Life of an Alert?
Is there a flow of like Life cycle of an event how it gets generated , How it shows in console , is it in DB or DW who receives it (MS or RMS), which servic is responsible for it what happens if we dont resolve it how does it cause an email to be generated and send to the subscribers.
January 26th, 2011 9:28pm

you mean event or alert? :) i suppose you mean alerts and it depends a lot. There are 2 major versions of alerts: 1. alerts generated by rules. These are pretty straight forward. An event happens, which triggers the alert. The alert stays in scom until someone closes it. if the event happens again, another alert will be triggered ( When duplicate alerts have been setup, it might just result in a repeat count). 2. alerts generated by monitors. monitors have a healthy state and an unhealthy state (sometimes a warning and critical state). Monitors can auto resolve alerts when the monitor returns to a healthy state. In general you should never close a monitor alert, but there are exceptions e.g.: a. monitors that don't have the "auto resolve alert checkbox" checked b. manual reset monitors (don't close the alert, but manual reset the monitor, when this doesn't reset the alert maybe a. applies as well :))" The biggest problem is a normal operator can't know the difference as he can't see the config of a monitor.Rob Korving http://jama00.wordpress.com/
Free Windows Admin Tool Kit Click here and download it now
January 26th, 2011 9:46pm

Dear Rob, Thank you for explaining this, as i worked a bit more on SCOM i understood what you explained. As you explained the difference between alerts generated by a rule or a monitor: Since fortunately i am a SCOM Admin not just an operator so i have all the views to my disposal, , but again my ignorance gave rise to some doubts , here they are: >How would i know an alert was generated by a rule or a monitor. >When an alert is generated will i see any entry in the event log of the Agent telling me that it has sent an alert to the MS (If at all agent generates the alert , i am not even certain which service generates the aleart Guess Health Service) >If agent generated the alert based on a monitor or Rule what happens : How does that alert travel like from Agent to MS , as i have RMS and MS. So my doubt is i cant see the alert in the console until it reached RMS as RMS will be the one which is the source for what we see in consoel. Can i track the laert from Agent to MS to RMS. >Now that the alert reaches the RMS , i suppose it writes it to the DB first and then we are able to see the alert in the console (is this interaction logged somewhere) I guess i am asking a lot of questions , but i struggle as i dont know the basics , it is important that i know Monitoring as i am in Love with it.
February 8th, 2011 1:41am

I found 1 answer while learning in the console: >How would i know an alert was generated by a rule or a monitor. When we click on the alert , it shows more details about the alert in the Allert Details pane There we can see if the Alert is generated by : An Alert Rule or Alert Monitor Q: how would i know the time when a sate of the monitor will be rechecked / recalcuated , is there any default time or something. Thanks
Free Windows Admin Tool Kit Click here and download it now
February 8th, 2011 2:13am

it depends on the config of the monitor. Some monitors will do a check every x minutes, some wait for a manual reset while other wait for a "healthy" event to occur. As scom admin(author) you can just look at the monitor and see how it's configured. As operator you'd have to guess (imho this should be availabe as read only to operators).Rob Korving http://jama00.wordpress.com/
February 18th, 2011 10:11pm

This topic is archived. No further replies will be accepted.

Other recent topics Other recent topics