Hi

I need to monitor a file on a Windows machine and have it Alert if the contents of the file changes, eg. an executable that has been modified.

The File Sensor, with its Specific "Monitor File Content", works perfectly EXCEPT I want the sensor to generate an Alert when this is triggered, not just the "Change Notification".

As the sensor is not generating an Alert the email sent when I use an Email Notification Template is Green with a note saying file changed. Not the Red I am hoping for.

I thought maybe I could setup a Notification Template using a HTTP Action to feedback to the Sensor a simulate.htm API call using the %sensorid. However, this does not work. I am not sure why, as there does not seem to be any errors logged that I can see. So don't know if it is a permissions issue, or my API URL syntax is incorrect, or something else.

So my main question is, How do you override a Change Trigger to make it an Alert?

Cheers Jim

Article Comments

Hello,

the change trigger only sends the notification and cannot be changed to a down status. The API call however should work if put correctly as HTTP action.

Does that URL work if you use it manually in the browser to put the sensor to a simulated error status?


Nov, 2021 - Permalink

Arne

Thanks for your response.

Yes, when I try the URL in a browser it works by generating a simulated Alert.

However, if I use incognito mode of the browser it says I need to authenticate. Obviously picking up my authenticated status from another tab when not using incognito mode. So do I need to setup a user that has permission to run the API so the call in the Change Trigger can also authenticate?

Also does the %sensorid work within the change trigger HTTP Action, or would I need to hardcode the sensor's ID. When testing in the browser I have of course had to use the real sensor ID and not a variable.

Cheers Jim


Nov, 2021 - Permalink

Hello Jim,

the %sensorid placeholder should be replaced if used as HTTP action.

That call however does neet authentication provided, meaning the &username= and &passhash= parameters in order to work as HTTP actio.


Nov, 2021 - Permalink