We recently installed RU3 & it's all fine, but it looks to have changed the behaviour of auto closing alerts. We have various alerts added (eg, like server has rebooted, group membership changes, SQL job didn't run) that after around 15 days we get a batch of betwen 10-20 closed alerts at 4:00am each morning. How do I stop these? I've looked at the Administration/Settings/Alerts which has resolve all active alerts for new as 125 days, and resolve all active alerts when healthy after 45 days. (which doesn't seem right) essentially if an alert is left open for say 7 days, auto close but DO NOT send a closed alert off. (some of these are monitors & some are rules). It was ok before but CU3 seems to have changed things. Any ideas?

This sounds like normal grooming. Is it possible that grooming wasn't working for you prior to CU3?Microsoft Corporation

Is there some reason why you changed your alert auto resolution settings so high? More commonly, these are adjusted down to maintain peak performance in the operational database. But this isn't your problem. The problem seems to be with your notification settings sending closed alert notifications. If you don't want notifications about closed alerts, then open your subscriptions and take closed (255) alerts out of the criteria.HTH, Jonathan Almquist - MSFT

I think those values were changed by mistake ... I'll move them back to the normal values .. We have alerts that do this like notify when groups are changed in AD or when events are logged on servers, but for those we don't want a closed event. I suppose what we need is any alert that has been open for 7 days, close the alert with no notifcation. (this may then trigger it to reopen if the condition is still met, which is fine). For other alerts, like when a service is stopped that we do want an open/closed alert. Thx.

Looking at the alerts we get, they all get sent around 4am & all have 'Last modified by: Auto-resolve' .. so I'm looking for a way to exclude them from alert if anyone know's how?

Go into the subscription criteria and check the 'last modified by a specific user' check box. For the string I used "!(Auto-resolve)". I have tested injecting an alert on a server that I received before adding this criteria and after adding this string I still received the alert. So far it appears that this is working. I will wait for the 4am barrage of alerts that I receive as well and let you know if the string is correct or not for the last modified by. Thanks

Had the !(Auto-resolve) string in place and didnt receive some alerts so looks like this is not working. What ever was fixed in CU3 should be made broke again so these alerts at night stop. :)