Windows System Event Log "message" details not accurate
We are using the default Windows System Event Log event source and having those errors route through a Teams integration. When tested from Windows System Event Log event source the Event Logging displays the entire “message” detailing the eventID reason etc etc. When looking in the Alerts section of the GUI it also shows the entire “Message” section with details.
However when the alert shows up in Teams its dumbed down and useless. We get the following.
Message: error - HOSTNAME Windows System Event Log
The Teams integration is setup identically to the Event Source Alert message as seen below. Anyone know why ##Message## is getting overwritten with useless info instead of the actual message details from the Event?
Host: ##HOST##
Eventsource: ##EVENTSOURCE##
Windows Event ID: ##EVENTCODE##
Message: ##MESSAGE##
Detected on: ##START##
derek_haneman
OP2 years agoYeah its looking like the latter. When i get it built i’ll post it here for others.
LM User
·2 years agoOk, then it has to do with something LM is doing under the covers that they aren’t telling you about. Your options are to submit a feature request that they open it up or fix it or something, OR rebuild it yourself.
derek_haneman
OP2 years agoGood call on the email stage escalation. The message portion is fully written out there.
LM User
·2 years agoThe message token has always been a bit weird. Try adding your own email address to the escalation chain and check the email template to see that it includes the ##message## token. That will tell you if the problem is with the integration or with the message token itself.
derek_haneman
OP2 years agoHaha, sorry I should have posted the entire message and knew that might cause some confusion. And yes, the “Full Alert Details” works fine and is viewable within Teams. Yeah its a bit strange we don’t have full control over the data that's coming over with how good the testing ability is within the EventSource itself. I’m just trying to avoid the inevitable manager whining that the alert isn't face up with the details to begin with.
Host: Hostname
Eventsource: Windows System Event Log
Windows Event ID: 42
Message: error - Hostname Windows System Event Log
Alert Rule: This alert matches the rule Systems-Error
Recipients: Alert now is going to stage 1 recipients: Name(Alert Channel)
Detected on: time:xx:xx
LM User
·2 years agoWait, your payload has 5 lines in it, but what shows up in teams only has the one line? Sounds like LM is ignoring your desired payload. Or only putting your desired payload behind the “full alert details” button and creating their own “subject” line.
Does the “full alert details” expand the card or is it a link to LM? I imagine teams uses the Adaptive Cards framework (they built it after all). Webex uses the same framework (why rebuild it when MS was nice enough to make it open?). I built our Webex teams integration from scratch and was able to specify the entirety of the card format. Seems like maybe LM is only letting you modify a small section of the card.
If so, we should have them change it so you can pass in the JSON for the card itself as designed here instead of passing in a portion of the text you want pasted in.
derek_haneman
OP2 years agoAlso, yeah i know i can click the button in the teams message “Full Alert Details” but that’s not ideal when you want your alerts face up and human readable at first glance.