Submit a ticketCall us

Have You Auto Renewed? If not, you're missing out.
The SolarWinds Renewal Program comes with a host of benefits including the most recent product updates, 24/7 technical support, virtual instructor-led training and more. Experience all of this with the convenience of Auto Renewal, and never worry about missing any of these great benefits. Learn More.

Home > Success Center > Log & Event Manager (LEM) > Rule notification when a LEM agent goes offline

Rule notification when a LEM agent goes offline

Created by Christine Magbuo, last modified by Tim Rush on Nov 10, 2017

Views: 120 Votes: 1 Revisions: 18

Overview

This article describes how to create a rule that sends an email alert when a LEM agent goes offline.

An Agent offline could occur because the service stopped, the server was shutdown, or the network experienced an outage. If the network experienced an outage (complete disconnection), the agent offline notification will require a timeout period before the notification is sent.

Agent online can be configured, but it is less common. If the agent cannot send data to LEM, the agent will queue the log data under the agent "ContegoSPOP" directory. Once the agent is able to connect, all of the queued data will be sent to LEM.

Environment

  • All LEM versions
  • Windows agent installed in any supported Windows platform

Steps

Create/add a new rule for the event called Internal Agent Offline.

     There are two ways to accomplish this.

 

Simple Rule configuration:

     (assumes you have previously set up some rules, and have email notifications enabled.)

  1. Open the LEM Console and go to Build > Rule.
  2. In the top left, under Refine Results, enter "agent offline"  (without the quotes).
  3. Under the Templates on the lower right, select "clone" from the gear next to "Template: Agent Offline - Server".
  4. Select the Enable checkbox at the top. This enables the rule.

  5. Add the Users name (email address) under the Actions, and Save the rule.
  6. Select "Activate Rules" at the top right to perform a "global save' of all changed rules, which activates the rule.

 

A more automated method for rule construction:

  1. Open the LEM Console and go to Build > Rule.
  2. Click Add rule.
  3. Select It Operations > General Best Practice.
  4. Configure email settings and verify that it is working.
  5. Select the email recipient and click Finish.
  6. In the search bar on the left pane, type agent.
  7. Select InternalAgentOffline and drag it to the Correlation box.
  8. Leave the Correlation Time as it is.
  9. In the Actions box, select Send Email Message and drag the InternalAgentOffline events under the $EventInfo field
  10. Do the same for Detection Time.
  11. Click Save.
  12. Click Activate Rule in the upper right hand corner of the Rule tab.

 

 

In case you do want the Agent Online notification:

  1. Open the LEM Console and go to Build > Rule.
  2. In the top right, select the Plus sign to add a new rule.
  3. At the top under the main part of the page, enter a name like "Agent Online".
  4. under Rule Creation on the left, empty space under Events group, enter InternalAgent.
  5. Select InternalAgentOnline, and drag under Correlations in the main part of the screen, and be sure there is a green check for this event.
  6. Select InternalAgentOffline, and drag under the Correlations in the main part of the screen, but select the green checkmark to change to a red-X.
  7. Select InternalAgentOnline, grab the DetectionIP from the under Fields, and drag to the Correlations in the main part of the screen.
  8. Select InternalAgenOffline, grab the DetectionIP from the under Fields, and drag to the 'pencil field' next to the InternalAgentOnline that was just placed under Correlations.
  9. Select the Enable checkbox at the top. This enables the rule.
  10. Select Actions on the far left, and drag "Send Email Message" under the Actions in the main part of the screen.
  11. Select the Agent Offline Dell Phone Messages email template, or create your own template.
  12. Select InternalAgentOnline from the Events, drag the AgentAddress from under Fields, and drop into the blank area to the right of $Agent under the email action.
  13. Drag the DetectionTime from the Fields to the $time field under the email action.
  14. Add the Users name (email address) under the Actions, and Save the rule.
  15. Select "Activate Rules" at the top right to perform a "global save' of all changed rules, which activates the rule.

 

 

 

Last modified

Tags

Classifications

Public