Auto resolve of alerts in SCOM

Hi Experts,

We used to get the below OS windows alerts when a planned reboot happend during patch of the OS windows servers. we receive all those alerts as incidents. This alerts are auto resolve after interval of 30 minutes. Therefore we want to reconfigure alerts in SCOM not to generate during patch time or check for 30 minutes for auto resolve. And we want those alerts as incidents if auto resolve not happend. Please guide me how to configure in SCOM console for auto resolve.

Health Service Heartbeat Failure
Windows service stopped the service
Memory Pages Per Second is too High

Thanks,
Sreenivasa
tscharyAsked:
Who is Participating?
 
tscharyAuthor Commented:
Thanks Rich for the information and solution. I have verified in SCOM.  In subscription under subscription criteria we have to choose an option Created by specific rule or monitor(source) option to delay the alerts. I wll test the same in verification.  Thanks for support!!!
0
 
Rich WeisslerProfessional Troublemaker^h^h^h^h^hshooterCommented:
SCOM uses some unusual terminology.  I assume you want SCOM to not send you an email msg about an alert unless remains an active alert for at least 30 minutes.  You can change that setting for the Subscriptions (Administration workspace, Notifications, Subscriptions... the fourth page of the Subscription dialog allows you to configure the "Alert Aging".)

If you simply don't want alerts during the patching window, you can put the servers which are being patched into Maintenance Mode during the patching process.  Assuming you want to do many devices programmatically, I suspect you'll want to use the Powershell cmdlet start-scommaintenancemode.

(I'm assuming your monitors are autoresolving alerts now?)
1
 
Rich WeisslerProfessional Troublemaker^h^h^h^h^hshooterCommented:
(I assume your Incidents are generated by a Notification Subscription... which are sending the notifications to a ticketing system.  If that assumption is correct, configuring the "Alert Aging" to 30 minutes will prevent those notifications from being sent if the alerts return to their original state within 30 minutes.  I think this is the answer you're looking for(?).)
1
Introducing Cloud Class® training courses

Tech changes fast. You can learn faster. That’s why we’re bringing professional training courses to Experts Exchange. With a subscription, you can access all the Cloud Class® courses to expand your education, prep for certifications, and get top-notch instructions.

 
tscharyAuthor Commented:
Thanks Rich for the information. I will go through Maintenance Mode during the patching process. I am not looking SCOM not to send email but am looking auto resolve of the  alerts in SCOM.

HPOM is the ticketing tool and Orchestrator process the alert from SCOM. our goal is to reduction of such alerts within scom by some automation without getting incidetns.

example for Health Service Heartbeat Failure alert: when we restart or suddenly if any reboot happend for any windows server we get Health Service Heartbeat Failure incident immediately through orchestrator and HPOM. when we see the status of heartbeat of the particular server in SCOM within 30 minutes it comes to healthy state and based on this we close the incident. Therefore i am looking how to retain such alert within SCOM for 30 minuts and alert should auto close if server health becomes green during 30 minuts. I want that alert as incident if it is not auto resolve within 30 minutes.

Please guide me how to achieve.
0
 
tscharyAuthor Commented:
Yes RIch. your assumption is correct. Is it possible to configure alert aging in SCOM for specific alert ? so that we can keep Alert aging for only 2-3 alerts and not for all type of alerts. Please clarify.
0
 
tscharyAuthor Commented:
Hi Rich, Is it possible to configure alert aging in SCOM for a specific alert ? so that we can keep Alert aging for only 2-3 alerts and not for all type of alerts. Please clarify and suggest how can it possible? Thanks
0
 
Rich WeisslerProfessional Troublemaker^h^h^h^h^hshooterCommented:
I'm not aware of a way to differentiate alerts with the ageing mechanism.  :-(

(And unfortunately I haven't played in Orchestrator, so I don't understand the hooks... But it makes sense that it wouldn't rely on notifications.  Unless there is something specific in those hooks, I keep coming back to maintenance mode as the way to temporarily prevent the alert from firing... but when maintenance mode ends, it'll still fire on status effects still effecting the server.   (I'm cagey on that, because I'm not certain it'll fire on event rules, for example.))
I think the maintenance mode, most likely on the server object (and allow to inherit down) is the BEST bet.
1
 
tscharyAuthor Commented:
Thanks Rich for response. we will keep server in maintenance mode during planned changes or patching time to stop alerts. but how can we keep Alert aging for only 2-3 alerts which are auto resolved in 30 minutes.

Is Orchestrator2012 will solve this kind of issues? Plaese let me know I will explore on that area. Kindly provide some useful links to refer. Thanks.
0
 
Rich WeisslerProfessional Troublemaker^h^h^h^h^hshooterCommented:
Maybe I misunderstand.  Do you want to use Alert Aging to resolve the alert?  THAT mechanism isn't that granular.  Are you trying to get those 2-3 alerts to auto-resolve?  (If that's the case, you need to look at each of the alerts and see if they have a mechanism to automatically resolve.)

Unfortunately I can't talk to what Orchestrator can or can not do.  (Powershell, on the other hand, does have a Resolve-SCOMAlert cmdlet.)
1
 
tscharyAuthor Commented:
Thanks Rich. Yes i want Alert Aging or any other similar option to resolve the alert because those are resolving in 15 minutes automatically without doing any action. So i want to close that alerts by SCOM prior generating to ticketing system. we are getting those alerts as incidents from ticketing tool.

 Please help me how can we achieve in SCOM
0
 
Rich WeisslerProfessional Troublemaker^h^h^h^h^hshooterCommented:
I don't know the specific monitor or rules which are firing... but I suspect those monitors or rules have their own resolution logic built in, and it's that logic which is resolving the alerts in fifteen minutes.  (And it sounds like that part is working.)  

You indicate you want SCOM to close the alerts prior to the ticketing system getting the alert.  How much time is that?

Again, I suspect if you put the objects (I assume the servers) in maintenance mode during the patching, the alerts will resolve without being sent to your ticketing system.
1
 
tscharyAuthor Commented:
Yes. I am looking 15 to 30 minutes delay to generate a alert since those are auto resolving during in that time. I will try that logic. I am aware of maintenance mode which stop the. alerts. thanks.
0
 
Rich WeisslerProfessional Troublemaker^h^h^h^h^hshooterCommented:
One other possibility: look at the specific rule/monitor which is generating the alert.  Try setting an override to see if the rule/monitor author left you the option of setting how long the condition has to be maintained before generating an alert.  (That will be rule/monitor specific though.)
1
 
tscharyAuthor Commented:
let me close.
0
 
tscharyAuthor Commented:
I have verified in SCOM and delayed the monitor to get it auto resolve under subscription folder.
0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.