Submit a ticketCall us

AnnouncementsAre You “Flying Blind?”

When it comes to your complex IT infrastructure, you want to ensure you have a good grasp of what’s going on to avoid any fire drills that result from guesswork. Read our white paper to learn how proactively monitoring your IT environment can help your organization while giving you peace of mind.

Get your free white paper.

Home > Success Center > Log & Event Manager (LEM) > LEM - Knowledgebase Articles > Send Email Message Action in Rule Creation

Send Email Message Action in Rule Creation

Created by Karen Valdellon_ret, last modified by MindTouch on Jun 23, 2016

Views: 962 Votes: 1 Revisions: 8


This article describes how to use the Send Email Message action in Rule Creation.


  • All LEM versions



Before adding an action, consider the example used in the two Related Procedures and perform the following:

  1. Open the LEM Console and go to Build > Rules.
  2. Select Change Management on the left and locate the User Account Lockout template on the right.
  3. Select the gear icon for the rule to clone.
  4. Edit the rule Correlations as needed and click Save.

To add or edit a Send Email Message Action:

  1. Expand the Actions list on the Components pane on the left, and drag Send Email Message into the orange Actions box on the right side.
    Note: If you make a mistake, or decide you want to clear out the actions and start over, hover over any action and click the upper right hand X. There is also an Undo button in the lower left corner of Rule Creation.
  2. Whether editing an existing Send Email Message Action or starting with a new one, select your template from the Email Template list.
    Note: If you forgot the name, you can always go back to Build>Groups to view your templates' details. Your rule will still be open when you come back to Build>Rules.
  3. Click on the Users list and check the box next to the user(s) you want to be notified about this event.
  4. To populate the Send Email Message action with dynamic values from the event firing the rule:
    1. Locate the Event or Event Group in the rule's Correlations. In this example, the User Account Lockout (Updated) Rule uses the UserDisable event, so expand Events on the components pane and type UserDisable into the search box.
    2. Click the Event to populate its available fields in the Fields listing under the Events listing.
    3. Drag the appropriate fields from the Fields listing into your action. In this example, the Email Template created in the related articles below require the following fields: DetectionTime for the Time variable, SourceMachine for the Machine variable, DestinationMachine for the DC variable, and DestinationAccount for the Account variable.
  5. Make sure your rule is enabled by selecting the Enable check box.
    Note: Once enabled, you can also use the Test check box to put your rule in Test Mode. When a test rule fires, you will see InternalTestRule events in the Console to let you know it was triggered and what it would have done, but no action will have been taken.
  6. Click Save to save your changes and exit Rule Creation.
    Important: Back in the folders view, you'll see that the Activate Rules button is enabled in the top right corner. This allows you to batch up all your rule changes in case you want to make multiple changes before changing the running state of the manager. So, be sure to click Activate Rules to tell the Console to send your changes to the manager and enable them.

At this point, your rule is active and your template is set up. The next time your rule fires, the recipients specified in your rule will have an email that matches the format you've specified.

Common monitoring/troubleshooting steps:
  • How do I know that the rule is being triggered? Check your Console for InternalRuleFired events, either by using nDepth or a filter. Those events will show which rule was triggered and when.
  • Rule is not triggered when it should be? Check your rule logic and timestamps. The appliance or virtual appliance host layer might need to be configured for NTP. By default, rules will not fire when incoming data drifts more than five minutes from the appliance's clock.
    1. Open a PuTTY session to LEM on port 32022.
    2. Using the CMC user, enter the appliance menu.
    3. Enter the dateconfig command, and confirm the date and time on the Console. The time can be changed with this command, but when the vSphere/Hyper-V time sync pushes the time to the LEM, this will change.
  • Rule is triggered but emails are not sent? Make sure that the Email Active Response connector is configured on your manager appliance by performing the following:
    1. Go to Manage > Appliances.
    2. Click the leftmost gear icon, going to Connectors > Email Active Response.
    3. Click Gear > New to create a new connector, or click Gear > Stop and Gear > Edit to edit the configuration if you see a mistake.
      Note:Always click Save and Gear > Start to start/restart the connector. If you typed in a test email address, you can click Test after starting to send a test mesage.

Related Procedures

Last modified