We have websites being monitored that require notification setup. What we are looking for is a way to notify a specific e-mail address when the website is down for more than 10 minutes, and a second notification when it is up/healthy (i.e. the alert has been closed). We are doing well with the down notification... it is the "up" that is giving us troubles as we aren't finding the right combination for our subscription setup. To sum it up, our results have been very inconsistent. In the criteria, we've narrowed it down to: raised by any instance of a test class and with Closed (255) resolution state and last modified by a %SYSTEM% user I've reviewed the XML for the "Notifications Internal Library" management pack and it appears to me that the subscription I create is basically a rule that runs on the RMS. The rule has a polling interval of 1 minute. My interpretation of how this is working (correct me if I am wrong) and why the results I'm seeing aren't consistent is due to a timing issue: -------------------------------------------------------------------- Scenario 1: 1:03:57 PM - My alert closes (i.e. last modified by System) 1:04:05 PM - The subscription criteria is reviewed... Alert is from my test class (yes) It is closed with resolution state of 255 (yes) Modified by %SYSTEM% (yes) <notification is sent> 1:04:24 PM - My connector to my OMW system updates the history of the alert since it communicated with the corresponding OMW message (history shows modified by OMA service account) 1:05:05 PM - Subscription reviewed again, not all criteria is met due to failing on the "last modified by" criteria. No notification. (good) Scenario 1 results: Notification is sent once... perfect! -------------------------------------------------------------------- Scenario 2: 1:03:42 PM - My alert closes (i.e. last modified by System) 1:03:54 PM - My connector to my OMW system updates the history of the alert since it communicated with the corresponding OMW message (history shows modified by OMA service account) 1:04:05 PM - The subscription criteria is reviewed... Alert is from my test class (yes) It is closed with resolution state of 255 (yes) Modified by %SYSTEM% (NO... my connector modified it last... OMA service account) <notification is NOT sent> Scenario 2 results: Notification is never sent -------------------------------------------------------------------- Thoughts/ideas on how we setup our subscription to get a single notification when the alert is closed? Thank you, Kate

Why don't you have your connector write a value to one of the custom fields on the alert when it makes the update and trigger notification on that? I believe that would eliminate the concern around who modified the alert last and triggering on that. And by writing an exact value to a custom field, you eliminate wildcard searches, which dont help performance.Pete Zerger, MVP-OpsMgr and SCE | http://www.systemcentercentral.com

Pete... Thank you for the response. Our connector is the Interop connector from Microsoft that interfaces with HP OMW. I was considering your suggestion and came up with a slight variation that has provided the solution we need. The down notification that I mentioned uses the logic that if after 11 minutes, the alert is still active/new, it will change the resolution state from New to "Processed by subscription", send out the notification, and update, via powershell script, Custom Field 1 with "Notification sent out". For the same alerts that have been sent out when the site is "down", we want to make sure an alert is sent when they are "up" (i.e. the alert closed by the system). To accomplish this, we have a new command channel that runs a powershell script to change the Custom Field 1 from "Notification sent out" to "Healthy notification sent out". The subscription for the "Up" scenario has been modified and looks for: raised by any instance of a test instance (or group would work too) and with Closed (255) resolution state and resolved by System user and with Notification sent out text in Custom Field1 Now, when the alert closes, it reviews the criteria, matches all, then runs the command channel which updates Custom Field 1 to indicate the healthy has been sent out, and any updates by our connector, post closure of the alert will not sent out a notification due to the new value in Custom Field 1. Hopefully this makes sense and will help out someone else searching for a means to send a single notification on closure. Kate