Get Agent that triggered SCOM Alert

Hi Everybody!
Is there a way to get the agent id that has triggered an alert in SCOM? Maybe with Powershell or SQL Query?
I was searching the Internet and tried some things but still have no solution for it ...
We are using SCOM 2012 SP1.
I need that for an Orchestrator Runbook that creates incidents in our ticket system (it's not SCSM ;)).
Thank you!
Wolfgang

For SQL, executing the below query would get you the agent id
select basemanagedentityid from alert where <<your condition>>

Similar Messages

Get element that triggered action

Hello,
Does anybody know how to find out which element on the screen triggered the action? Within action method I need to know which element triggered the action.
Elements are created dynamically and action to them is bound during run time.
Thank you.

Example: You have 2 buttons "B1", "B2" and both are assigned the same action. How to know in the action handler which button was pressed?
Solutions: Event parameter mapping
B1.mappingOfOnAction().addParameter("Button", "B1");
B2.mappingOfOnAction().addParameter("Button", "B2");
Declare an action parameter "Button" of type String. Then at runtime, this parameter will contain "B1" or "B2" depending on the button that was pressed.
Armin

SCOM Alert Connector - not updating the start time and finish time

When I am monitoring the status of connectors in service manager console, I found that for SCOM Alert Connector the Start Time and Finish Time are not updating. Previously it was updated daily. As of now, service manager is working fine but would like
to check will it create any issues? Even I have cliked on Synchronize Now, but there is no update. Please guide me on this to trouble shoot further? Thanks.

Hi,
Based on my research, the Start Time and Finish Time values are not updated when an alert connector is synchronized. These values are only updated when alert data is transferred between Operations Manager 2007 and Service
Manager.
More details, please refer to the link below:
http://technet.microsoft.com/en-us/library/hh495609.aspx
In addition, here is a blog about troubleshooting for SCSM and SCOM alert connector:
http://blogs.technet.com/b/servicemanager/archive/2010/04/14/troubleshooting-tips-for-your-scsm-scom-alert-connector.aspx
Regards,
Yan Li
Regards, Yan Li

How to get SCOM alerts and send single summary email of one's that have breached.

Hi,
I'm trying to create a runbook which does as the title suggests, ie I want to get the 'Active' alerts from the console which have breached our SLA, which is No Critical or Warning alerts in resolution state of New for more than 24 hrs, and emails this list
to an internal Distribution List of all the potential service owners. Its just intended as a daily email to poke the relevant people not to ignore the console alerts :-)
I'm able to Get Alerts OK, but from there I'm having diffs. I have been given a powershell (as I'm no good at Powershell myself) which does the filtering to get the relevant breached alerts, but when I pass output to other activities and ultimately
to the create/send email, I end up only able to get multiple emails, one be alert which matches the filtering from powershell. I have appended to a file to check that I can write the alert properties line by line, but for example if Ive 4 alerts then
I end up with 4 emails - I want one email with each alert detail (severity, Alert name, path,resolutionstate, Days/hrs in breach, Service Owner (custom Field 3) etc). I have toyed with flattening the output with line breaks and/or commas at various points
along the activity chain to ftry force a single iteration of te send email but this just messes the format to the point of not being useful.
So was wondering if anyone could advise if this is possible, esp if able to do it using the standard activities along with SCOM IP - I'm sure doing it all in powershell it a possible answer but I'm not proficient to do it - unless someone can provide
said script! :-)
Another possibility which has crossed my mind is to possible query the OpsMgr DB directly using the Alert ID from Get Alert but haven't tried tht yet. I think I' stuggling to understand the basic of how the data is passed from activities esp using
the 'flatten outpout method.. My current runbook has the fllowing activities:
GetAlert -> Run .Net (powershell for filtering for breaced alerts) -> AppendFile (to Check the alert output) -> Create/Send Email(to send summary email). What happens is if I have say 4 Breached emails in Console, when I run tester I
see GetAlert runs Once detail shows it has found 4 alerts), then each activity up the chain runs 4 times so that finally I end up with 4 emails.
If anyone has any suggestions it would be much appreciated - I can provide any more details/upload pic of current runbook if it helps...
Thanks...

