Email alerts from ArcGIS Server

[ThomasColson]

There's all sorts of ways to get email alerts from ArcGIS server (Configure email notifications—ArcGIS Monitor Administrator | ArcGIS Enterprise, https://community.esri.com/groups/survey123/blog/2017/11/30/a-simple-e-mail-notification-system-for-... , python - Is there any way to get an email when ArcGIS Server services are stopped/down? - Geographic... , GeoSystems Monitor Enterprise — Vestra ). This just happens to be what worked for my environment.

While working on another must-get-alert-when-it-happens issue, I realized how solving one problem also solves my "I want to know when ArcGIS Server hiccups problem" as well. I have quite a large GIS server farm, and it's important to me to be able to get in front of GIS server issues before my customers encounter any stop-work issues. 

Creating the Powershell scripts that will harvest the events

We need two scripts: 

System Events: Looking at System Events with the string "Arc" for the last year, I discovered that I'm interested in all of them except routine ArcGIS has started traffic:

$event = get-eventlog -LogName System -Message *Arc* -newest 1 | Where-Object {$_.Message -ne "The ArcGIS Server service entered the running state."}

$PCName = $env:COMPUTERNAME
$EmailBody = $event | format-list -property * | out-string
$EmailFrom = "$PCName sasquatch@bigfoot.com"
$EmailTo = "you_cant_find@me.com"
$EmailSubject = "ArcGIS Warning!!!!!!!!!!!!"
$SMTPServer = "smtp.server"
Write-host "Sending Email"
Send-MailMessage -From $EmailFrom -To $EmailTo -Subject $EmailSubject -body $EmailBody -SmtpServer $SMTPServer‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

Save this as C:\ALERTS\ALERT_ARC_SYSTEM.ps1

Application Events:Looking at Application Events with the string "Arc" for the last year, I discovered that I'm interested in all of them except routine MsiInstaller traffic:

$event = get-eventlog -LogName Application -Message *Arc* -newest 1 | Where-Object {$_.Source -notlike "MsiInstaller"}
$PCName = $env:COMPUTERNAME
$EmailBody = $event | format-list -property * | out-string
$EmailFrom = "$PCName sasquatch@bigfoot.com"
$EmailTo = "you_cant_find@me.com"
$EmailSubject = "ArcGIS Warning!!!!!!!!!!!!"
$SMTPServer = "smtp.server"
Write-host "Sending Email"
Send-MailMessage -From $EmailFrom -To $EmailTo -Subject $EmailSubject -body $EmailBody -SmtpServer $SMTPServer‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

Save this as Save this as C:\ALERTS\ALERT_ARC_APPLICATION.ps1

The flexibility here is that you can filter whatever types of Events you want to receive an email for. Using Get-EventLog properties, I'm expecting about 1-5 emails per week with the filters I'm using. 

Setting up Task Scheduler to monitor the event log

Right-click on the Application Log and select Attach a Task To this Log

When you get to Action, select the PS script you created for Application Events

Finish the Basic Task Wizard then go into Task Scheduler and set things up to run as a service account, etc. 

Testing

From an administrative PS prompt:

PS C:\Windows\system32> New-EventLog –LogName System –Source "Test Arc System"‍
PS C:\Windows\system32> Write-EventLog –LogName System –Source "Test Arc System" –EventID 1 –Message "Test Arc System 4"‍‍
PS C:\Windows\system32> New-EventLog –LogName Application –Source "Test Arc"
PS C:\Windows\system32> Write-EventLog –LogName Application –Source "Test Arc" –EventID 1 –Message "Test Arc Application 4"
‍‍‍‍

And you should see: 

In conclusion, there are many ways to do this, and my Powershell won't get me hired as a Powershell scripter, but this should give you some ideas on how to customize and automate how you're getting ArcGIS Server alerts. 

Credit: I was inspired by https://www.ryadel.com/en/event-viewer-send-notification-e-mail-messages-with-powershell/  

[JayJohnson6]

How to Send a Text from Email: 5 Steps (with Pictures) - wikiHow 

You could also text yourself using this address.

FME Server is nice enough to have an alerting system built in; however it could end up emailing every ArcGIS for Server admin worldwide, as we had happen at Royal Dutch Shell. 

[MarkHougaard]

Thanks for tip. There are a number of things that need to be done to make this work better.

1. Using SMTP through Send-MailMessage as written isn't going to work, especially if you need to use an external SMTP server like Gmail. All connections must be authenticated. We need to add password credentials and use SSL. We should even store the password in encrypted for so it's not exposed as clear text.
2. The way the Get-EventLog line is composed, we'll get a message anytime the event log file is updated, even if it's not a message we care about because it always finds the last event that matched in the log, no matter how long ago that was. We can improve the Where-Object clause to limit how far back in time to consider messages as new.
3. This is more a coding preference, however, if there are no events found, i.e., $EmailBody is empty/null, why even attempt to call Send-MailMessage? It will fail, it's a waste of resources, and it's bad form to have a script that fails 99% of the time.

Here is an updated version of the ALERT_ARC_SYSTEM.ps1 script with the above issues addressed.

$PCName = "ARCGISMACHINE"
$SRCemail = "source@company.com"

$SMTPServer = "smtp.gmail.com"
$SMTPPort = "587"

# To generate encrypted password do the following first on the machine running the powershell scripts
# 1. Save the clear text password in a temporary password file, e.g. pwtemp.txt
# 2. Then run:  Get-Content .\pwtemp.txt | ConvertTo-SecureString -AsPlainText -Force | ConvertFrom-SecureString > .\securepass.txt
# 3. Delete clear text password file.

$pass = Get-Content C:\Alerts\securepass.txt | ConvertTo-SecureString
$cred = New-Object System.Management.Automation.PSCredential($SRCemail,$pass)

$event = Get-EventLog -ComputerName $PCName -LogName System -Message *Arc* -newest 1 | Where-Object {$_.TimeGenerated -le $_.TimeGenerated.AddMinutes(-2) -and $_.Message -ne "The ArcGIS Server service entered the running state."}

$EmailBody = $event | format-list -property * | out-string

if (!([string]::IsNullOrEmpty($EmailBody))) {
    $EmailFrom = "$PCName $SRCemail"
    $EmailTo = "destination1@compay.com", "destination2@company.com"
    $EmailSubject = "ArcGIS Warning!!!!"

    Write-host "Sending Email"
    Send-MailMessage -From $EmailFrom -To $EmailTo -Subject $EmailSubject -body "$EmailBody" -SmtpServer $SMTPServer -Port $SMTPPort -UseSsl -Credential $cred
}