Expected alerts are not appearing in the Event Console

Article:TECH45344  |  Created: 2009-09-25  |  Updated: 2012-09-26  |  Article URL http://www.symantec.com/docs/TECH45344
Article Type
Technical Solution


Issue



When a rule triggers locally on a machine, it should generate an alert and send it to the Event Console. There may be abnormal circumstances, however, that could prevent the alert from appearing, or being processed by, the agent or the Event Console. Suspicion can be validated by referring to the following file, located on the monitored resource:

Windows x86:  [Symantec Management Agent install path]\Altiris Agent\Monitor Agent\RuleState
Windows x64:  [Symantec Management Agent install path]\Altiris Agent\x64\Monitor Agent\RuleState
UNIX/Linux:  [Symantec Management Agent install path]/notification/monitor/var/RuleState
  

The RuleState file contains all currently triggered rules for that resource by rule GUID. The rule GUID can be looked up by searching the Monitor Agent's Config.xml file, also located in the Monitor Agent installation path. Currently triggered rules in the RuleState file should have a corresponding alerts in the Event Console.

  


Environment



  • Monitor Solution for Servers 7.x
  • Event Console 7.x

    


Cause



The exact cause is currently unknown.

Some causes can be:

  • A service interruption or hiccup of some kind during the time frame when the rule is triggered and the alert is sent to the Symantec Management Platform (SMP) server.
  • The configuration file is not populated correctly

  


Solution



To resolve if the alert is not being sent to the SMP:

  1. In the Console, access:  Home > Monitoring and Alerting > Monitor > Jobs and Tasks 
  2. Right-click Tasks and choose New > Task 
  3. Under the Monitoring and Alerting folder, select Reset Monitored Resource, then OK 
  4. Run this task against a target which contains the machines in question

Check the file C:\Program Files\Altiris\Altiris Agent\Monitor Agent\Config.xml.  If it is 0kb, it can be reset as follows:

  1. Stop the AexMetricProv service on the agent
  2. Delete the Config.xml and RuleState files in C:\Program Files\Altiris\Altiris Agent\Monitor Agent
  3. Restart the AexMetricProv service.


 

   



Legacy ID



49296


Article URL http://www.symantec.com/docs/TECH45344


Terms of use for this information are found in Legal Notices