Hi thanks for the suggestion. I've tried playing around with the runbook using the Junction activity infront of the sendmail. It doesnt appear to do anyting in itself (unless I'm not using it correctly). The only way I can get the email
to only send once is if I flatten the output from the returned data behaviour - this works if I flatten at the Get Alert stage without the Junction activity or if I use the junction an flatten it then the email fires once.
However the problem with this is that each field for each alert is written vertically, so if I have 3 alerts returning 3 pieces of returned data I get:
<Alert1 datafield1>
<Alert2 datafield1>
<Alert3 datafield1>
<Alert1 datafield2>
<Alert2 datafield2>
<Alert3 datafield2>
<Alert1 datafield3>
<Alert2 datafield3>
<Alert3 datafield3>
wereas I wan the dat to appear in horizonally with each alert details on each row as like when written to a file, ie
<Alert1 datafield1> <Alert1 Datafield2> <Alert1 DataField3>
<Alert2 datafield1> <Alert2 Datafield2> <Alert2 DataField3>
<Alert3 datafield1> <Alert3 Datafield2> <Alert3 DataField3>
Without the use of flatten, the email which fires once for each alert has the data displayed correctly. So essentially what I'm hoping to get is all returned alert details one per line/row in the body of the email...
If theres any easy way to do it withing the orchestrator activities would be great. Otherwise it looks like I might have to try find a powershell or SQL script to pull back alert data. Cheers...

How do we alert agents that there are other calls in the queue?

Hey,
I'm trying to figure out a way to alert agents that there are other calls in the queue (whether they're ready or not-ready). I've seen systems that have a separate button on the phone that flashes when there's a call sitting in the queue.
The purpose of this is two fold:
1) if they are on a call they know they need to step up the game a bit to get the current issue resolved.
2) if they are "not-ready" and didn't notice the software, the blinking phone should help jump-start their brain to think "why isn't my phone ringing?"
A wallboard, while nice, is not practical for the situation i'm looking at (information desk). I'd like to minimize the number of things they have to keep track of (walk-ins, a PC, and the phone only), and a flashing button seems like a good way to do that.
Has anyone seen something similar to this on UCCX?
JM

Hi thanmad,
I don't have a sample script with me on hand now, the script i did before is part of our production scripts. But the script required to alert the agents is fairly simple.
First part is identifying when you would like the alert to be triggered, for example say when the call is been in the queue for 2 minutes. You can achieve this in different ways; you can use “Get reporting statistic” and use a field which will give you the Current wait duration of the caller, in this case Report object “csq ipcc express” need to be selected. You then need to compare the result with the predefined duration (seconds) and if the result is higher, then trigger the Alarm.
The Alarm is triggered to the alerting device by using “Call Consult Transfer” set a time out for it and then send the call back to the Queue. Make sure this device doesn’t have any VM setting or forwarding configured to it. If you don’t want reporting statistics you can just put this step where you want in the script and when the call hits it, it will trigger the alarm.
Not sure if it makes sense to you but I would recommend you playing with it and see if it is what you are looking after.
HTH!

Identify SCOM agents that do not have an SCCM client

I would like to identify SCOM agents that do not have an SCCM client installed. I have the SCCM mp installed as well as the SCCM client health mp provided by Tao Yang installed. I believe I could create my own registry discovery to identify
if the SCCM install exists, but was wondering if there was a way that could leverage the existing SCCM mps I have in place instead of duplicating efforts.

Try running a report in SCCM and then check it against the windows server group in SCOM.
Check it into excel and then use the highlight duplicates. This should give you list of servers that are missing either SCCM or SCOM agent.
This is a manual process but you could look at scripting this:
extract SCCM server list (Export -CMDeviceCollection)
extract SCOM server list (See:
http://scom-2012.blogspot.com.au/2013/11/scom-2012-powershell-retrieving-list-of.html)
$Group = Get-SCOMGroup | where {$_.DisplayName -eq "Windows Computers
$Members = $Group.GetRelatedMonitoringObjects()
$Members
compare lists
email/save report
Schedule it.
Cheers,
Martin
Blog:
http://sustaslog.wordpress.com
LinkedIn:
Note: Posts are provided “AS IS” without warranty of any kind, either expressed or implied, including but not limited to the implied warranties of merchantability and/or fitness for a particular purpose.

