Alert rule or Monitor

Hello,

I saw several threads https://social.technet.microsoft.com/Forums/systemcenter/en-US/3a8e7469-ac2f-4b70-acaa-5a2a9dbac8ab/scom-alert-for-particular-event-id?forum=operationsmanagergeneral but why using Rule? Why using Monitor? What will be the parameter which make the choice between rule and monitor?

Event ID 4688 and 4689

Thanks,

DOm

August 21st, 2015 12:39am

Hi Dom,

Basically Event based alerting rule will flush lot of alerts in case if the specific event is logged 100 times then 100 alerts will appear in SCOM Console. In this case lots of alerts will be flooded if lot of events are generated and will need to be manually cleared.

In a Event monitor - You can specify criteria such as Event id 1 is critical, Once Event ID 2 appears in the same folder (Which is healthy and good) you can set the criteria saying after event id 1 if 2 appears resolve the alert. In this case alerts will be less and will auto close if the health event appears.

Hope the above

Free Windows Admin Tool Kit Click here and download it now
August 21st, 2015 1:10am

Hi

This is not true - "the specific event is logged 100 times then 100 alerts will appear in SCOM". You should look to use suppression to prevent this. In fact, there are times though when you would want this.

My guideline for whether to use a rule or monitor is:

1. Does the "issue" affect health. If yes, then try to use a monitor (though see item 3 below). If it does not affect health, then a rule. E.g. you might be using SCOM to monitor users being added to Domain Admins. Do you want your Domain Controllers going red if a user gets added to domain admins? Probably not. You just want the alert. Another example - if a single backup fails, do you want your backup application going unhealthy. Again, probably not. You want an alert to investigate the failure but it doesn't mean the system is down or unhealthy.

2. Do you need to know each time something happens. If so, a rule. E.g. If you want to know each time someone gets added to Domain Admins then a monitor will not do this. It will alert you on the first one and that is it until you reset health. In fact, I would not even use suppression on the rule here. You would (probably) want to know each and every time someone got added to Domain Admins.

 3. Is there a healthy as well as an unhealthy "event". Monitors need something that not only shows that something is  unhealthy but also that it is health again. You can use timed and reset monitors but neither are a great solution.

There is no single correct answer to this and everyone will have a slightly different response to each question. Experience and personal preference will decide which approach you take.

Regards

Graham

August 21st, 2015 3:48am

This topic is archived. No further replies will be accepted.

Other recent topics Other recent topics