Orchestrator 2012: Reset SCOM 2012 monitor for closed alert

Everyone who works with System Center Operations Manager 2012 knows the problem of closed alerts where the monitor has not been reset first. The monitor will stay in the unhealthy state and no new alerts will be created anymore until the monitor gets reset.

You can create a scheduled task with a script on a management server or use Orchestrator for it. I found this blog which describes how to use the “Monitor alert” activity and then run a script afterwards. http://blog.scomfaq.ch/2012/05/05/reset-monitor-using-scom-2012-and-orchestrator-a-must-have-runbook/
I like the “Monitor alert” activity but I would like to reduce the number of scripts which connect to the management group.

So I have created another runbook.

resetmonitor

The first activity “Check every 5 min” triggers the runbook every 5 min. I think that is a good timeframe to check for closed alerts.

The next activity “Reset Monitor” runs on the Runbook server. It uses PowerShell and imports the SCOM 2012 module, so this must be installed on the Runbook Servers and the execution policy should be set to remotesigned.

Here are the details of the activity:

dotnet

$Alertname=@();
$State=@();
$Displayname=@();
# Import Operations Manager Module and create Connection
Import-Module OperationsManager;
New-SCOMManagementGroupConnection %ManagementServerName%;
$alerts=get-scomalert -Criteria “Severity!=0 AND IsMonitorAlert=1 AND ResolutionState=255″| where {$_.LastModified -ge ((get-date).AddMinutes(-5)).ToUniversalTime()}
if ($alerts -is [object])
{
foreach ($alert in $alerts)
{
$monitoringobject = Get-SCOMClassinstance -id $alert.MonitoringObjectId
# Reset Monitor
If (($monitoringobject.HealthState -eq ‘Error’) -or ($monitoringobject.HealthState -eq ‘Warning’))
{
$monitoringobject.ResetMonitoringState()
$State+=$monitoringobject.HealthState
$Displayname+=$monitoringobject.displayname
$Alertname+=$alert.Name
}
}
}

The script gets all closed alerts from monitors with severity ‘Warning’ or ‘Critical’ within the last 5 min and only resets the monitor if it is still in ‘Error’ or ‘Warning’ HealthState. You could use this script also for a scheduled task on a management server.

The published data is Alertname, State, Displayname, you could also publish other data, but that was what I needed for troubleshooting.

Advertisements

Published by

SystemCentertipps

* 1974, female, working as a IT Senior System Analyst in a chemical company. Main topics: System Center Operations Manager 2012, System Center Orchestrator 2012, System Center Configuration Manager 2012. Monitoring servers since 2002, started with NetIQ Appmanager. Twitter: @NatasciaHeil

7 thoughts on “Orchestrator 2012: Reset SCOM 2012 monitor for closed alert”

    1. Hi David, you can use the same script as a base, only change the get-scomalert command to this:
      $alerts=get-scomalert -Criteria “Severity!=0 AND IsMonitorAlert=1 AND ResolutionState!=255”.
      Then you get all open alerts which are not informational and are from monitors.

      The rest is the same.

      Regards,
      Natascia

  1. This is absolutelly the best way to do it. I also tested the script from blog.scomfaq.ch, but due to the way detection is done, you can receive multiple “Closed” alerts for the same monitor.
    Thank you!

  2. Thanks for this Natascia, i got a The string is missing the terminator: “. error when i used your scripts directly, but got i solved.
    Great blog, I have linked to your blog from my own mcloudinfo.wordpress.com
    Have a great day.
    /Mads

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s