locked
SCOM Alerts Creating Incidents in SCSM RRS feed

  • Question

  • I am starting to look into setting up SCOM alerts through the connector in SCSM. Our connector is already configured, just no subscription yet. What I am wondering about is for example, if a site goes down and starts generating alerts (I am told the alerts repeat until the issue is resolved.) Will each instance of the alert open another incident in SCSM? I don't really want to have a thousand incidents created for one outage. Is there a way to set the threshold for creating incidents for the same outage?
    Tuesday, March 27, 2012 6:42 PM

Answers

  • Hey

    If the same SCOM Rule detects the same Event multiple times, "normally" only 1 Alert is created and the Repeat Count is updated. Means, SCSM will only create 1 Incident and update the Repeat Count as soon as the Alert is updated in SCOM. I say "normally" because it depends how the Rules are configured in SCOM, which is the MP Author's decision.

    But you are right: If a site goes down, this could generate a bunch of Incidents (depending on your Connector Configuration). But as SCOM-Alerts and SCSM-Incidents are continuously synchronized, those Incidents will be resolved automatically as soon as the SCOM Alert is gone.

    Regards
    Marcel


    SCSMfaq // Blog --> http://blog.scsmfaq.ch // Twitter --> #scsmfaq // Business --> http://www.itnetx.ch

    Wednesday, March 28, 2012 1:01 PM

All replies

  • The alert is resetting automatically? Or do you have to reset the alert manually? As long as a the alert still exist and isn't reset/closed the connector should only create one incident because the existing alert is still active and only updated.


    Andreas Baumgarten | H&D International Group

    Tuesday, March 27, 2012 8:31 PM
  • I am not sure - the network team tells me it will email continuously every few seconds until the issue is resolved. I was just afraid it would open an incident for each email. So if I understand it as you say - it should only open one for each alert condition? Until that is resolved?
    Wednesday, March 28, 2012 12:21 PM
  • Hey

    If the same SCOM Rule detects the same Event multiple times, "normally" only 1 Alert is created and the Repeat Count is updated. Means, SCSM will only create 1 Incident and update the Repeat Count as soon as the Alert is updated in SCOM. I say "normally" because it depends how the Rules are configured in SCOM, which is the MP Author's decision.

    But you are right: If a site goes down, this could generate a bunch of Incidents (depending on your Connector Configuration). But as SCOM-Alerts and SCSM-Incidents are continuously synchronized, those Incidents will be resolved automatically as soon as the SCOM Alert is gone.

    Regards
    Marcel


    SCSMfaq // Blog --> http://blog.scsmfaq.ch // Twitter --> #scsmfaq // Business --> http://www.itnetx.ch

    Wednesday, March 28, 2012 1:01 PM