Welcome to ISAserver.org

"Alert action failure"

Users viewing this topic: none

Logged in as: Guest

Printable Version

All Forums >> [ISA 2006 Firewall] >> Logging and Reporting >> "Alert action failure"

Page: [1]

Message

<< Older Topic Newer Topic >>

"Alert action failure" - 10.Jun.2008 3:17:45 PM

gbarnas

Posts: 147
Joined: 27.Apr.2005
From: New Jersey
Status: offline

We need to integrate our enterprise monitoring into our ISA environment. We're all in agreement that adding any software to the ISA systems is not the best idea, so, I figured I could use an alert event to write a message to a log file on the CSS server. We could then use our tools to monitor that file. Sounds simple enough.

Wrote and tested a script to accept an argument from the ISA alert that would identify the source, severity, and message, and write it to a timestamped log file. Works fine..

We're running ISA2K6-EE, 2 members in the "proxy-prod" array, and two CSS systems.

I placed the script on both array members and both CSS servers. We have a standard folder for our admin tools on every system, so all paths are consistent. I defined the "run a command" option on one of the benign alert events that gets logged constantly, just as a test. It fails constantly.

I originally ran the script with System credentials, then switched to my Admin account. No dice either way.

I replaced my script with a batch file that logged the argument, thinking that something was wacked out there.. (used both sets of credentials) No dice!

Finally, I defined the alert to run "isa.bat", which contains nothing more than
@Echo ISA Test >> C:\Temp\IsaTest.log
no arguments, nothing weird, and the bat file is System:FC & Users:R, and the temp folder has System:FC and Users:M permissions. Again, it fails with either set of credentials.

As far as credentials, I've manually entered "domain\account" and also browsed for the account (which creates them with a "user@domain" syntax.) Doesn't make a difference.

Clearly, it's trying to run the command, or I would not get the "Alert action failed" message. I'm at my wits end. Anyone have any ideas?

Thanks,

Glenn