Resolve Alert subscription ID to name

Question

Hello everybody,
I'm expierencing some trouble with alert notification. On a regular base I get an alert about the fact that alert notification takes too long. I copied this from the eventviewer:
Log Name: Operations Manager
Source: Health Service Modules
Date: 6-10-2014 11:22:57
Event ID: 11411
Task Category: None
Level: Warning
Keywords: Classic
User: N/A
Computer: xxxx
Description:
Alert subscription data source module encountered alert subscriptions that were waiting for a long time to receive an acknowledgement.
Alert subscription ruleid, Alert subscription query low watermark, Alert subscription query high watermark:
5fcdbf15-4f5b-29db-ffdc-f2088a0f33b7,10/06/2014 09:07:09, 10/06/2014 09:10:09
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Health Service Modules" />
<EventID Qualifiers="32768">11411</EventID>
<Level>3</Level>
<Task>0</Task>
<Keywords>0x80000000000000</Keywords>
<TimeCreated SystemTime="2014-10-06T09:22:57.000000000Z" />
<EventRecordID>8281981</EventRecordID>
<Channel>Operations Manager</Channel>
<Computer>xxxx</Computer>
<Security />
</System>
<EventData>
<Data>5fcdbf15-4f5b-29db-ffdc-f2088a0f33b7,10/06/2014 09:07:09, 10/06/2014 09:10:09
</Data>
</EventData>
</Event>
If I'm understanding it correctly this ID "5fcdbf15-4f5b-29db-ffdc-f2088a0f33b7" is representing one of my subscriptions. So i tried to resolve it with Powershell, but this is what I get:
PS C:\Users\Slinkos> Get-SCOMNotificationSubscription -id 5fcdbf15-4f5b-29db-ffdc-f2088a0f33b7 | ft DisplayName
Get-SCOMNotificationSubscription : An object of class NotificationSubscription with ID 5fcdbf15-4f5b-29db-ffdc-f2088a0f
33b7 was not found.
At line:1 char:1
+ Get-SCOMNotificationSubscription -id 5fcdbf15-4f5b-29db-ffdc-f2088a0f33b7 | ft D ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : InvalidOperation: (Microsoft.Syste...scriptionCmdlet:GetSCNotificationSubscriptionCmdlet
   ) [Get-SCOMNotificationSubscription], ObjectNotFoundException
    + FullyQualifiedErrorId : ExecutionError,Microsoft.SystemCenter.OperationsManagerV10.Commands.GetSCNotificationSub
   scriptionCmdlet
So what am I doing wrong? I don't know how else I should troubleshoot this.

Answer 1

Slinkos,
Thank you for providing the alert name. Helped me in digging few things.
The event 11411 occurs when your MS / RMS is not able to send the alert notification via email.
Reasons:
Overloaded SQL server or Database space.
There is a huge alet flow in your SCOM environment.
Solutions:
1.Check the performance of the SQL server where the Operationsmanager and OperationsmanagerDW is hosted
Check the free space in both the DB's as well.
2. There is huge alert flow in your SCOM.  There is some rule / rules or Monitor / monitors generating very very frequently for which this overload is happening.
Did you recently configure any new set of rules / monitores ? 
Use the reporting feature to pull the top 10 contributed alert list to validate
Reporting --> Microsoft generic report library  --> Most common alerts report.
Also is there any time frame of this alert coming, then check the ops manager console for other alerts as well.
Post me the results.
Also if the above issue resolves automatically as you said then Event id 11412 will be generated.
So check When 11411 came and 11412 came so we can analyse the time difference when this hapens and auto recovers.
Gautam.75801