We like email alerts. Much of the time the email subject (which includes the computer name) can give us what we need to see, so we don't need to open the email, just scan the Inbox.
When we first purchased EventSentry we configured alerts to send multiple events in each email. The problem there was that the subject is pulled from the first alert that's ready to send. So if there is a relatively innocuous event followed by something more serious, the serious event is effectively hidden. We switched to a single event in each email, which tends to generate lots of emails.
I would love to have an option to combine multiple events in the same email, but only the same type of event - for example tracking/services. One email could contain an arbitrary number of these events, but a separate event - like a change to local admins on a box - would generate a separate email. That way something that you'd normally want to look at quickly wouldn't get lost in the noise.
Any chance of an enhancement?
Hi Bill,
Yes, we do have some plans to improve the email alerts, but we didn't have your specific request on the list.
Just to make sure I understand this correctly: You'd like to configure in the email action, to group events with similar data (e.g. same event category, same event source) into a single email, and possibly define a maximum email notification interval - say 1 minute.
So if your server logs 11 events in one minute, 10 of which are from the category "Service Monitoring", and one of which is from "Object Access Tracking", then you would get two emails, one containing all 10 from "Service Monitoring", and one from "Object Access Tracking".
Is that correct?
It looks like you're new here. If you want to get involved, click one of these buttons!