When a rule triggers locally on a machine, it should generate an alert and send it to the Event Console. There may be abnormal circumstances, however, that could prevent the alert from appearing, or being processed by, the agent or the Event Console. Suspicion can be validated by referring to the following file, located on the monitored resource:
Windows x86: [Symantec Management Agent install path]\Altiris Agent\Monitor Agent\RuleState
Windows x64: [Symantec Management Agent install path]\Altiris Agent\x64\Monitor Agent\RuleState
UNIX/Linux: [Symantec Management Agent install path]/notification/monitor/var/RuleState
The RuleState file contains all currently triggered rules for that resource by rule GUID. The rule GUID can be looked up by searching the Monitor Agent's Config.xml file, also located in the Monitor Agent installation path. Currently triggered rules in the RuleState file should have a corresponding alerts in the Event Console.
The exact cause is currently unknown.
Some causes can be:
To resolve if the alert is not being sent to the SMP:
Check the file C:\Program Files\Altiris\Altiris Agent\Monitor Agent\Config.xml. If it is 0kb, it can be reset as follows: