SCOM 2012 delay forwarding alerts to internal connector

All,
Is there anyway to delay alerts being forwarded to a connector similar to how you can with email subscriptions?
I need to delay alerts being forwarded to AlertItNow connector until a powershell channel subscription has run.
The powershell script populates Custom Field 1 which is required to run before the alert is forwarded to ServiceNow helpdesk.
Thanks,
Darren

Hi Darren,
I have to say that, as far as I know, no built-in way to delay forwarding to a connector.
There is an option for delay aging for notifications configuration.
http://blogs.technet.com/b/kevinholman/archive/2012/04/28/opsmgr-2012-configure-notifications.aspx
Regards,
Yan Li
Regards, Yan Li

Similar Messages

SCOM 2012 Web Transaction alerting after second bad poll

I'm trying to create a synthetic web transaction that will raise an alert after the second bad occurrence. Anybody have any idea as to how to accomplish this to filter hair trigger errors.

More info:
SCOM 2012 - Monitoring the System Center 2012 App Controller Website
http://kevingreeneitblog.blogspot.com/2012/01/scom-2012-monitoring-system-center-2012.html
Please remember to mark the replies as answers if they help and unmark them if they provide no help. If you have feedback for TechNet Subscriber Support, contact [email protected]

SCOM 2012 SP1 - Automating alert ownsership with command channel notification: the command keeps executing

Hello everyone,
here is the context: one of my client wants that, when a SCOM operator changes the resolution state of an alert to a specific resolution state "XYZ", the alert's ownership is automatically set to this user's AD Account.
What I did:
a PoSh script that takes the alert ID as a parameter, extracts the user ID from the alert's history - get-scomalerthistory - and sets the alert's owner field with this ID - set-scomalert -owner.
a command channel running the script
a subscription that triggers for alert with the specific resolution state "XYZ"
It works great the first time - when the user sets the alert to XYZ state. Problems come right after this as it seems that modifying the alert in anyway - via GUI or script - will trigger the subscription once again.
So, in fact, I need the subscription to trigger only when the alert CHANGES its resolution state to XYZ.
Does anyone have an idea about this ?
Reagrds,
P. Augras

Hi, it's predictable behavior as your script updates the alert property but alert property matches criteria specified. So one of methods is to change the resolution state in script to another state, something like XYZProcessed.

Monitoring services on MSMQ cluster with SCOM 2012

Hello guys,
I'm looking a way that SCOM 2012 is able to monitor several services installed on MSMQ cluster. I think it's possible that SCOM 2012 can generate alert through the message queuing service associated to these services but this is an indirect monitoring. I
would want that SCOM generates the alert for the specific service in problem.
Any suggestion?
Thank you very much.

Hi,
There is a management pack for Message Queuing.
You can download it from http://www.microsoft.com/en-us/download/details.aspx?id=36775
Hope it help's
Greetings,
Roel Knippen
Please remember to click “Mark as Answer” on the post that helps you, and to click “Unmark as Answer” if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.

Automatic Maintenance Mode SCOM 2012

What I'm trying to do is get an alert based on a shutdown event to trigger a script that then puts the server into maintenance mode. I've seen a few solutions to this for 2007, but this is the only one I've seen for 2012.
https://overcast.azurewebsites.net/2013/11/auto-maintenance-mode-with-scom-2012/
Basically, an alert is set up to watch for the shutdown event, which then uses a command channel to execute the script. The main significant part of that is the use of the ManagedEntityDisplayName parameter in the command channel to pass the server
name to the script. If I run the script from a command prompt and pass the FQDN of the server to it as a parameter, it works like a charm. But when I use SCOM to run it through the command channel, the server never gets put into
mm. For troubleshooting, I had it write a couple things to a log file.
When I run it from the command prompt, the log file contains the hostname I'm passing it for the ManagedEntity parameter in line 4, and the Instance that is returned from line 6 and it all works.
When I run it with the command channel in SCOM, it again writes out the ManagedEntity parameter as the hostname, so that part seems to work the same. But the Instance is returned to the log file as an empty line and then of course the server doesn't
go into MM. So it seems like something is different between me passing the FQDN as a parameter from the command line, and the command channel passing the ManagedEntity parameter from SCOM. Even though they both get written to the log file as the
hostname of the server. Any idea what I'm missing?
Param($ManagedEntityDisplayName)
$startTime = [DateTime]::Now
$endTime = $startTime.AddMinutes(15)
"Managed Entity is $managedentitydisplayname" |out-file log.txt
import-module OperationsManager
$Instance = Get-SCOMClassInstance -Name $ManagedEntityDisplayName
"Instance is $Instance" | Out-File log.txt -Append
Start-SCOMMaintenanceMode -Instance $Instance -EndTime $endTime

