Hello everybody, i have some problems regarding a "best practice" design for application specific monitoring and alerting. In our company we have the infrastructure guys (only interested in hardware and OS) and the application guys. Each application operator is responsible for one or more applications and he is interested only in his application errors. Let me explain you what we want to achieve: We have about 100 different applications, which are monitored separetly. Let us assume an application A (App A). It consists of some SQL DBs, some Websites, some services, all distributed accross multiple servers. The operator only wants alerts from the DBs, the websites and the specified services of App A. No Alerts from OS related sources, like disks etc. Because the operator is responsible for multiple applications, he wants to distinguish the alerts from the different applications. So he wants SCOM alerts with some kind of a Prefix like "App A" in the title for all relevant alerts, coming from App A... My problem is, that no solution which we found so far, is acceptable: We could group the servers by application and create the corresponding notification subscriptions for this group, but: - one server can host multiple applications (e.g. SQL DB Cluster) - the Subscriber gets every alert from the group (HW, OS AND Application) - because we can not override Alert header/titles, there is no way to associate a particular alert to an application We could put all necessary components into a distributed app, but: - there is still the problem, that we can not change the alert title and therefore associate the alert to the application Finally, we could create complete new custom MPs for things allready monitored by standard MPs, but this would be very ressource intense and involved with high costs. I think, this should be a common monitoring problem. How did you guys solved this problem? Any hints and suggestions are highly apprectiated. Best regards, Frank

Hi You could look to build a Savision Live Map for each application - using the Live Maps, you can have a dashboard of App Names and health states and then be able to drill down through the AppName to the underlying components. They tend to be a bit more flexible than Distributed Applications. Savision does automatically create a group for all objects in the map - so an application per map creates a group of the components that comprise the application that can be targetted for notifications. And you could create a custom notification format for each app to prefix the app name ... it won't work for alerts though as they are "hard coded" via sealing. You can get a free 5 map version of LiveMaps to test in your dev environment. Cheers Graham View OpsMgr tips and tricks at http://systemcentersolutions.wordpress.com/

Why not just make a management pack for each application? Each would then have its own views. And no, you shouldn't make copies of things already being monitored by the catalog MPs. For those, you will need to scope users by machine groups if you want to partition by individual host name. Microsoft Corporation

Hi Graham, thanks for the hint. We played with LiveMaps, but as you said, it will not solve the alert description problem... But maybe it is the best compromise so far, if we do not find another solutions. Thanks, Frank

Hi Dan, our problem is: 95% of what we want to monitor is allready covered by standard MS or 3rd party MPs. Grouping hosts together is as well ok, but it does not allow us to create application specific alarming. In my point of view we are stuck in a catch-22 situation: if we use standard MPs and group hosts by application it is easy and quick, but we neither have a real application specific alerting nor a good SLA monitoring for the specific application. If we want application specific alerting and a suitable health monitoring to get perfect SLA results, we have to completely write our own MPs and loose one of the main benefits of SCOM. Do i get this right? Thanks, Frank

Hi Frank Sadly you'll need to compromise somewhere. If you want to change the Alert names then you'll compromise on time \ effort \ budget of recreating all the relevant rules \ monitors from sealed management packs. I (personally) don't feel this is a viable option. If your teams can accept that compromise, then you can always create views scoped by the Savision Live Map group so that the alerts in the console can be segregated. There is also the option of leveraging Visio \ SharePoint 2010 instead of Live Maps - http://technet.microsoft.com/en-us/library/ee342533.aspx - depends where your skill sets lie and budgets. By the time you pay for SQL \ SharePoint licenses, it probably isn't any cheaper than LiveMaps. But if you have the skills and an existing SharePoint installation then it might be worth investigating. Cheers GrahamView OpsMgr tips and tricks at http://systemcentersolutions.wordpress.com/

I don't see it this way. You seem to be saying A or B. That is called the suckers choice, btw. If you know you want more monitoring by specific applicaiton, build the MP that only does this addative piece at the application level. This way you get monitoring that is application specific. The team that can see is a different topic - if you are saying you have a team of people that are supposed to see everything from a given group of servers, scoping is how you do this - so when you do build your custom monitoring that is not a full slice that repeats the catalog management pack monitoring, you should scope those as well.Microsoft Corporation