I've been setting up alerts in our SAM, and I've run into one that I don't see a way to do.
I set up an application monitor to watch for Acrobat Reader, and if it's CPU usage stays above 18% for more than 10 minutes, to set an orion alert and to send an e-mail out detailing what server it's happening on, and when the problem is gone, it sends out an all clear e-mail. This is working fine. The only thing I'd like to see different about it is to only report on it if it's there and if there's a problem. Right now, if it's not there, it shows as down - I'd rather it be flagged either as 'up' or as 'unavailable' if it's not present (It obviously doesn’t matter if no one on the server has Acrobat reader running). But that may be a topic for another thread.
What I'd like to do is either set up another alert entirely using the same application monitor, or another e-mail action in the existing one (doesn't matter which to me) that will also specify which user has the offending processes - so if JDoe is the user that the processes has gone crazy for, the message ends up saying something like 'User JDoe on Server1 has an out of control copy of Acrobat Reader'. The 'server' variable isn't a problem.
I may be blind, but I can't seem to find a way to insert the offending username into the alert. Is there any way to do this? If the only way to do it is at the application monitor level causing all of the alerts to contain this information, that's fine - the reason for the additional e-mail alert is to have a message sent to one or more different groups of people for one or more different servers.
Thanks,
Dave
