logo

The ConnectWise Control forum has moved to ConnectWise University! This forum has been locked and is in read-only mode. Click here for instructions on how to access the new forum.

Welcome Guest! You can not login or register.

Notification

Icon
Error

Options
Go to last post Go to first unread
vexation  
#1 Posted : Wednesday, December 12, 2018 2:38:00 PM(UTC)
vexation


Rank: Member

Medals: Level 1: Random Act of Kindness! Received One Thanks!

Joined: 8/28/2012(UTC)
Posts: 34

Thanks: 7 times
Was thanked: 3 time(s) in 2 post(s)
Per subject - I've been trying to setup an e-mail trigger for in the event a PC is stolen or we're asked to advise when a PC connects to the internet and it has our unattended installer on it.

Event.EventType = 'Connected' AND Connection.ProcessType = 'Guest' AND (Session.GuestMachineName = 'ComputerNameHere')

I've tried the ComputerNameHere as the computer name and the FQDN (i.e ComputerNameHere.domain.local) but I've been unable to trigger this.

I could have swore I had this working successfully in previous versions of SC - I'm on 6.8 at the moment.

Am I missing something obvious? Any help is appreciated.

myers6mm  
#2 Posted : Wednesday, December 12, 2018 4:04:11 PM(UTC)
myers6mm


Rank: Advanced Member

Medals: Level 1: Random Act of Kindness! Received One Thanks!

Joined: 9/5/2013(UTC)
Posts: 64
Man
Location: Central Kannsas

Thanks: 25 times
Was thanked: 5 time(s) in 5 post(s)
This is the format I'm using, to watch for stolen computers.

Session.SessionType = 'Access' AND Event.EventType = 'Connected' AND Session.Name = 'Computer Name'

The Computer name above is the name you give it in ScreenConnect or in other words the name of the session.
thanks 1 user thanked myers6mm for this useful post.
vexation on 12/13/2018(UTC)
vexation  
#3 Posted : Wednesday, December 12, 2018 9:36:02 PM(UTC)
vexation


Rank: Member

Medals: Level 1: Random Act of Kindness! Received One Thanks!

Joined: 8/28/2012(UTC)
Posts: 34

Thanks: 7 times
Was thanked: 3 time(s) in 2 post(s)
Originally Posted by: myers6mm Go to Quoted Post
This is the format I'm using, to watch for stolen computers.

Session.SessionType = 'Access' AND Event.EventType = 'Connected' AND Session.Name = 'Computer Name'

The Computer name above is the name you give it in ScreenConnect or in other words the name of the session.


Just tried this and still no joy but the mail alert tests are coming through fine and other event triggers (like new support sessions etc) are working so I know the SMTP details are correct.

So weird.
vexation  
#4 Posted : Wednesday, December 12, 2018 9:55:20 PM(UTC)
vexation


Rank: Member

Medals: Level 1: Random Act of Kindness! Received One Thanks!

Joined: 8/28/2012(UTC)
Posts: 34

Thanks: 7 times
Was thanked: 3 time(s) in 2 post(s)
Originally Posted by: vexation Go to Quoted Post
Originally Posted by: myers6mm Go to Quoted Post
This is the format I'm using, to watch for stolen computers.

Session.SessionType = 'Access' AND Event.EventType = 'Connected' AND Session.Name = 'Computer Name'

The Computer name above is the name you give it in ScreenConnect or in other words the name of the session.


Just tried this and still no joy but the mail alert tests are coming through fine and other event triggers (like new support sessions etc) are working so I know the SMTP details are correct.

So weird.


Any ideas what I can do to troubleshoot this? Is there a log I can look at?

I tried changing the Filter to just Event.EventType = 'Connected' AND Session.Session.Type = 'Guest' amongst others (ignoring the need for a specific computer name, I just wanted SOMETHING to trigger) and still nothing.
vexation  
#5 Posted : Wednesday, December 12, 2018 10:00:17 PM(UTC)
vexation


Rank: Member

Medals: Level 1: Random Act of Kindness! Received One Thanks!

Joined: 8/28/2012(UTC)
Posts: 34

Thanks: 7 times
Was thanked: 3 time(s) in 2 post(s)
Originally Posted by: vexation Go to Quoted Post
Originally Posted by: vexation Go to Quoted Post
Originally Posted by: myers6mm Go to Quoted Post
This is the format I'm using, to watch for stolen computers.