Hi
What version of Power shell are you using on your management server? The I suspect the issue might be that when you run it doesn't actually load "import-module
OperationsManager" when scom runs it. So when you execute any scom command and save it into a variable it will always be empty.
To test if this is the issue run this
Param($ManagedEntityDisplayName)
$startTime = [DateTime]::Now
$endTime = $startTime.AddMinutes(15)
"Managed Entity is $managedentitydisplayname" |out-file log.txt
import-module OperationsManager
$SCOMConnection = Get-SCOMManagementGroupConnection
"Connection is $SCOMConnection" | Out-File log.txt -Append
$SCOMAgent = Get-SCOMAgent -name $ManagedEntityDisplayName
"SCOMAgent is $SCOMAgent" | Out-File log.txt -Append
If you don't get anything for these variables looks like the Import module is the issue.
I suggest the following:
Adding the full file path location to the module (might just not be registered correctly)
see: http://msdn.microsoft.com/en-us/library/dd878350(v=vs.85).aspx
If the above doesn't fix the issue re installing the console might be needed
see: http://thoughtsonopsmgr.blogspot.com.au/2013/02/om12-sp1-operations-manager-shell-fails.html
What version of Power shell are you also running on your Management server/s? If you are running v4 you might also need to include credentials when making a connection to the management server:
see: http://blogs.technet.com/b/robcost/archive/2008/05/01/powershell-tip-storing-and-using-password-credentials.aspx
So your after you import the Operations manager module you need
New-SCOMManagementGroupConnection -ComputerName "localhost" -Credential (Get-Credential WOODGROVE\Administrator)
see: http://technet.microsoft.com/en-us/library/hh920188(v=sc.20).aspx
Also how many management servers do you have? If you have more that 1 don't forget to place a copy of the script in the same location on each MS.
Thanks Martin
sustaslog.wordpress.com

SCOM 2012 R2 Connector - Some alerts are not being picked up

I created a Windows service that connects to SCOM to collect unacknowledged alerts every 60 seconds. In the alert iteration process, the very first thing I do is post an update to the alert which indicates that the alert has been received.
When I'm done processing the alert, I post another update showing that the alert has been processed. After processing the alert collection, I acknowledge them with the "AcknowledgeMonitoringAlerts"
method.
The problem I am experiencing is that not all alerts are getting picked up by the connector, which is set up in OM with a subsciption to accept all alerts. This is happening randomly. One minute I'll see a specific alert for a specific server
come through, and an hour later, the same alert for the same server will show up in Operations manager, but won't come through in the connector. This is evident in the fact that the history tab in the alert doesn't show the updates that should
have been posted by the connector.
Anyone else seeing this type of behavior? Suggestions?

Hi,
Based on your description, the issue is random. Would you please check your operation manager event log and check for more details when this issue happen.
And in addion, you may refer to the below article:
Tools to Use for Troubleshooting Connectors
http://technet.microsoft.com/en-us/library/ee809020.aspx
Regards,
Yan Li
Regards, Yan Li