So, I made my account a while ago before I had an iPhone so I can get music. The result of that I can't remember my security questions, and it tells me to send a rescue email an alert, but it doesn't show you how to get to that page. Can someone help me?

So, I made my account a while ago before I had an iPhone so I can get music. The result of that I can't remember my security questions, and it tells me to send a rescue email an alert, but it doesn't show you how to get to that page. I am getting quite annoyed because apples hours arent the best fitted to my scedule since I have school and work, so I cant call and ask how to get fixed. Please help me all I want to do is buy some music...

Click here and fill out the form.
(90729)

I just got the iPhone 5 and noticed that the message alerts will only alert once . I have it set up as 3 times and its not working . Please help. I'm running 6.0.2 and I really starting to get ****** off with apple products

I just got the iPhone 5 and noticed that the message alerts will only alert once . I have it set up as 3 times and its not working . Please help. I'm running 6.0.2 and I really starting to get ****** off with apple products

Instead of getting annoyed, read the User's Guide and try basic troubleshooting.

Escalation not getting triggered in Alert

Hi
I have triggered an alert from BPM which is successfully received both in my mail box as well as Alert inbox.
If the Alert is not confirmed, it should trigger an Escalation. In the Alert configuration I have maintained the recipient of the Escalation message, the tolerance limit and also have checked "Escalation Active"
But the Escalation is not getting triggered. Kindly advice...
Anup

Hi Anup,
Please go through these..
http://help.sap.com/saphelp_nw2004s/helpdata/en/96/f1033c128f4a7de10000000a114084/frameset.htm
http://help.sap.com/saphelp_nw2004s/helpdata/en/4a/2dc1e0778648afa9e69d9a44244def/frameset.htm
http://help.sap.com/saphelp_nw2004s/helpdata/en/49/cbfb40f17af66fe10000000a1550b0/frameset.htm
cheers,
Prashanth

When visiting gmail and sometimes facebook, on my mac, the page doesn't load fully and I get an empty old styled alert box that cannot be closed.

It seems that when I visit gmail, occasionally, only the top part of the page loads and i get one of the old alert boxes. This alert box, however, doesn't have a message; it is blank. i can click 'ok' or 'cancel', but it does nothing.
I have a few plugins, and had to disable them. I do keep Firebug, however. and web devloper toolbar since I use FF for developing.
I have not noticed this on my PC version of FF.
this error happened with FaceBook once or twice as well, but it happens more with Gmail.

Start Firefox in <u>[[Safe Mode]]</u> to check if one of the extensions is causing the problem (switch to the DEFAULT theme: Firefox (Tools) > Add-ons > Appearance/Themes).
* Don't make any changes on the Safe mode start window.
* https://support.mozilla.com/kb/Safe+Mode
* https://support.mozilla.com/kb/Troubleshooting+extensions+and+themes

In my utility program i get information, that the SUID file "System/Library/Core...Agent" became a change and is not to fix. What say me this and is it a problem?

in my utility program i get information, that the SUID file "System/Library/Core...Agent" became a change and is not to fix. What say me this and is it a problem?

See this
http://support.apple.com/kb/TS1448?locale=da_DK

SQL Server Agent Job Duration monitor alerts incorrectly

As per SQL Server MP guide, changes in Dec 2007 update : Fixed a script that was resulting in invalid alerts being generated from the agent job's Job Duration monitor.
In my SCOM 2012 environment on few SQL servers I'm getting an alert from Job Duration monitor for SQL jobs that have completed well within the defined thresholds. Interestingly this monitor then resets on its own(The monitor has been initialized for
the first time or it has exited maintenance mode) and immediately turns critical again. I do not see any pattern around these state changes. These are weekly jobs, however the Job Duration monitor continues to alert for these specific jobs 10-15 times a day.
This is creating unnecessary noise in the environment.
Is anyone else facing this issue? I know I can disable this default monitor and create my own monitor. However I want to check if this is a known bug in this SQL MP(version 6.4.1.0).
Note : I'm aware about an updated MP version 6.5.1.0, however the release note doesn't specify if it fixes this issue.
Thanks,
Harry
Thanks, Harry :-)

