How to troubleshoot AlertMail notification in SCCM 2012
From SCCM 2012 we have the alert and notification feature. Till Sp1 the mail notification was restricted to endpoint protection but from Sp1 we have this for all the component which can create alert. Since it is least used feature at times while troubleshooting we have lack of articles which help us to understand the flow.
In this article what we are trying to see is how can we configure and test the alert and notification feature.
When you configure the Email notification you have a option to test if we can send a mail,
Please understand that the mail will be send from the top of the hierarchy. The logs which logs the information is NotiCtrl.log
The mail is send by the top most sever in the Hierarchy. (ie The central administration site or Primary when we have a primary standalone server)
Whenever an alert is generated and we have a subscription associated to this then the SMS_ALERT_NOTIFICATION component will trigger a mail as per the subscription.
How to configure the alert and configure subscription is there in this link
https://technet.microsoft.com/en-in/library/hh427334.aspx
Now when you click on Test SMTP server this is what is happening
NotiCtrl.log
[NotiCtrl]: NOTIFY job manager ( 1, 0, C:\Program Files\Microsoft Configuration Manager\inboxes\notictrl.box\3.TST ). SMS_ALERT_NOTIFICATION 3/3/2015 1:09:32 PM 3836 (0x0EFC)
Testing SMTP connection, server name: cmsecondary1.Contoso.com, port: 25 SMS_ALERT_NOTIFICATION 3/3/2015 1:09:32 PM 3836 (0x0EFC)
Impersonation is about to start ... SMS_ALERT_NOTIFICATION 3/3/2015 1:09:32 PM 3836 (0x0EFC)
Impersonation succeed, current user identity is: contoso\administrator SMS_ALERT_NOTIFICATION 3/3/2015 1:09:32 PM 3836 (0x0EFC)
Impersonation is reverted. SMS_ALERT_NOTIFICATION 3/3/2015 1:09:33 PM 3836 (0x0EFC)
Test SMTP connection succeeded. Server name: cmsecondary1.Contoso.com, port: 25, authentication type: Other SMS_ALERT_NOTIFICATION 3/3/2015 1:09:33 PM 3836 (0x0EFC)
[NotiCtrl]: EVENT raised ( 1, 0, C:\Program Files\Microsoft Configuration Manager\inboxes\notictrl.box\3.TST ). SMS_ALERT_NOTIFICATION 3/3/2015 1:09:34 PM 3836 (0x0EFC)
[NotiCtrl]: 1 instruction file processed. SMS_ALERT_NOTIFICATION 3/3/2015 1:09:34 PM 3836 (0x0EFC)
This is done using the WMI methods under the provider class SMS_Subscription. (GetTestSmtpConnectionResult Method and TestSmtpConnection Method)
- https://msdn.microsoft.com/en-us/library/hh949798.aspx
- https://msdn.microsoft.com/en-us/library/hh949066.aspx
- https://msdn.microsoft.com/en-us/library/hh949800.aspx
Once this is done we are sure that the server can send Emails.
On the database you can see the result on the test
select * from [dbo].[AlertEmailTestConnection]
Now assuming that we have a subscription lets see what happens when an alert is created.
Alert ID for the alert I tried was 1.