SCOM Internal Connector - Default Alert Format

Hi All,
We are having SCOM Probe, to Receive alarms from Netcool Connctor (Created at the time probe integration) and for that connector subscriptions are allowed to receive event
Post that, we are able to receive alarms of all them and all works fine.
But, For Service Availability Alarms,
Let Say: I have stopped one service , and got the alarm, but am not able to find exact service name and display name of service from raw data/event.
Further i have seen that , Monitoring Alert properties from below link
http://msdn.microsoft.com/en-us/library/microsoft.enterprisemanagement.monitoring.monitoringalert_properties.aspx
From above URL info, looks like by default am not getting Service Name and etc as like below.
URL : http://blogs.technet.com/b/kevinholman/archive/2007/12/12/adding-custom-information-to-alert-descriptions-and-notifications.aspx
Service Monitors:
Service Name                         $Data/Context/Property[@Name='Name']$
Service Dependencies             $Data/Context/Property[@Name='Dependencies']$
Service Binary Path                $Data/Context/Property[@Name='BinaryPathName']$
Service Display Name             $Data/Context/Property[@Name='DisplayName']$
Service Description                 $Data/Context/Property[@Name='Description']$
http://blogs.technet.com/b/kevinholman/archive/2007/12/12/adding-custom-information-to-alert-descriptions-and-notifications.aspx
How to get Service Name and others along with Monitoring Alert Props via connector to Netcool Event Mgmt Systems.
Is there any possibility to get Service Name and Display Name in Custom Fields Available in Default Monitoring Alert Properties ??
Thank you so much in advance.
Regards
Sekhara
9611200711

Hi Yan Li
Thanks for your reply.
Can you correct me in terms of syntax used in Custom Field
In your ex link i can see
<Property Name="CustomField9" NewValue="$PrincipalName$" GroupIdFilter=""
/>
        <Property Name="CustomField10" NewValue="$Severity$" GroupIdFilter=""
Above values taken from Monitoring Alert Class Members right ?
I wanted to store Service Name and Display Name as like above my query
As per my ex: Service Name = $Data/Context/Property[@Name='Name']$
CustomField1 = Here what value should i put here ??
Am pretty new to SCOM, am doing SCOM integration with Netcool.
So i need to know exact value , to propose right changes in SCOM to Client
Thanks
Sekhara
Sekhara Reddy

Orchestrator/SCOM 2012 and UTC Time for Get Alert

We are currently moving to using Orchestrator to act as a connector between SCOM 2012 and Unicenter for ticket generation. Right now, the runbook that I have built out does the following.
Monitor Date/Time > Format Date/Time > Get Alert
The monitor Date/Time runs every 60 seconds.
Format Date/Time then pulls from a variable that grabs the current time using now(). I then have it adding 4 hours and 55 minutes to the time to set the UTC time to 5 minutes earlier.
Get Alert then looks for all alerts that meet a specific criteria. This includes the time and any alert that was generated within the last 5 minutes, which is why I have it currently set to 4 hours and 55 minutes.
In a few months, that's going to break and I'll have to manually update the format date/time to 5 hours and 55 minutes. What I'm trying to find is a way to do this automatically so the runbook doesn't have to be modified. I'm thinking of using
the 'Activity End Time in UTC' from the Monitor Date/Time but want to see if there's any other easier way of doing it.

Hi again,
If the question is to have a an easy way to get only Alerts not already seen with "Get Alert" before:
Use "Update Alert" and update fields like TicketID or ResoultionState after "Get Alert" and exclude this criteria in the Filter tab of "Get Alert" ...
Regards,
Stefan
www.sc-orchestrator.eu ,
Blog sc-orchestrator.eu

Nagios- SCOM 2012 Connector

Hi,
We have a requirement that "We need alerts to SCOM 2012 from open source tool Nagios"
I found one connector which can send alerts from SCOM to Nagios. But, as per my understandings it is only one way connector.
I need a solution that Nagios can speak to SCO 2102. That is I need Nagios alerts in SCOM.
I hope Microsoft expert can help me on this. Please give me some good solutions.

Hi,
I will help you to collect the requirements. Thanks for using SCOM 2012.
Niki Han
TechNet Community Support

How to configure windows services alerts in SCOM 2012 for all agent servers. For eg, Terminal Services, Netlogon, RPC etc..

