Orchestrator 2012: Reset SCOM 2012 monitor for closed alert

Everyone who works with System Center Operations Manager 2012 knows the problem of closed alerts where the monitor has not been reset first. The monitor will stay in the unhealthy state and no new alerts will be created anymore until the monitor gets reset.

You can create a scheduled task with a script on a management server or use Orchestrator for it. I found this blog which describes how to use the “Monitor alert” activity and then run a script afterwards. http://blog.scomfaq.ch/2012/05/05/reset-monitor-using-scom-2012-and-orchestrator-a-must-have-runbook/
I like the “Monitor alert” activity but I would like to reduce the number of scripts which connect to the management group.

So I have created another runbook.


The first activity “Check every 5 min” triggers the runbook every 5 min. I think that is a good timeframe to check for closed alerts.

The next activity “Reset Monitor” runs on the Runbook server. It uses PowerShell and imports the SCOM 2012 module, so this must be installed on the Runbook Servers and the execution policy should be set to remotesigned.

Here are the details of the activity:


# Import Operations Manager Module and create Connection
Import-Module OperationsManager;
New-SCOMManagementGroupConnection %ManagementServerName%;
$alerts=get-scomalert -Criteria “Severity!=0 AND IsMonitorAlert=1 AND ResolutionState=255″| where {$_.LastModified -ge ((get-date).AddMinutes(-5)).ToUniversalTime()}
if ($alerts -is [object])
foreach ($alert in $alerts)
$monitoringobject = Get-SCOMClassinstance -id $alert.MonitoringObjectId
# Reset Monitor
If (($monitoringobject.HealthState -eq ‘Error’) -or ($monitoringobject.HealthState -eq ‘Warning’))

The script gets all closed alerts from monitors with severity ‘Warning’ or ‘Critical’ within the last 5 min and only resets the monitor if it is still in ‘Error’ or ‘Warning’ HealthState. You could use this script also for a scheduled task on a management server.

The published data is Alertname, State, Displayname, you could also publish other data, but that was what I needed for troubleshooting.

Post a comment or leave a trackback: Trackback URL.


  • david  On April 11, 2013 at 8:53 am

    Great. I like this script. do you have any script to reset all monitors (active alerts)

    Thank you

    • opsmgrtipps  On April 11, 2013 at 2:14 pm

      Hi David, you can use the same script as a base, only change the get-scomalert command to this:
      $alerts=get-scomalert -Criteria “Severity!=0 AND IsMonitorAlert=1 AND ResolutionState!=255”.
      Then you get all open alerts which are not informational and are from monitors.

      The rest is the same.


  • Vanessa (@mysehnsucht)  On July 9, 2013 at 12:18 pm

    Thank you! This script solved my problem!

  • Valentin Nedeianu  On November 15, 2013 at 10:02 am

    This is absolutelly the best way to do it. I also tested the script from blog.scomfaq.ch, but due to the way detection is done, you can receive multiple “Closed” alerts for the same monitor.
    Thank you!

  • Mads Laksø  On March 3, 2015 at 9:02 am

    Thanks for this Natascia, i got a The string is missing the terminator: “. error when i used your scripts directly, but got i solved.
    Great blog, I have linked to your blog from my own mcloudinfo.wordpress.com
    Have a great day.

  • blackwyng  On September 2, 2015 at 5:38 pm

    Reblogged this on System Center HQ and commented:
    Excellent tip for anyone (all of us?) who have ever fought with monitors not resetting and have to deal with scheduled task scripts to overcome. Thank you, @SystemCenterTipps!


Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s

%d bloggers like this: