List alerts meeting Management Pack, Severity, and Priority criteria

Question

Hello,
As part of our Management Pack Life Cycle Management Process, I need to identify the alerts meeting the following criteria:
1.      
Generated from objects hosted by a specific subset of Management Packs (ex.: Windows Server 2003 & Windows Server 2008 (Monitoring))
2.      
With a particular subset of “Severities” (ex.: Severity = Critical | Warning)
3.      
With a particular subset of “Priorities” (ex.: Priority = High)
Alert Views
Though I can scope an alert view by severity & priority, I cannot scope by source Management Pack. 
I therefore see alerts from all Management Packs! L
Alert Report
Though the Alerts report (under
Microsoft generic Report Library) allows me to scope by Severity & Priority, here too I cannot scope by source Management Pack.
I guess ideally, I would either:
1.      
Create a new report, allowing me to specify the desired criteria; or
2.      
Build & run a SQL statement that would extract the information directly from the database
The problem is that I haven’t yet gained enough experience with OpsMgr to build either of them.
Looking forward to hearing from someone,
Larry

Answer 1

Hi Larry
Try the following:
# Name of Root Management Server
$RMS="XXXXXXXXXXXXXXXX"
# Initialise OpsMgr Provider
write-Host
write-Host "Executing UpdateAlerts.ps1 ..."
write-Host
## prepare OpsMgr shell
if ((Get-PSSnapin | Where-Object {$_.Name -eq 'Microsoft.EnterpriseManagement.OperationsManager.Client'}) -eq $null) {
Write-Host
Write-Host "File loaded."
Write-Host "Initializing shell for operations manager..."
Write-Host "Add Microsoft.EnterpriseManagement.OperationsManager.Client snap in."
Add-PSSnapin Microsoft.EnterpriseManagement.OperationsManager.Client -ErrorAction SilentlyContinue -ErrorVariable Err
if ($Err) { $(throw write-Host $Err) }
if ((Get-ManagementGroupConnection | Where-Object {$_.ManagementServerName -eq $RMS}) -eq $null) {
Write-Host "Connect to Management Server: $RMS"
New-ManagementGroupConnection $RMS -ErrorAction SilentlyContinue -ErrorVariable Err
if ($Err) { $(throw write-Host $Err) }
if ((Get-PSDrive | Where-Object {$_.Name -eq 'Monitoring'}) -eq $null) {
Write-Host "Create Monitoring drive from Provider."
New-PSDrive -Name: Monitoring -PSProvider: OperationsManagerMonitoring -Root: \ -ErrorAction SilentlyContinue -ErrorVariable Err
if ($Err) { $(throw write-Host $Err) }
Write-Host "Operations manager shell initialized."
Write-Host
Set-Location Monitoring:\$RMS
# Rules - Alert Name, Severity, Priority, Management Pack
get-alert -criteria 'PrincipalName is not null and ResolutionState = ''0'' and IsMonitorAlert=''False''' |
select-object name, Severity, Priority, @{Name="ManagementPack"; Expression={((get-rule $_.monitoringruleid).getmanagementpack()).displayname}} |
Export-csv c:\temp\listalertsfromrules.csv
# Monitors - Alert Name, Severity, Priority, Management Pack
get-alert -criteria 'PrincipalName is not null and ResolutionState = ''0'' and IsMonitorAlert=''True''' |
select-object name, Severity, Priority, @{Name="ManagementPack"; Expression={((get-monitor $_.problemid).getmanagementpack()).displayname }} |
Export-csv c:\temp\listalertsfrommonitors.csv
It works for me (at the moment it lists all alerts with resolution state = 0 but you can change the -criteria clause to amend that). You could also add filters for different priorities and severities and I guess add on date ranges ... but lets check the
base script works for you first!
Just a few things you'll need to amend in the script:
1) The RMS is defined in the second line - you'll need to specify your RMS
2) I have saved the output to a folder c:\temp - either create such a folder or change the file output path
Let us know how it goes.
Cheers
Graham
View OpsMgr tips and tricks at
http://systemcentersolutions.wordpress.com/