxy.Query(String query, IDictionary`2 parameters)
   at SolarWinds.Orion.Core.Alerting.Plugins.Conditions.Dynamic.ConditionEvaluatorSwsl.OnNotificationAsync(Notification notification)
   at SolarWinds.Orion.PubSub.Implementation.MessageBusSubscription.<>c__DisplayClass11_0.<CreateMessageQueue>b__0(Indication indication)
   at SolarWinds.MessageBus.RabbitMQ.EasyNetQueue.<>c__DisplayClass29_0`1.<BeginConsume>b__1(T m)
   at EasyNetQ.Producer.SendReceive.<>c__DisplayClass4`1.<>c__DisplayClass6.<Receive>b__3()
   at EasyNetQ.Internals.TaskHelpers.ExecuteSynchronously(Action action)
   --- End of inner exception stack trace ---
---> (Inner Exception #0) System.ServiceModel.FaultException`1[SolarWinds.InformationService.Contract2.InfoServiceFaultContract]: User account is disabled. (Fault Detail is equal to InfoServiceFaultContract [ SolarWinds.Data.AccessDeniedException: User account is disabled. ] ).<---

 

Product section

Orion Platform

Cause

  • Admin account is disabled
  • Trigger is improperly configured

Resolution

There is a known issue in Orion 2019.4 and 2020.2 where alerts will not trigger as long as the 'Admin' account is disabled. It is advised to enable the 'Admin' account until the bug issue is resolved.

Another common issue is the use of the filter "Varbind element with name" or "Varbind element with OID."
  • Ensure that the element name is an exact match. Case sensitivity applies.
  • Using OIDs: include the parenthesis around the OID value as it appears in the incoming trap message.
    • If the OID with parenthesis did not work, try the exact OID value instead. image.png


Contact support if you experience further issues.