Re: Alerting on 4740 Event IDs (lockouts) for subset of users

It's likely that the PowerShell script output is not formatted correctly for SAM. You may want to ask for assistance modifying your scripts output in the Script Lab

Scripts Must Report Status Through Exit Codes

Scripts must report their status by exiting with the appropriate exit code:

For example, if you want to inform SolarWinds SAM that a VBScript reports Up status, you would exit the script using code similar to the following, where 0 reports Up:

Wscript.quit(0)

Scripts with Text Output

Scripts report additional details by sending text to the script’s standard output.

In APM 4.0.2 and earlier, each line of output contained a single detail in the following format:

DetailType:Value

# Script output comment

Message: The directory contains too many files.

Statistic: 5

While this is still true, SAM now supports multiple values returned by a script using the following format.

Statistic.Name1: x
Message.Name1: abc

Statistic.Name2: y
Message.Name2: abc

There is a limit of ten Statistic and Message pairs for the script. These can be placed anywhere in the script output. The Statistic and Message names you give must contain valid letters and/or numbers.

Sample output:

# Script comment: This shows two pairs. Ten pairs are possible.

Statistic.CPU: 31.08

Message.CPU: svchost.exe cpu usage

Statistic.RAM: 1234.56

Message.RAM: svchost.exe ram usage