OneSight Administrator Guide

Setting Up an Alert to Trigger an Action Plan
Category (General will be listed in the event’s Category column). You can
enter a list of strings or a list of number ranges separated by commas.
Trigger Response if Username is – This setting refers to the Name
column in the Windows NT Event Viewer. If, for example, you enter
Security under Trigger Response if Username Is, a response will be
triggered if an event is logged in Event Viewer that has Security as its
Category (Security will be listed in the event’s Name column). You can
enter a list of strings separated by commas.
NT Event Type – This setting refers to the symbols to the far left of events
listed in the Windows NT Event Viewer. The symbols refer to event
types. If you’re not sure which event type a symbol refers to, do the
following in the Windows NT Event Viewer: highlight the event, click
Detail on the View menu, and look under Type in the Event Detail dialog
box.
Reset Sample Count – Determines how many sampling intervals need to
occur after the above conditions are met before an alert is retired. When
the alert retires, the monitor or metric health is reset to Good (green) and
any action plan associated with the alert is immediately terminated. If
Reset Sample Count is set to 0, the NT Event Log Match alert will never
trigger a response.
Search String – Specifies a pattern that is validated against the
description of the event. This string can be a full Perl regular expression
(however, it does not return a result). See Using Regular Expressions
for Pattern Matching in Chapter 5 for more information about
specifying Perl expressions.
Trigger Response for event that does NOT match the string – Triggers
an alert for all errors except those that match the search string.
SNMP Trap Settings
These options are available when you select SNMP Trap in the Alert
Editor Respond If group box. The data source for this metric is SNMP
Trap.
Chapter 5: Configuring Monitors 441