locked
SCOM overrides flaky? RRS feed

  • Question

  • Technet,

    Please help, overriding critical to warnings fails most of the time unless I disable the monitor all together which isn't always an option.

    Update: I noticed the alert will actually be yellow (warning) but the Monitoring pane shows Critical. It doesn't affect the reports SLA but it does cause alarm when displayed on the dashboards everyone monitors. how do we get  rid of this or just change the color it displays? There are many but the one in particular is from a SharePoint management pack so I think it's sealed.

    Any advice on how to troubleshoot this?







    • Edited by KLIFTIN Saturday, September 9, 2017 2:44 PM
    Saturday, September 9, 2017 11:21 AM

Answers

  • Hello,

    As the management pack is a sealed one, there may be management packs that depend on it. If you want to delete it and reimport it, please take this into consideration.

    You can use powershell command to export it:

    get-scommanagementpack | where {$_.displayName -eq "<MP Name>"} | export-scommanagementpack –path “<Path>"

    And then you may able to edit it, you may find the monitor according to it's name, and then check the definition of the health state.


    Please remember to mark the replies as answers if they help. If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com.

    • Marked as answer by KLIFTIN Saturday, September 30, 2017 10:44 AM
    Monday, September 25, 2017 2:29 AM

All replies

  • Hey,

    the monitor will always show red if it is in a "critical" state. 

    The overrides are affecting only the alerts - their priority and/or severity. 

    Hope that helps. Regards,


    Stoyan (Please take a moment to "Vote as Helpful" and/or "Mark as Answer" where applicable. This helps the community, keeps the forums tidy, and recognizes useful contributions. Thanks!) Blog: https://blog.pohn.ch/ Twitter: @StoyanChalakov

    Saturday, September 9, 2017 10:11 PM
  • Hey,

    the monitor will always show red if it is in a "critical" state. 

    The overrides are affecting only the alerts - their priority and/or severity. 

    Hope that helps. Regards,


    Stoyan (Please take a moment to "Vote as Helpful" and/or "Mark as Answer" where applicable. This helps the community, keeps the forums tidy, and recognizes useful contributions. Thanks!) Blog: https://blog.pohn.ch/ Twitter: @StoyanChalakov

    No sorry that doesn't help or maybe I'm just not understanding. I have overrode some alerts before and the server State from the monitoring pane will change from Critical to warning. But then some don't behave this way no matter how I override the monitor/object/class or whatever. Basically, the State will stay critical and not downgrade to warning which affects the SLA/Reports.

    Any way to solve this besides disabling the monitor which seems to work but we don't always want to do that if ever.



    • Edited by KLIFTIN Sunday, September 10, 2017 10:54 AM
    Sunday, September 10, 2017 8:38 AM
  • Hello,

    The health state of object and the alert severity is different from each other, the health state is defined first, and then the alert is triggered according to the definition. Please see the below pictures. Picture 1 configure health, picture 2 configure alert.

    As we can see, if we defined the health state as critical, and define the alert as warning, then when the alert is triggered, the alert is always a warning, but the health state is critical. 

    No matter what severity of alert is changed when your override the monitor, this does not affect the health state. 


    Regards,

    Yan Li


    Please remember to mark the replies as answers if they help. If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com.


    • Edited by Yan Li_ Monday, September 11, 2017 2:31 AM
    • Proposed as answer by Yan Li_ Tuesday, September 19, 2017 5:12 AM
    Monday, September 11, 2017 2:30 AM
  • Hello,

    The health state of object and the alert severity is different from each other, the health state is defined first, and then the alert is triggered according to the definition. Please see the below pictures. Picture 1 configure health, picture 2 configure alert.

    As we can see, if we defined the health state as critical, and define the alert as warning, then when the alert is triggered, the alert is always a warning, but the health state is critical. 

    No matter what severity of alert is changed when your override the monitor, this does not affect the health state. 


    Regards,

    Yan Li


    Please remember to mark the replies as answers if they help. If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com.


    Great work. My last question then is that most of the time, these parameters in the pic are grayed out and I cannot change them from there, hence the overrides. Am I suppose to convert the management pack to unsealed?

    I'm still at a loss on how to change the state health from critical to warning? I don't have the option to change them as you show in the picture. 








    • Edited by KLIFTIN Wednesday, September 13, 2017 7:27 AM
    Tuesday, September 12, 2017 8:50 AM
  • Hello,


    In my opinion, the better way is to disable those monitor, and recreate them by yourself according to your requirement.   

    Regards,

    Yan Li


    Please remember to mark the replies as answers if they help. If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com.


    • Edited by Yan Li_ Thursday, September 14, 2017 9:44 AM
    • Proposed as answer by ScottMoss Wednesday, September 20, 2017 4:48 PM
    Thursday, September 14, 2017 9:40 AM
  • Hello,


    In my opinion, the better way is to disable those monitor, and recreate them by yourself according to your requirement.   

    Regards,

    Yan Li


    Please remember to mark the replies as answers if they help. If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com.


    To do this would I export the current management pack and pick out the code? Any instructions on this? I'll search otherwise, I'll create my own monitor. Thanks again.

    Friday, September 22, 2017 4:19 PM
  • Hello,

    As the management pack is a sealed one, there may be management packs that depend on it. If you want to delete it and reimport it, please take this into consideration.

    You can use powershell command to export it:

    get-scommanagementpack | where {$_.displayName -eq "<MP Name>"} | export-scommanagementpack –path “<Path>"

    And then you may able to edit it, you may find the monitor according to it's name, and then check the definition of the health state.


    Please remember to mark the replies as answers if they help. If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com.

    • Marked as answer by KLIFTIN Saturday, September 30, 2017 10:44 AM
    Monday, September 25, 2017 2:29 AM
  • Right on, thanks for the code. 
    Saturday, September 30, 2017 10:51 AM