Session.SessionType = 'Access' AND Event.EventType = 'Connected' AND Session.Name = 'Computer Name'

The Computer name above is the name you give it in ScreenConnect or in other words the name of the session.


Just tried this and still no joy but the mail alert tests are coming through fine and other event triggers (like new support sessions etc) are working so I know the SMTP details are correct.

So weird.


Any ideas what I can do to troubleshoot this? Is there a log I can look at?

I tried changing the Filter to just Event.EventType = 'Connected' AND Session.Session.Type = 'Guest' amongst others (ignoring the need for a specific computer name, I just wanted SOMETHING to trigger) and still nothing.


Well scrap that - it appears no triggers are working at all - even the alerts we used to get about new support sessions so I guess back to the drawing board on that, the filter is probably perfect, just gotta find out why nothing is being triggered.
vexation  
#6 Posted : Wednesday, December 12, 2018 10:10:34 PM(UTC)
vexation


Rank: Member

Medals: Level 1: Random Act of Kindness! Received One Thanks!

Joined: 8/28/2012(UTC)
Posts: 34

Thanks: 7 times
Was thanked: 3 time(s) in 2 post(s)
Originally Posted by: vexation Go to Quoted Post
Originally Posted by: vexation Go to Quoted Post
Originally Posted by: vexation Go to Quoted Post
Originally Posted by: myers6mm Go to Quoted Post
This is the format I'm using, to watch for stolen computers.

Session.SessionType = 'Access' AND Event.EventType = 'Connected' AND Session.Name = 'Computer Name'

The Computer name above is the name you give it in ScreenConnect or in other words the name of the session.


Just tried this and still no joy but the mail alert tests are coming through fine and other event triggers (like new support sessions etc) are working so I know the SMTP details are correct.

So weird.


Any ideas what I can do to troubleshoot this? Is there a log I can look at?

I tried changing the Filter to just Event.EventType = 'Connected' AND Session.Session.Type = 'Guest' amongst others (ignoring the need for a specific computer name, I just wanted SOMETHING to trigger) and still nothing.


Well scrap that - it appears no triggers are working at all - even the alerts we used to get about new support sessions so I guess back to the drawing board on that, the filter is probably perfect, just gotta find out why nothing is being triggered.


Restarted the ScreenConnect Services on the Server and Triggers are working again. Frustrating as the up-time was only 27 days but is what it is.

Thanks for the help with the filter, much appreciated.
SoCo_Systems  
#7 Posted : Thursday, December 13, 2018 1:59:12 PM(UTC)
SoCo_Systems


Rank: Advanced Member

Medals: Level 1: Random Act of Kindness! Received One Thanks!

Joined: 1/29/2014(UTC)
Posts: 130
Man
United States
Location: Indianapolis, IN

Thanks: 2 times
Was thanked: 21 time(s) in 21 post(s)
You can also flip it around. I use this as the trigger:
Event.EventType = 'Connected' AND Session.HostConnectedCount = 0 AND Session.Notes LIKE '*ALERTME*'

This way you don't have to create a new trigger for each machine, you just drop an ALERTME note on any of them you want to track. I even have a session group to monitor which machines are set to alert, using:
Notes LIKE '*ALERTME*'

Edited by user Thursday, December 13, 2018 2:00:23 PM(UTC)  | Reason: Not specified

thanks 1 user thanked SoCo_Systems for this useful post.
vexation on 12/15/2018(UTC)
vexation  
#8 Posted : Saturday, December 15, 2018 12:06:14 PM(UTC)
vexation


Rank: Member

Medals: Level 1: Random Act of Kindness! Received One Thanks!

Joined: 8/28/2012(UTC)
Posts: 34

Thanks: 7 times
Was thanked: 3 time(s) in 2 post(s)
Originally Posted by: SoCo_Systems Go to Quoted Post
You can also flip it around. I use this as the trigger:
Event.EventType = 'Connected' AND Session.HostConnectedCount = 0 AND Session.Notes LIKE '*ALERTME*'

This way you don't have to create a new trigger for each machine, you just drop an ALERTME note on any of them you want to track. I even have a session group to monitor which machines are set to alert, using:
Notes LIKE '*ALERTME*'


That's a good idea, thanks.
Users browsing this topic
Forum Jump  
You cannot post new topics in this forum.
You cannot reply to topics in this forum.
You cannot delete your posts in this forum.
You cannot edit your posts in this forum.
You cannot create polls in this forum.
You cannot vote in polls in this forum.