Submit a ticketCall us

AnnouncementsAre You “Flying Blind?”

When it comes to your complex IT infrastructure, you want to ensure you have a good grasp of what’s going on to avoid any fire drills that result from guesswork. Read our white paper to learn how proactively monitoring your IT environment can help your organization while giving you peace of mind.

Get your free white paper.

Home > Success Center > Log & Event Manager (LEM) > Log & Event Manager (LEM) Documentation > LEM Administrator Guide > Use the Send Email Message action in LEM rule creation

Use the Send Email Message action in LEM rule creation

Updated: September 15, 2017

Use the Send Email Message action to create a rule. Before you add an action, perform the following steps:

  1. Open the LEM console. See Log in to the LEM web console or Log in to the LEM desktop console for steps.

  2. Click Build > Rules.

  3. Enter user account lockout in the Refine Results search field.

  4. Locate the User Account Lockout template in the Rule Templates grid.

  5. Click button-gear.png next to the template and select Clone.

  6. Edit the rule Correlations as required, and then click Save.

Add or edit a Send Email Message action

  1. Open the LEM console. See Log in to the LEM web console or Log in to the LEM desktop console for steps.

  2. Click Build > Rules.

  3. Click File:Success_Center/Reusable_content_-_InfoDev/LEM/Log_and_Event_Manager_Administrator's_Guide/LEM_Administrator's_Guide/0830-Auto-populate_user-defined_groups_using_a_LEM_rule/button-plus_18x16.png in the Rules toolbar to create a new rule.

  4. Expand the Actions list.

  5. Drag Send Email Message into the Actions box.

    If you make a mistake, or decide you want to clear out the actions and start over, hover over any action and click X or click Undo.

  6. Click the Email Template drop-down menu and select your template.

    If you forgot the name, you can always go back to Build > Groups to view your template details. Your rule will still be open when you come back to Build > Rules.

  7. Click the Recipients drop-down menu and select the users who need to be notified about this event.
  8. Populate the Send Email Message action with dynamic values from the event firing the rule.
    1. Locate the Event or Event Group that contains your desired action. In this example, the User Account Lockout (Updated) Rule uses the UserDisable event. Expand Events on the components pane and type UserDisable in the search box.
    2. Click the Event to populate its available fields in the Fields listing under the Events listing.
    3. Drag the appropriate fields from the Fields listing into the Correlations box.

      For example, the Email Template created in the related articles below require the following fields: DetectionTime for the Time variable, SourceMachine for the Machine variable, DestinationMachine for the DC variable, and DestinationAccount for the Account variable.

  9. Select the Enable check box.

    After you enable the rule, you can also use the Test check box to place your rule in Test Mode. When a test rule fires, InternalTestRule events display in the console to verify the trigger and actions, but no action is taken.

  10. Click Save to save your changes and exit Rule Creation.

    Activate Rules is enabled in the Rule Creation toolbar. This allows you to batch up all your rule changes in case you want to make multiple changes before changing the running state of the Manager.

  11. Click Activate Rules to send your changes to the LEM Manager and enable your changes.

    Your rule is active and your template is set up.

    The next time your rule fires, the recipients specified in your rule will receive an email that matches your specified format.

Last modified