Troubleshooting Webhooks

Specific Issues

Strange API Key Account Types

Problem

When using a nonstandard account type linked to the API Key runas profile you may see various unexpected behaviors. Typically the API Key uses the last known good value.

Cause

This occurs if an unexpected Run-As account type is used (for example an SNMPv3 Run-As account).

Resolution

We recommend only using the 'Simple Authentication' Run-As account type - so you should revert to this account type in the first instance. Other account types may work to varying degrees, but we do not support their use.

Alert Generation Was Temporarily Suspended Due to Too Many Alerts

Problem

If a connection pulls in more than 50 alerts in 60s it will be disabled for 10 minutes.

Cause

This is standard SCOM alert storm protection functionality.

Resolution

Ideally, you should be spreading the load across multiple different webhooks to reduce the likelihood of any one webhook processing too much. You could also move to Inbound Event Webhooks to define individual rules and monitors to break down the calls into more distinct workflows. Should you need to, you can also adjust the thresholds on these alert storm protections, however, we do not recommend this.

The Lookup Template Failed, Please Correct the Syntax

Problem

When using Dynamic Object targeting and Criteria Expression Syntax on Inbound Event Webhooks you see the following error when testing the query:

Cause

Unfortunately, this can be caused by a great many things and can be difficult to work out the root cause of. If using Boolean Operators such as ‘AND'/’OR' break these down into their component parts and test each clause individually. If querying for a property, make sure that it is available on the class that you are querying against.