I have several alerts in the console that are almost a year old according to the created and last state change colums. There are large repeat counts also so these are all rules, not monitors. I understand these will not close automatically as monitors do because they are rules and don't have the "Automatically resolve.." setting per alert but I do have the global Automatic Alert Resolution setting "Resolve all active alerts in the new resolution state after" 30 days. They are also in the new resolution state. When the task runs every day at 4 AM we do see alot of alerts that close which is what I thought should be happening. Also, when I run a report for alerts on those objects which have old alerts still open there aren't any recently created ones. Why aren't these old alerts closing?

Hi Matt,

its really pretty strange. If you look at the alert properties, are there any modifications on them in the past 30 days? Are there new rule generated alerts, which are also not closed after 30 days?

Regards,

Stoyan

Hi,

Whether all rule generated alerts have this issue?

To work arround this issue, you may try below script tp close old alerts coming from rules:

SCOM 2012 script to close old alerts coming from Rules

https://gallery.technet.microsoft.com/SCOM-2012-script-to-close-c4511481

Regards,

Yan Li

Hi,

In my opinion closing the alerts themselves is not the problem, they can be closed of course either with the script Yan Li gave or also manually. The issue is more why the old alerts are not being closed even if "Resolve all active alerts in the new resolution state after" is configure to 30 days.

Or maybe, this is the problem ONLY with those few old alerts for some reason and if they are closed, there not going to be more of them.

Regards,

Stoyan

Please manually run the stored procedure p_AlertAutoResolveExecuteAll, it is sql procedure for execute SCOM  auto-resolution , and see whether it will close the alert and any error or not.
http://blogs.technet.com/b/kevinholman/archive/2007/12/13/how-grooming-and-auto-resolution-work-in-the-opsmgr-2007-operational-database.aspx
Roger

If I check the event log I do actually see recent events that would cause an alert in SCOM. So I'm guessing it is actually correct in that the repeat count keeps incrementing by 1 instead of creating a new alert. I can't report on the original alert because the DW database retention was recently modified so that info has been purged. Assuming it is working as designed, is there any way to find out when the latest increment was added to the repeat count other than looking at the raw data with a query. I do see the "last modified" column does seem to match up with the most recent event log so maybe that is the way to do it.