Creating an override from alert - but alerts has already closed
Disk transfer (reads and writes) latency is too high We seem to get a lot of those. I found this article that talks about setting the frequency to a higher value: http://www.systemcentercentral.com/Default.aspx?tabid=143&indexid=62540 But, the state of these alerts have changed to closed before I get to them. Normally I would right-click on the alert in the console to create the override. But I can't do that if it has already closed. How do I find where to create the override if the alert has already closed?
August 27th, 2011 9:55am

Hi Create an alert view for closed alerts (resolution state = 255). Cheers GrahamNew SCOM 2012 Blog! - http://www.systemcentersolutions.com/blog/ View OpsMgr tips and tricks at http://systemcentersolutions.wordpress.com/
Free Windows Admin Tool Kit Click here and download it now
August 27th, 2011 10:04am

well you can either wait for it to popup in your list again, or you can go for a "closed alerts" view. And pick it up from a closed alert. If you go to the My Workspace pane in the scom console (on the left-bottom side). create a new alert view. call it closed alerts. than scroll down to where the conditions are. find where it says: With specific resolution state below it you see it appearing with a blue linked word Specific. click that one. Click the checkbox next to Closed (255). you need to click twice to get it to select... click ok ok ok. Find your alert by name for instance. good luck! Bob Cornelissen - BICTT (My BICTT Blog) - Microsoft Community Contributor 2011 Recipient
August 27th, 2011 10:05am

ha ha ha, you see Graham and I are thinking the same at the same time :-)Bob Cornelissen - BICTT (My BICTT Blog) - Microsoft Community Contributor 2011 Recipient
Free Windows Admin Tool Kit Click here and download it now
August 27th, 2011 10:06am

Yep - just had the same thing with Marnix on another post! Almost the weekend here so not too many more posts today ;-)New SCOM 2012 Blog! - http://www.systemcentersolutions.com/blog/ View OpsMgr tips and tricks at http://systemcentersolutions.wordpress.com/
August 27th, 2011 10:10am

well you can either wait for it to popup in your list again, or you can go for a "closed alerts" view. And pick it up from a closed alert. If you go to the My Workspace pane in the scom console (on the left-bottom side). create a new alert view. call it closed alerts. than scroll down to where the conditions are. find where it says: With specific resolution state below it you see it appearing with a blue linked word Specific. click that one. Click the checkbox next to Closed (255). you need to click twice to get it to select... click ok ok ok. Find your alert by name for instance. Ok, I did that. And as my luck with SCOM would have it, I get nothing. There are no closed alerts after I create that view. I followed your instructions exactly.
Free Windows Admin Tool Kit Click here and download it now
August 27th, 2011 10:30am

Hi This shows you how to create an alert view: http://technet.microsoft.com/en-us/library/dd996594.aspx For the criteria, choose resolution state = 255 (closed). Cheers GrahamNew SCOM 2012 Blog! - http://www.systemcentersolutions.com/blog/ View OpsMgr tips and tricks at http://systemcentersolutions.wordpress.com/
August 27th, 2011 10:34am

Here's a screenshot of my custom alert view Properties:
Free Windows Admin Tool Kit Click here and download it now
August 27th, 2011 10:45am

That is exactly what i had in mind. And you see nothing in that view? Wait in scom console in this alert view. Look at the top menu bar. Is it filtered by time (show last hour in stead of show all). Or do you see the button called Scope active? Those two limit what you see.Bob Cornelissen - BICTT (My BICTT Blog) - Microsoft Community Contributor 2011 Recipient
August 27th, 2011 11:35am

I just changed the scope to "all windows computers". And then alerts showed up. Interestingly, the "show" button was set to all - and if I changed it, it made no difference. But then if I went back to the scope and changed it to "agent managed computer group", which in our case are the same computers... the view then changed to reflect whatever "show" is set to. Anyway, it's working correctly now. Thank you.
Free Windows Admin Tool Kit Click here and download it now
August 27th, 2011 1:26pm

Yeah, by clicking the scope button again you can also un-scope it. and in the time period I always go for show all first so I know that I am looking at everything. Filter only when needed, but that is a personal preference. I usually create specific views if needed. The closed alerts view is always a nice one to have, perhaps that one limited to last hour or last day if there are lots of closed alerts. If you see high volumes of alerts opening and closing within seconds you know there is something you can go after to take care of on the clients side or on monitoring side. Anyway, glad we found it now, good way to get into the weekend :-) Good luck!Bob Cornelissen - BICTT (My BICTT Blog) - Microsoft Community Contributor 2011 Recipient
August 27th, 2011 1:44pm

This topic is archived. No further replies will be accepted.

Other recent topics Other recent topics