I am running scom 2007 R2 rollup 4, and i have imported the latest Exchange 2010 mp. If i want a particular monitor or rule to raise a critical alert, with a high priority, do i need to do an override on the rule or monitor? from doing a spot check on some of the rules and monitors it looks like by default the alert severity are all set to "warning" and priority is set to "low" If i am not mistaken this was not the case with SCOM 2007? Is the default now in SCOM 2007 R2 to only raise alerts when the monitor or rule is configured with an alert severity of critical and alert priority of high? Bulls on Parade

Hi skipster, Alerts are raise if the "generate alert" option is selected, for sealed MP microsoft already set this option to generate alert when needed. this is done regardless of the priority or severity level. about the priority issue, every MP have several rules and monitors with different prioriity/severity, this is also true for exchange 2010. if you find a rule or monitor that generate alert with priority or severity that don't match your needs then tou will have to set an override of the alert. Kobi

It is one of the particalur properties of the Exchange 2010 MP that the severity and priority are determined by the correlation engine service; it is not possible to influence the severity and priority of the alerts in the MP RolandRoland

Roland is correct, at least partly. You'll find that the Correlation Engine simply writes new events, and that those events have rules/monitors that raise the actual alerts. Directly messing with the monitors that define the interim states used by the correlation rules engine in Exchange 2010 is not something you should do. When you do see an alert in the alert view, you should be able to trace it back to the rule that raised it however - it typically will NOT be the monitors that track the health conditions.Microsoft Corporation

Thanks guys for all your advice and information. I am finding that the HTTP Synthentic logons in the Exchange 2010 MP are kicking my $%#$!. It appears that any HTTP monitor raises an alert. Example is below. When the rule or monitor runs this command on one of my 2010 sp1 CAS servers, it always raises and alert. When the agent on the 2010 CAS server runs the same command but uses TCP instead of HTTP, an alert is not raised. I know Autodiscover and all the Exchange web services are working correctly, the only thing i can think of that would be causing all the HTTP synthentic transactions to raise alerts, is we currently have outlook anywhere disabled in Exhcange 2010, and i'm thinking that the HTTP and RPC synthetic transactions are trying to test the availability and health of outlook anywhere? If i am correct, then how can i disable these monitors without making the correlation engine pissed off at me? Test-OutlookConnectivity -RpcProxyTestType:Internal -RpcTestType:Server -TrustAnySSLCert:$true -MonitoringContext:$true Alert: HTTP Connectivity with Autodiscover - Unexpected Exception Source: Outlook Connectivity - DC02CHTP002 (Client Access) - Phoenix Path: DC02CHTP002.RSACFamily.com;DC02CHTP002 (Client Access) - Phoenix Last modified by: System Last modified time: 6/28/2011 8:29:16 AM Alert description: An exception occurred while the cmdlet was running. This often indicates the test environment isn't prepared correctly. The administrator needs to examine the configuration. Exception details: Microsoft.Exchange.Monitoring.FatalAutodiscoverException: Fatal Autodiscover failure EXPR = <Null>. at Microsoft.Exchange.Monitoring.AutodiscoverTask.AutodiscoverEnd(IAsyncResult asyncResult) at System.Net.LazyAsyncResult.Complete(IntPtr userToken) at System.Net.ContextAwareResult.CaptureOrComplete(ExecutionContext& cachedContext, Boolean returnContext) at System.Net.ContextAwareResult.FinishPostingAsyncOp() at System.Net.HttpWebRequest.BeginGetResponse(AsyncCallback callback, Object state) at Microsoft.Exchange.Management.SystemConfigurationTasks.AutoDiscoverClient.<>c__DisplayClass6.<>c__DisplayClass8.<BeginInvoke>b__5(ICredentials credentials) at Microsoft.Exchange.Management.SystemConfigurationTasks.CredentialsImpersonator.Impersonate(ImpersonateDelegate impersonateDelegate) at Microsoft.Exchange.Management.SystemConfigurationTasks.AutoDiscoverClient.<>c__DisplayClass6.<BeginInvoke>b__4() at Microsoft.Exchange.Management.SystemConfigurationTasks.AutoDiscoverClient.ExecuteAndReportErrors[T](Func`1 func) at Microsoft.Exchange.Management.SystemConfigurationTasks.TestOutlookWebServices.InternalDiscover(String componentId, List`1 endpoints, String emailAddress, AsyncCallback asyncCallback, String[] optionalHeaders) at Microsoft.Exchange.Monitoring.AutodiscoverTask.AutodiscoverBegin(AsyncResult`1 result) at Microsoft.Exchange.Monitoring.AutodiscoverTask.<BuildTransactions>d__2.MoveNext() at Microsoft.Exchange.Monitoring.OutlookConnectivityBase.<BuildTransactionHelper>d__0.MoveNext() at Microsoft.Exchange.Monitoring.TestOutlookConnectivityTask.RunTasksWithTimeout(ExDateTime expireTime, IEnumerable`1 task) at Microsoft.Exchange.Monitoring.TestOutlookConnectivityTask.InternalProcessRecord() Diagnostic command: "Test-OutlookConnectivity -Protocol:Http -TrustAnySSLCert:$true -MonitoringContext:$true" TimeWindowStart: 2011-06-28T08:21:21.3106006-07:00 TimeWindowEnd: 2011-06-28T08:34:41.3106005-07:00 TimeFirst: 2011-06-28T08:21:21.3106006-07:00 TimeLast: 2011-06-28T08:26:12.9330397-07:00 Count: 2 EventSourceName: MSExchange Monitoring OutlookConnectivity End To End Bulls on Parade

Hi, For more information about alert correlation in the Exchange Server 2010 Management Pack, please also see: Understanding Alert Correlation http://technet.microsoft.com/en-us/library/ee758053(EXCHG.140).aspx Please try override if you don’t want to monitor some components: Best practices to use when you configure overrides in System Center Operations Manager 2007 http://support.microsoft.com/kb/943239 Regarding the settings and configurations of the Exchange Server 2010 Management Pack, please refer to the management pack guide: Exchange Server 2010 Monitoring Management Pack http://www.microsoft.com/download/en/details.aspx?displaylang=en&id=692 Thanks. Nicholas Li - MSFT Please remember to click Mark as Answer on the post that helps you, and to click Unmark as Answer if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.

Does the alert context give you some more information on the actual rule performing the tests?Regards, Marc Klaver http://jama00.wordpress.com/