SolarWinds Orion platform products, such as Network Performance Monitor (NPM) and Server & Application Monitor (SAM), provide network, performance, availability and server monitoring for multi-vendor networks, Linux and Windows Server systems, and detailed application performance monitoring metrics for over 200 applications such as Apache HTTP Server, Microsoft Exchange, and Oracle Database. Both NPM and SAM allow you to trigger and reset alerts based on custom thresholds that can trigger and resolve incidents in PagerDuty.
This integration works by logging SolarWinds Orion alerts to a file containing JSON formatted for our Events API. A VBScript then iterates through every file in the queue directory where alerts are written to and sends the JSON to PagerDuty, deleting the alert file after it has been accepted by the server.
This guide and VBScript were written and tested on Windows Server 2012 R2 with SolarWinds Orion platform 2015.1 and 2016.1. Please see our Legacy SolarWinds NPM Integration Guide if you have an older version of NPM. Earlier versions of SAM/APM and SolarWinds products not using the Orion platform can be configured to send alerts to PagerDuty using an email integration instead.
If you are creating a new service for your integration, in General Settings, enter a Name for your new service. Then, in Incident Settings, specify the Escalation Policy, Notification Urgency, and Incident Behavior for your new service.
C:\PagerDutyon your SolarWinds server, and the sample alerts anywhere you like on your workstation or SolarWinds server.
Sample Alerts.zip on your workstation or SolarWinds server (i.e. on your desktop,
Downloads folder, or
PDIntegrationKeyand, optionally, set a Description, such as “PagerDuty Service Integration Key,” then click Next.
Sample Alerts.zipfile to earlier (i.e. on your desktop,
Common alerts that can be used for both NPM and SAM are in the main
Sample Alerts folder, while SAM-specific alerts are in
Sample Alerts\SAM. Note that only one alert can be imported at a time.
C:\Windows\System32\cscript.exeand Add arguments to
//B "C:\PagerDuty\PagerDuty.vbs", then click OK.
You can send additional alerts to PagerDuty by selecting the alert you want to use and going to Trigger Actions, then simply add an action using the Log the Alert to a File option. The file should be logged to
C:\PagerDuty\Queue with a
.txt file extension, and the content should be JSON that is formatted for our Events API. Check out the alert definitions we provide for examples of how to write your own alerts to be sent to PagerDuty.
Special Characters: If you have an alert which uses characters that will affect the JSON output, such as a quotation mark, then you will need to escape those characters with a backslash, or modify the VBScript to handle them. For example, if you add quotation marks to an alert, add a backslash (
\) before them so they look like
\" in your Log the Alert to a File action. Other special characters can be escaped if needed by modifying the VBScript and using the Replace method, which is what we use in the script to escape backslashes, as backslashes have a special purpose in JSON as the escape character, but are also used in alerts containing Windows paths.
Lastly, you’ll want to add an action to Execute an External VB Script and call
"C:\PagerDuty\PagerDuty.vbs" using the
CScript.exe interpreter. This allows SolarWinds to send the alert to PagerDuty immediately, rather than having to wait for the scheduled task to run before it gets sent to us.
Yes! Simply go to the details page for the node you want to trigger incidents on a different PagerDuty service, scroll down to the Custom Properties section, then click Edit Custom Property Values to set a different value for
PDIntegrationKey on that node. No need to change your alerts (unless you’ve hard-coded the integration key for your custom alerts), as the templates we provide use a SQL query to pull the integration key from this custom property on each node.
First, make sure you’re executing the VBScript using the
CScript.exe interpreter, rather than
WScript.exe, and that the script filename is in quotation marks in both your scheduled task and SolarWinds triggers.
The script will log errors to the Windows Application Event Log to help resolve problems with alerts not being sent to PagerDuty. You can also manually execute the VBScript via Command Prompt using
CScript.exe "C:\PagerDuty\PagerDuty.vbs" to see what happens to alert files in the queue step-by-step.
If you would like the VBScript and alert queue directory to reside somewhere other than
C:\PagerDuty, you will need to perform a find and replace on the XML alert definition files before importing them to change the path to your desired location before proceeding. Unfortunately this path must be hard coded in the alert definition, as SolarWinds does not currently support the execution of VBScript or writing alert files to directories using Windows environment variables such as
You will also need to modify the
QueuePath variable in the VBScript from
C:\PagerDuty\Queue to point to the location where you would like the alert queue to reside.
Although SolarWinds can execute VBScript from a shared folder or mapped network drive, we recommend using a local copy and alert queue on each system in case the host with the script becomes unavailable. This is also recommended in the SolarWinds knowledge base: Tips for executing external scripts and batch files with alerts.
For example, if you configure SolarWinds to write alerts to a queue on a file server and execute the VBScript hosted on that server, and that server goes down for any reason, SolarWinds will not be able to write alert files or execute the VBScript to trigger an incident in PagerDuty for any SolarWinds alerts until the file server is available again.
If PagerDuty can’t be reached for any reason, events will be stored in
C:\PagerDuty\Queue. The scheduled task to execute the VBScript will attempt to re-send the events at one minute intervals, so your SolarWinds server should begin sending incidents to PagerDuty within a minute of being able to access the internet again.