Resolution: The issue was that the SCOM Agent was getting restarted repeatedly. Post restart health calculation was done again and the SQL Job duration monitors would reset and generate new alerts.
There is a recovery configured in an aggregate monitor to restart the SCOM Agent if Handle Count/Private Bytes of Health Service/Monitoring Host breach a set threshold. I had to create an override to change the thresholds for all Health Service/Monitoring
Host and exclude the recovery on Physical servers.
If there are large number of workflow on an SCOM Agent due to multiple MP(SQL, HP, etc.), the increase in Handle Count/Private Bytes is usual.
Thanks, Harry :-)

Enabling SCOM Alert Connector in SCSM

Hi,
Had a query regarding the Alert Connector in SCOM that forwards alerts in SCOM to SCSM (Service Manager) to create incidents.
Currently, we had SCOM and SCSM at the same level i.e 2012 SP1. But, in future we might have to upgrade to R2 so is there any compatibility matrix for the SCOM and SCSM versions for the Alert Connector. Like if we had SCOM on Sp1 and SCSM on R2 would it
affect or the vice-a-versa.
Regards,
Daya Ram

Hi,
System Center 2012 – Operations Manager is supported by Service Manager and Service Manager SP1 for connectors and agents. However, only corresponding System Center versions are supported when you register a data source in the Data Warehouse
workspace.
System Center 2012 – Operations Manager agents were not supported with System Center 2012 – Service Manager. However, the agent that is automatically installed by System Center 2012 – Service Manager
SP1 is compatible with System Center 2012 – Operations Manager and System Center 2012 – Operations Manager SP1.
More details:
Operations Manager Considerations in System Center 2012 - Service Manager
http://technet.microsoft.com/en-us/library/hh524312.aspx
Regards,
Yan Li
Regards, Yan Li

SCOM Alerts Connector run as failed

Hi
I have setup the SCOM alerts connector in SCSM but after that i starts to get wernings in scom on servers there are in a difrent domain.
werning:
Description:
The Health Service cannot verify the future validity of the RunAs account Domain1\SCOMAlertsConnectorUser for management group SCOMMG01. The error is Logon failure: the user has not been granted the requested
logon type at this computer.(1385L).
SCSM and scom is in domain1
the servers i got the werning on is in Domain2
what can i do to fix this?

The connectors runas account must be administrator in SCOM (as I recall). Is that the case for Domain2?
Cheers,
Anders Spælling
Senior Consultant
Blog:
Twitter: LinkedIn:
Please remember to 'Propose as answer' if you find a reply helpful

SCSM to SCOM Alert Connector Error

Hello,
Long story short, the SCSM admin created an Alert Connector between SCSM and SCOM, then uninstalled SCSM and started over. That means I had an orphaned SCSM connector in SCOM.
In order to set up a new connection, I followed the instructions found in Kevin Holman's blog post:
http://blogs.technet.com/b/kevinholman/archive/2012/09/28/opsmgr-2012-how-to-delete-an-old-product-connector.aspx
Now, when I try to re-create a new Alert Connector, I get this error:
"Found at least one other alert connector in Operations Manager. Alerts may not be routed as expected if multiple connectors subscribe to the same alert."
I checked the SCOM server to make sure there were no orphaned connectors by running this SQL code against the OperationsManager database:
Aside from the copious number of SCVMM connectors, there were six connectors. Of those six, the previous SCSM connector is marked as "IsDeleted":
Next, I checked the "Microsoft.SystemCenter.Notifications.Internal" management pack to verify that there are no orphaned subscriptions. The ONLY alert referenced is for the "Advisor Data Connector".
At this point, my questions are as follows:
1) Will the System Center Advisor (now renamed Azure Operational Insights) connector cause the warning message I listed above when setting up an Alert Connector in SCSM?
2) Is there another orphaned entry in SCOM that I need to check for and remove before setting up the SCSM alert connector?

Hi,
I would like to suggest you remove the subscription that was orphaned. When remove a connector we should remove the subscriptions first.
And here is a similar thread
SCSM 2012 Cannot create SCOM Alert Connector
https://social.technet.microsoft.com/Forums/en-US/a5d0b921-bb0a-43b8-99ca-8b0112ab3bf0/scsm-2012-cannot-create-scom-alert-connector?forum=connectors
Regards,
Yan Li
Please remember to mark the replies as answers if they help and unmark them if they provide no help.

Get Agent that triggered SCOM Alert

Similar Messages

Maybe you are looking for