Hi All, Is there a way to in SCOM 2007 R2 to set a rule so that if it sees a particular alert to close other previous alerts? e.g If I got many alerts saying "Database 1 is down". Then is it possible to setup rule to check if event 1234 then close all alerts that have "Database 1" in the descript of the alert? Thanks ECL

Hi SCOM is a big scripting engine so it is almost always possible - indeed, Powershell could be leveraged to retrospectively close alerts and this could be fired by a subscription. An example is given here: http://blogs.msdn.com/b/steverac/archive/2010/08/17/updating-custom-alert-fields-using-subscriptions-and-powershell.aspx The bigger issue is whether it is wise to do so. You'd first need to check if it was a monitor so that it didn't close alerts generated by monitors. I'd also suggest that if you are getting many alerts when you only want one, that perhaps the underlying monitoring needs a tweak. Perhaps by using suppression on the rule or by looking at usng monitors and appropriate rollups (e.g. if this was a remote database check using the OLE DB template). Could you perhaps give a concrete example of what you want to do .. Cheers Graham View OpsMgr tips and tricks at http://systemcentersolutions.wordpress.com/

Hi Graham, There are a couple of examples and mainly around managing the clustered Red hat linux boxes. e.g. as only one of the linux boxes are active at any one time when it fails over the other node alerts that it has lost its Oracle database and Disks. So I was thinking of when that alert happens then to run a script to check that the database and disk are ok on the other node and then close the alerts. As for the OLE DB template you spoke of - will that work on Oracle or is that for SQL only? Thanks ECL

Hi ECL, For the OLE DB monitoring you can also refer to this post. See if it helps you http://www.maartendamen.com/2010/09/monitor-an-oracle-database-with-a-scom-oledb-watcher/. And yes, you could go for the solution to close alerts every time. Just be carefull you dont loose too many alerts this way. You might want to reset the health state as well, as a red monitor will fire once and while it stays in a red state not fire again when you have closed the alert and not did anything with the state. Just as example.Bob Cornelissen - BICTT (My BICTT Blog)

Thanks, I will have a go at the link, it sound promising :)