Alert Description truncated in mail

Document ID : KB000031661
Last Modified Date : 14/02/2018
Show Technical Document Details

Problem:

We are using escalation policies to send email notifications to the users with the alert message details using the '$[Alert Description]' variable in the policy action. 

However we have found that this alert message if long, gets truncated when being sent in the email. The escalation policy history shows the entire message, but the email when received has a truncated message (see below picture)

For example: we have an alert message as follows:

ntevl:8/11/2015 6:42:09 AM - A handle to an object was requested.Subject:Security ID:S-1-5-18Account Name:Xyz-2$Account Domain:ABCD ID:0x3e7Object:Object Server:PlugPlayManagerObject Type:SecurityObject Name:PlugPlaySecurityObjectHandle ID:0x0Process Information:Process ID:0x2a4Process Name:C:\Windows\System32\svchost.exeAccess Request Information:Transaction ID:{00000000-0000-0000-0000-000000000000}Accesses:Unknown specific access (bit 1)Access Reasons:-Access Mask:0x2Privileges Used for Access Check:-Restricted SID Count:0 Correct CI not found: use xyz-2 as host for escalation 

 

The email content sent was: 

8/11/2015 6:42:09 AM - A handle to an object was requested.Subject:Security ID:S-1-5-18Account Name:xyz-2$Account Domain:ABCD ID:0x3e7Object:Object Server:PlugPlayManagerObject Type:SecurityObject Name:PlugPlaySecurityObjectHandle ID:0x0Process Info 

truncated mail issue.png

 

Environment:  

SOI 3.2, 3.3 CUM1 & 3.3 CUM2

Resolution:

The '$[Alert Description]' variable in the mail action corresponds to "Summary" field on the console. The maximum character limit set on the alert summary message is 256 characters.

Hence, we need to use '$[Detail]' variable in the mail action to show the entire message in mail (see below picture)

EmailAction.jpg