Hello, In our environment we are experiencing a storm of CPU alerts. All alerts generated by the Windows Server MP are configured to automatically generate an incident with our service desk. The CPU monitor goes in and out of a healthy state and generates hundreds of alerts over a period of time (weekend) for one problem server. Is there any way to suppress alerts for the CPU monitor? (We don't want to change the thresholds it is already set to 99% for five minutes) . Any input would be greatly appreciated! Shannon

Hi It depends what you mean by "suppress". You can certainly disable the monitor. Or another alternative if you want to see what has happened but not generate tickets is to override the monitor to generate informational alerts and not forward the informational alerts. These monitors that flip \ flop do hit performance of SCOM so it is worth resolving the issue. http://blogs.technet.com/b/kevinholman/archive/2009/12/21/tuning-tip-do-you-have-monitors-constantly-flip-flopping.aspx With regard to changing settings on the monitor - you can only change settings that the author has exposed as overrides. So if the author has not exposed this as an override then all you could do is disable the monitor and recreate a new one with the functionality that you desire. You could increase the number of consecutive samples above threshold? http://blogs.technet.com/b/momteam/archive/2012/06/18/updated-windows-server-operating-system-management-pack.aspx "Updated the Total CPU Utilization Percentage monitor to run every 5 minutes and alert if it is three consecutive samples above the threshold." Or if these are virtual machines then consider disabling cpu and memory monitoring at the OS level (as it isn't accurate) and monitor instead via the Hypervisor e.g. use the Veeam Management Pack if you use VMware or Virtual Machine Manager if you use Hyper V. Cheers GrahamRegards Graham New System Center 2012 Blog! - http://www.systemcentersolutions.co.uk View OpsMgr tips and tricks at http://systemcentersolutions.wordpress.com/

Hi It depends what you mean by "suppress". You can certainly disable the monitor. Or another alternative if you want to see what has happened but not generate tickets is to override the monitor to generate informational alerts and not forward the informational alerts. These monitors that flip \ flop do hit performance of SCOM so it is worth resolving the issue. http://blogs.technet.com/b/kevinholman/archive/2009/12/21/tuning-tip-do-you-have-monitors-constantly-flip-flopping.aspx With regard to changing settings on the monitor - you can only change settings that the author has exposed as overrides. So if the author has not exposed this as an override then all you could do is disable the monitor and recreate a new one with the functionality that you desire. You could increase the number of consecutive samples above threshold? http://blogs.technet.com/b/momteam/archive/2012/06/18/updated-windows-server-operating-system-management-pack.aspx "Updated the Total CPU Utilization Percentage monitor to run every 5 minutes and alert if it is three consecutive samples above the threshold." Or if these are virtual machines then consider disabling cpu and memory monitoring at the OS level (as it isn't accurate) and monitor instead via the Hypervisor e.g. use the Veeam Management Pack if you use VMware or Virtual Machine Manager if you use Hyper V. Cheers GrahamRegards Graham New System Center 2012 Blog! - http://www.systemcentersolutions.co.uk View OpsMgr tips and tricks at http://systemcentersolutions.wordpress.com/

What version of the MP are you using? For this thing to trigger it would tell me there is some SERIOUS CPU starvation, as this monitor requires the CPU to *average* 95% over a default of 5 (or 3) consecutive samples, AND the CPU queue length has to be above 15, which is very deep. If this is causing a lot of alerts you should remedy the root cause. Alternatively - to lower the frequency of state changes (and thereby alerts) you should increase the CPU threshold AND queue threshold, to a level where you would actually take action. If you wont take action at any level, you should uninstall the SCOM agent. :-) Kevin Holman http://blogs.technet.com/b/kevinholman