Missed event monitor with event reset

Question

I have pretty simple request for Scom monitoring, but I don’t know how to do it. My application generates an event in custom log with name Mpis. Event level is Informational, Event ID is 10 and source is Mpis. This event is created every
5 minutes. If application failed, event isn’t created. I have a need to create an alert, if event isn’t created more than one hour and monitor must go into unhealthy state (red). If same event come back, monitor must resolve itself and go back to healthy (green).
I try doing this with missed event monitor with event reset, but they don’t work as I expected, probably because I use the same event for trigger an alert and resolve an alert. Any idea ?

Answer 1

There must be something misconfigured. Missed Event Detection -> Windows Event Reset is the correct one.
Use Event ID 10 and Source Mpis as expression in both Simple Event Expression and Missing Event Expression. in Missing Event Detection, use "Based on fixed simple recurring Schedule" and choose 60 minutes/1 hour.
I have configured this in my environment, and this works perfectly; if no events are logged within an hour, i get an alert. If i then create the event, the alert Closes.
www.coretech.dk - blog.coretech.dk