Use variable from Event Log test to use in alert

[Kris]

Hi all,

I have a test that checks Windows event logs for OWA login failures (event ID 4625).
In that test, I extract some useful details with a tune-up like this:

[KS-Soft]

So you need to translate message from event log to some e-mail address? message with usernameA -> e-mailA; message with usernameB -> e-mailB?
You can use IF statements and put just e-mail into Reply field, then use %Reply% variable for the action (recipient field) but I don't think this is good solution, especially if you have many users and/or you want to modify event log message...

Better use different test items for different users. Not a perfect solution either when you have many users.

Regards
Alex

[Kris]

Thanks for your reponse, Alex.

What I will do instead, is whip up a powershell script to scrape the eventlog for 4625 events and if found, send the email message to the user + set test status to warning.
That'll do as well

Thanks for inspiring

[KS-Soft]

You are welcome

Regards
Alex