Hi,
I need to configure different windows services alerts in SCOM 2012. Below are some of the windows services I need to monitor through SCOM.
Serivce: Windows Management Instrumentation
Service: Netlogon
Service: Remote Procedure Call (RPC)
Service: Server Service
Service: Terminal Services
Service: Windows Time
Service: Workstation
Service : WWW Publishing Service
Could some one please assist or share me the details, how to configure these services for windows agent servers.
Thanks..
Regards, Rajeev Parambil

Hi,
A certain set of services are monitored by default on all agents:
DNS Client
DHCP Client
RPC
Workstation
Server
For all the other services you could create a service monitor.
A nice blog series outlining this process can be found here: http://www.bictt.com/blogs/bictt.php/2011/03/16/scom-monitoring-a-service-part1
It's doing common things uncommonly well that brings succes. Check out my SCOM link blog:
SCOM link blog

Only Alert Data is not being inserted in SCOM 2012 Data Warehouse database

Hi All,
Alert data is not getting inserted into SCOM Data Warehouse database since 10 days though I could see latest Performance data in DW DB. No changes were made as far I know on SCOM servers or DB's. I had this issue few months back
and got resolved by executing a qiery to create an entry for Data Warehouse Synchronisation server entry.
Now I have checked the discovered inventory and could see an entry present and it is healthy. Still, latest Alert data is not getting inserted into DW DB. Please help me out.
http://social.technet.microsoft.com/Forums/en-US/2dac4f45-4911-40dc-a220-702993188832/alert-data-is-not-present-in-scom-2012-data-warehouse-database-since-two-weeks?forum=operationsmanagergeneral
Regards, Suresh

Hi,
Generally, data warehouse store a long-term data, and by default, it would keep 400 days data, I suggest check your configuration:
How to Configure Grooming Settings for the Reporting Data Warehouse Database
http://technet.microsoft.com/en-us/library/hh212806.aspx
Alex Zhao
TechNet Community Support

SCOM 2012 SP1 - PowerShell Script failed to run - 3 alerts appear after every reboot of the SCOM Server

Brand new SCOM 2012 SP1 install with Update Rollup 1 applied
Single server, local SQL install, SQL Server 2012 SP1
Hyper-V VM running on Server 2012. VM has 8GB Ram, single vCPU
Going through initial management pack importing and configuration, at this point I have the Windows Server 2012 and SQL 2012 MP's installed.
See screenshot
http://i.imgur.com/l0Molh1.png
I am getting the following alerts in my SCOM console and cannot find a resolution to fix the issue. I don't want to set an override, as an override will prevent the PowerShell alert in other instances, where I might want to receive an alert.
Looking at the alert description, it states "The Data Access service is either not running or not yet initialized"
The SCOM Console launches and responds fine, and I get no other errors. I check the Data Access service and it is online. I have left the system alone for a couple of hours and no other errors. I then closed those alerts and restarted the
server, and they came right back in, so I know that this is something that is happening at either server startup of during the start of the SCOM services.
Is it possible that SCOM is trying to execute these scripts and the Data Access service has not come online yet?
Has anyone else come across this before?

Please try the method in the following thread:
Note: As there is operations related to Registry, please perform a backup before doing this.
OpsMgr 2012 - Power Shell Script failed to run
http://social.technet.microsoft.com/Forums/de-DE/systemcenterde/thread/4be37f8d-1e7b-450c-8cb9-f1e95f3b2bd0/
Thanks.
Nicholas Li
TechNet Community Support

Alert data is not present in SCOM 2012 Data Warehouse database since two weeks

Alert data is not present in SCOM 2012 Data Warehouse database since a week though I could see Performance data for the latest dates. Old Alert data is present but I think the latest Alert data is not being inserted to Data warehouse. No activity was done
on the day from where we are missing data.
I could see 31554 events on all my Management servers and this proves that Data Insertion is happening. I am not sure why only Alert data is missing (or not getting inserted) in DW database. I am trying to use SQL queries to fetch the data as I dont have reporting
currently. The same query is working for other dates, so there is no issue with this query.
I have noticed that I could see the Alert Data present in SCOM OperationsmNager Db but NOT present in OperationsManagerDW database.
In SCOM 2007, data will be inserted in both Ops DB and DW simultaneously. I believe the same methodology in 2012 too.
Please help me to fetch Alert data from DW. Any suggestion pls?
Regards, Suresh

Hi,
Generally, data warehouse store a long-term data, and by default, it would keep 400 days data, I suggest check your configuration:
How to Configure Grooming Settings for the Reporting Data Warehouse Database
http://technet.microsoft.com/en-us/library/hh212806.aspx
Alex Zhao
TechNet Community Support

How can I add SCOM 2012 Alert Context within a SCOM Alert When using a cusom powershell script in a two state monitor?