Once we have a update in the Alert the smsdbmon will drop the trigger file
smsdbmon .log
RCV: UPDATE on Alert for SMS_Alert_ins_upd_SMSProv [1 ][18336] SMS_DATABASE_NOTIFICATION_MONITOR 3/3/2015 1:35:59 PM 328 (0x0148)
RCV: UPDATE on AlertForTrigger for SMS_Alert_upd_SMSProv_AlertForTrigger [1 ][18337] SMS_DATABASE_NOTIFICATION_MONITOR 3/3/2015 1:35:59 PM 328 (0x0148)
RCV: UPDATE on AlertForTrigger for AlertForTrigger_ALE [1 ][18338] SMS_DATABASE_NOTIFICATION_MONITOR 3/3/2015 1:35:59 PM 328 (0x0148)
SND: Dropped C:\Program Files\Microsoft Configuration Manager\inboxes\notictrl.box\1.ALE [18338] SMS_DATABASE_NOTIFICATION_MONITOR 3/3/2015 1:36:00 PM 328 (0x0148)
SQL>>>delete from TableChangeNotifications where RecordID in (18336,18337,18338) SMS_DATABASE_NOTIFICATION_MONITOR 3/3/2015 1:36:00 PM 328 (0x0148)
NotiCtrl.log
[NotiCtrl]: NOTIFY job manager ( 1, 0, C:\Program Files\Microsoft Configuration Manager\inboxes\notictrl.box\1.ALE ). SMS_ALERT_NOTIFICATION 3/3/2015 1:26:11 PM 3836 (0x0EFC)
Added new job, alert ID: 1, locale ID: 1033 SMS_ALERT_NOTIFICATION 3/3/2015 1:26:11 PM 3836 (0x0EFC)
[NotiCtrl]: EVENT raised ( 1, 0, C:\Program Files\Microsoft Configuration Manager\inboxes\notictrl.box\1.ALE ). SMS_ALERT_NOTIFICATION 3/3/2015 1:26:11 PM 3836 (0x0EFC)
[NotiCtrl]: 1 instruction file processed. SMS_ALERT_NOTIFICATION 3/3/2015 1:26:11 PM 3836 (0x0EFC)
[NotiCtrl]: Alert Notification Manager has received a new job request SMS_ALERT_NOTIFICATION 3/3/2015 1:26:11 PM 3836 (0x0EFC)
[NotiCtrl]: WAIT 3 event(s) for 5 minute(s) and 0 second(s). SMS_ALERT_NOTIFICATION 3/3/2015 1:26:11 PM 3836 (0x0EFC)
Use custom subject template for alert type 24 SMS_ALERT_NOTIFICATION 3/3/2015 1:26:12 PM 1860 (0x0744)
Use custom body template for alert type 24 SMS_ALERT_NOTIFICATION 3/3/2015 1:26:12 PM 1860 (0x0744)
Impersonation is about to start ... SMS_ALERT_NOTIFICATION 3/3/2015 1:26:12 PM 1860 (0x0744)
Impersonation succeed, current user identity is: contoso\administrator SMS_ALERT_NOTIFICATION 3/3/2015 1:26:12 PM 1860 (0x0744)
Impersonation is reverted. SMS_ALERT_NOTIFICATION 3/3/2015 1:26:30 PM 1860 (0x0744)
Successfully sending email to: administrator@contoso.com for Alert: 1 SMS_ALERT_NOTIFICATION 3/3/2015 1:26:30 PM 1860 (0x0744)
if you don't have subscription the NotiCtrl.log would look like this
[NotiCtrl]: NOTIFY job manager ( 1, 0, C:\Program Files\Microsoft Configuration Manager\inboxes\notictrl.box\1.ALE ). SMS_ALERT_NOTIFICATION 3/3/2015 1:47:32 PM 3836 (0x0EFC)
[NotiCtrl]: EVENT raised ( 1, 0, C:\Program Files\Microsoft Configuration Manager\inboxes\notictrl.box\1.ALE ). SMS_ALERT_NOTIFICATION 3/3/2015 1:47:32 PM 3836 (0x0EFC)
[NotiCtrl]: 1 instruction file processed. SMS_ALERT_NOTIFICATION 3/3/2015 1:47:32 PM 3836 (0x0EFC)
[NotiCtrl]: WAIT 3 event(s) for 5 minute(s) and 0 second(s). SMS_ALERT_NOTIFICATION 3/3/2015 1:47:32 PM 3836 (0x0EFC)
This table will tell you the information of the alerts subscription send.
select * from [dbo].[AlertEmailNotification]
Hope this information will be useful in troubleshooting alerts and subscriptions in Configuration Manager 2012
Sudheesh N
This posting /Script is provided "AS IS" with no warranties and confers no rights
Comments
- Anonymous
April 23, 2015
Thank you! It helps me a lot ;-)