Acknowledge Alerts via Email

If your organization tracks alerts via Error Auditing, then being able to acknowledge an alert by simply replying to an email is a useful feature. When this feature is enabled:

1. Each alert is assigned a unique ID
2. Emails have the alert ID appended to the subject like this: "Server is down {id:431}"
3. The alert email will come from a special email address that you specify
4. When support staff receive the email alert, they can simply reply to the mail, indicating they acknowledge it. Nothing special needs to be in the message body.
5. The mail box where the replied-to alert goes is scanned for incoming messages
6. Arriving messages are checked for the special ID in the subject
7. If the message has the ID, that alert is acknowledged using the From: field of the message, and the acknowledgement email is deleted to keep the mail box clean.

Configuration

Configuring this is very easy. First, you need to create or choose an existing email mail box that will receive the alert acknowledgement emails.

The configuration is available under the Advanced Services group as shown below.

The configuration dialog asks for typical email account information that will allow it to look at the received email messages.

Once Email Acknowledgement is enabled, email alerts will have the ID appended to the subject.

Additional Control

Alerts will not be acknowledged if the reply is an "Auto-Submitted" message, such as a vacation notice. These are detected by the AUTO-SUBMITTED email header that should be present according to RFC 3834.

You can futher control which emails count or don't count as an acknowledgement by changing the following registry values:

• Mail_Ack_Keyword - A comma delimited list of keywords to search for. If a keyword contains a * character, the word can be a partial match. So GO* could match GONE or GOING for example. If these keywords are seen, the email is acknowledged. If no keywords are defined (the default case), simply replying to the alert email will acknowledge it.
• Mail_Ack_Skip_Keyword - Also a comma delimited list of keywords. If a keyword in this list is found, the reply email does not trigger an alert acknowledgement.
• Mail_AckAll_Keyword - A comma delimited list of keywords that defaults to ACKALL. If a keyword from this list is seen, all errors from the computer that sent the alert will be acknowledged.

Two additional registry settings that can be changed:

• Mail_Ack_LinesChecked - Defaults to 4. Only this many lines at the top of the email will be checked for Ack commands.
• Mail_Ack_Maint_Cmd - Empty by default (so disabled by default). You can give a keyword, such as MAINT, and if MAINT is seen, the next value will be considered a number of minutes to put the servers into maintenance for (example: MAINT 15)

Examples:

Mail_Ack_Keyword: {blank}
Any email received will cause the alert to be acknowledged.

Mail_Ack_Keyword: ACK
Received emails must contain 'ACK' in the first {Mail_Ack_LinesChecked} lines for the alert to be acknowledged. If that is not seen, the alert is not acknowledged.

Mail_Ack_Skip_Keyword: vacation
An auto-responder email is received that contains "I'm out of the office on vacation". It will not cause an acknowledgement.

Mail_Ack_Keyword: {blank}
Mail_Ack_Maint_Cmd: MAINT
An email is received that contains in the first few lines: MAINT 10
The server will be put into Immediate Maintenance for 10 minutes, and the alerts will be acknowledged since no keyword is required by Mail_Ack_Keyword.

Mail_Ack_Keyword: ACK
Mail_Ack_Maint_Cmd: MAINT
An email is received that contains in the first few lines: MAINT 10
The server will be put into Immediate Maintenance for 10 minutes, but the alert will NOT be acknowledged because the required ACK keyword was not seen.

Mail_Ack_Keyword: ACK
Mail_Ack_Maint_Cmd: MAINT
An email is received that contains in the first few lines:
ACK MAINT 15
- or -
ACK
MAINT 15
The server will be put into Immediate Maintenance for 15 minutes, and the alert will be acknowledged.

Mail_Ack_Keyword: ACK*
If an email is received that contains ACKNOWLEDGED, ACK, ACK'D, or ACKNOWLEDGING, the alert will be acknowledged.