Hello, we have a two state monitor and I would like to channel the Alert Context to Alert Description.
The powershell script being used to find the stopped services is pasted below:
$API = new-object -comObject "MOM.ScriptAPI"
$bag = $api.CreatePropertyBag()
$ServiceStatus = Get-WmiObject -class win32_service |where {$_.startmode -eq'Auto'-and $_.State -eq 'Stopped' -and
$_.name -ne 'wuauserv'}
if (!$ServiceStatus) #if there are no automatic services that are stopped, we are healthy.
write-host "good"
$bag.addvalue("State","good")
if ($servicestatus) #if there are any automatic services that are stopped, we are unhealthy.
write-host "bad"
$bag.addvalue("State","bad")
foreach ($service in $servicestatus) #enumerate the stopped services
$bag.addValue("$($Service.Name):","$($Service.state)")
$bag
$API.Return($BAG)
The results of the services that are stopped are being captured in the Alert Context”. How can I pipe the Alert Context to “Alert Description” to obtain a meaningful alert?
Alert Context data:
Property Name                              Property Value
State
bad
clr_optimization_v4.0.30319_32: Stopped
clr_optimization_v4.0.30319_64: Stopped
How can I pipe to Alert Description in SCOM 2012?
Thanks,
Kapil Dham
Kapil Dham

you don't need write-host
you should create
$bag.addvalue("ServiceName1","StateOK")
$bag.addvalue("ServiceName2","StateStopped")
and in alert description you will see
ServiceName1
StateOK
ServiceName2
StateStopped
So try $bag.addValue($Service.Name,$Service.state)
and $Data/Context/Property$

SCOM 2012 monitoring IIS - windows updates generate SCOM alerts

We are using SCOM 2012 to monitor our environment. There is a logic implemented to suppress alerts (using maintenance mode) when Windows Updates cause system reboot.
We followed:<o:p></o:p>
http://operatingquadrant.com/2009/08/15/scom-automatically-starting-maintenance-mode-when-servers-are-rebooted-for-patching/<o:p></o:p>
Basically when in system event log event id 1074 appears then system is put in Maintenance mode. There is a problem with some IIS web servers - they
generate a lot of alerts when Windows Updates are installed (e.g. Microsoft Windows Internet Information Services 2003 Application Pool is Unavailable)
and before windows reboot. In details:
5:08 AM - Windows update installation in event log (event id 19)e.g.
Installation Successful: Windows successfully installed the following update: Security Update for Microsoft .NET Framework 4 on Windows Server 2003, Vista, Windows 7, Server 2008 x86 (KB2972106)
5:09 AM - SCOM generates alerts: Microsoft Windows Internet Information Services 2003 Application Pool is Unavailable
5:17 AM - event id 1074: The process winlogon.exe has initiated the restart of computer. SCOM put this server in Maintenance mode.
After 5:17 AM no more alerts generated by SCOM
We cannot change our logic and put system in maintenance mode based on event ID 19 (windows update installation) because there are a
lot of event ID 19 events generated almost every day. So we do not want to put our server in maintenance mode each time when windows updates are installed. Just when windows update installation cause some IIS features stops. Any idea?

For issue 1074, You can refer below link
http://theitcrownd.blogspot.com/2012/01/set-up-automatatic-scom-maintenance.html
Please remember, if you see a post that helped you please click "Vote As Helpful" and if it answered your question, please click "Mark As Answer"
Mai Ali | My blog: Technical | Twitter:
Mai Ali

SCOM 2012 delay forwarding alerts to internal connector

Similar Messages

Maybe you are looking for