Alert me when a server goes down in the SolarWinds Platform

Use the following procedure to create an alert that writes to a log and sends an email when a Windows server goes down.

1. Search for "Email me when a Node goes down" in the Alert Manager.
2. Select the check box next to the alert, and then click Duplicate & Edit.
3. Enter a name for the alert, such as "Notify me when Windows 2008 servers go down".
4. Enable the alert, and then click Trigger Condition or Next.
5. In The scope of alert, select Only following set of objects.
6. Select Node Machine Type is equal to Windows 2008 Server as the child condition.

   You can further refine your scope by entering another AND condition. For example, you can enter Node IP Address starts with 10.10.45 to restrict the scope of the alert to a specific subnet.

7. The actual trigger condition should be Node Status is equal to Down.

   Select and enter a value for Condition must exist for more than to prevent being alerted when a node enters the down state frequently within a set amount of time. This prevents you from receiving alerts until the node has been in the down state for longer than the time you have selected.

   You can further suppress alerts by enabling complex conditions in the Advanced options. This allows you to choose to wait until multiple nodes are down before triggering a single alert.

8. Click Reset Condition. The default action should be to reset the alert when the node is up.
9. Click Trigger Actions, and then click Add Action.
10. Select Log the Alert to a file, and then click Configure Action.
    1. Enter the location of the log. For example, enter C:\ExampleAlertLog.txt in the Alert Log Filename Field.
    2. In the Message text box, type Node ${N=SwisEntity;M=Caption} is currently down.
    3. Click Add Action.
11. Click Add Escalation Level, and enter 5 minutes to wait for 5 minutes before escalating to the next level.
12. Click Add Action in Escalation Level 2, and select Send an Email/Page. Click Configure Action.
    1. Enter your email as the recipient.

    2. Add a message.

       You can use variables to customize your message. You can also use a variable that allows you to acknowledge an alert from email (${N=Alerting;M=AcknowledgeUrl}).

    3. Enter your SMTP server information if you have not already done so.

       You can enter a default SMTP server that is used for all your email in the Configure Default Send Email Action setting.

    4. Go to Execution settings to click Add Action.
13. Click Copy Actions to Reset Actions Tab, and then click Next.
14. Click Edit next to your logging action, and modify your message to Node ${N=SwisEntity;M=Caption} is back up.
15. Click Edit next to your email action, and modify your message. You can also delete the email if you do not want to know if the situation has been resolved.
16. Click Summary to see if any object will trigger the alert, and then click Submit.

Once you have created the alert, it is added to the list of available alerts in the Alert Manager. You can test and view the results of each of your alert actions. See Testing Alerts for more information.