Submit a ticketCall us

Looking to compare latest NPM features with previous versions of NPM?
The NPM new feature summary offers a comparison of new features and improvements offered with this release.

 

Home > Success Center > Log & Event Manager (LEM) > Still receiving email alerts after modifying the rule to exclude a condition

Still receiving email alerts after modifying the rule to exclude a condition

Created by Jason Dee, last modified by MindTouch on Jun 23, 2016

Views: 9 Votes: 1 Revisions: 5

Overview

After modifying a rule to exclude certain conditions so it will not fire, you are still receiving email alerts with the excluded conditions. Examples may include excluding accounts, groups, etc.

Environment

All LEM versions

Cause 

This may be caused by one of the following:

  • Activate Rules was not clicked after making the change to the rule.
  • The rule conditions are not formatted properly or are excluding the wrong field.
  • Another rule may have similar conditions and is firing instead of the one you modified.

Resolution

Activate your rules:

  1. Under Build > Rules, click the Activate Rules button if it is not greyed out.

 

Verify your exclusion is formatted properly and is using the appropriate field:

  1. Check the date and time of the email alert you received.
  2. Go to Explore > nDepth.
  3. Perform the following query for a window slightly before and after that time:
    InternalRuleFired.ExtraneousInfo = *email*
    Note: You should be able to easily spot an InternalRuleFired event that correlates to the time you received the email alert.
  4. Highlight that event, click on the smaller Explore dropdown on the top-right, and click Event. This display shows you the InternalRuleFired event below the event(s) that caused that rule to fire.
  5. Highlight the source event and click the Event Details button to see all of its fields.
  6. Take a screenshot of the details.
  7. Go to Build > Rules, and edit the rule that fired (as specified in the InternalRuleFired event).
  8. Use the screenshot to verify you have your exclusions in the appropriate fields.
    1. If the fields of the event have additional text before or after the word/phrase you are excluding, make sure you have an asterisk (as a wildcard) before and/or after your exclusion.
    2. Make sure your exclusion has a Not Equal sign by clicking on the Equal sign to change it.
    3. Make sure the group with all of your conditions is using the AND operand (triangle icon).

 

Verify if another rule is firing and sending an email alert instead of the one you modified

  1. Check the date and time of the email alert you received.
  2. Go to Explore > nDepth.
  3. Perform the following query for a window slightly before and after that time:
    InternalRuleFired.ExtraneousInfo = *email*
    Note: You should be able to easily spot an InternalRuleFired event that correlates to the time you received the email alert.
  4. The name of the rule that fired the alert will be under the EventInfo field. If this is different from the rule you modified, go to Build > Rules and disable that duplicate rule.
Last modified
20:22, 22 Jun 2016

Tags

Classifications

Public