none
Configuring alerts for Compliance Settings RRS feed

  • Question

  • I want to configure SCCM Compliance settings to be able to send out email alert in 5-10 mins when an configuration item's state changed to "Non-Compliant". I have made the following configuration;

    1. Client Policy's polling interval change to 5 mins

    2. Compliance Setting's "Schedule compliance evaluation" change to 5 mins

    3. State message reporting cycle change to 5 mins

    4. Configure Email Notification and Create Email Subscription for the alert

    Following behavior are observed in SCCM

    1. The "Compliance history of a configuration item" report is showing the configuration item change state between 5-10 mins (not fixed interval)

    2. The email notification alerts are seen at the inbox between 30-90 mins.(not fixed interval either)

    The SCCM is still unable to send email alert in 5-10 mins and the alert interval is inconsistent. Is there any other configuration that I miss out in order to enable SCCM to send out Non-compliant email alert in 5-10 mins?

    Saturday, June 15, 2019 3:13 AM

Answers

All replies

  • CI will not return result less then 15 minutes, soooo anything less than that is useless. 

    Garth Jones

    Blog: https://www.enhansoft.com/blog Old Blog: https://sccmug.ca/

    Twitter: @GarthMJ Book: System Center Configuration Manager Reporting Unleashed

    Saturday, June 15, 2019 3:17 AM
    Moderator
  • I think you might be trying to make configuration items and baselines be something they are not. It’s not meant to be an alerting system, like Operations Manager. If you need alerting like that, you should get scom .

    Standardize. Simplify. Automate.


    Sunday, June 16, 2019 1:15 PM
  • I noticed perceptions from many experts that the Compliant Settings alerts in 5-10 mins are not possible. and result from what I've configured on SCCM also showed that email alert for non-compliant reached the inbox time is inconsistent between 30-90 mins even with Client Setting's "Scheduled Compliance Evaluation" is set to 5 mins

    Is there a way we can quantify the above statement? I try to check the "DCMReporting.log" on the client side when the "Schedule compliance evaluation" is set to 5 mins, the log show that the evaluation did not took place every 5 mins. that bring me to another question that how does the sccm respond when the compliance evaluation is set to 5 mins? What is the dependencies that causes the "Compliance Evaluation" does not run every 5 mins. Is there any deep dive information on how SCCM message flow for us to understand better on the compliant setting behavior and quantify the how the alert work?

        
    Tuesday, June 18, 2019 5:47 AM
  • to rephase what i said above anything less than 15 minutes is ignored. im sure that this is listed within the docs and you can see this one the client side logs too. again sccm is not a replacement for scom.

    Garth Jones

    Blog: https://www.enhansoft.com/blog Old Blog: https://sccmug.ca/

    Twitter: @GarthMJ Book: System Center Configuration Manager Reporting Unleashed

    • Marked as answer by river101 Tuesday, July 2, 2019 5:48 AM
    Tuesday, June 18, 2019 10:14 AM
    Moderator
  • Thanks for the clarification.

    I found the docs from Microsoft. following are the link;

    https://docs.microsoft.com/en-us/previous-versions/system-center/configuration-manager-2007/bb680847(v=technet.10) stated that "The client's compliance evaluation results are cached locally, for 15 minutes. Unless the client has received notification from its configuration baseline assignment that configuration data has been modified since its last evaluation, the client will not re-evaluate its compliance within this 15 minute window, even if you specify a shorter evaluation compliance schedule or click Evaluate in the Configurations tab."

    But I noticed the alert is received after 30mins (fastest) to 60 minutes. Is there any other dependencies on DCM or other SCCM components on top of the 15 mins constraint?

    Tuesday, June 25, 2019 5:25 AM
  • there isn't much you can do to make it faster, you can use scom instead for faster processing.

    Garth Jones

    Blog: https://www.enhansoft.com/blog Old Blog: https://sccmug.ca/

    Twitter: @GarthMJ Book: System Center Configuration Manager Reporting Unleashed

    Tuesday, June 25, 2019 11:13 AM
    Moderator