none
SCOM 2016 - Close all alerts from rules RRS feed

  • Question

  • hi 

    SCOM 2016 

    I'm looking for a script that I can run in a schedule task to closed alert (older than 24 hours) coming from "alert Rule"  

    Thanks in Advance 


    Help.Me

    Monday, February 19, 2018 3:22 PM

Answers

  • Hey,

    there are lots of ready to use scripts on the Internet. I would suggest you take a look here in the future, in case you need  scripts:

    TechNet Gallery - resources for IT professionals

    Here the particular contributions regarding closing alerts from rules:

    SCOM 2012 script to close old alerts coming from Rules

    This aplies also to SCOM 2016 as the cmdlets are the same. 

    P.S. Please read also the author's blog post on the topic. You might find it intereresting. 

    Cheers,


    Stoyan (Please take a moment to "Vote as Helpful" and/or "Mark as Answer" where applicable. This helps the community, keeps the forums tidy, and recognizes useful contributions. Thanks!) Blog: https://blog.pohn.ch/ Twitter: @StoyanChalakov





    Monday, February 19, 2018 4:08 PM
    Moderator
  • Hello,

    You can use below PS script, or simply follow link provided by Stoyan:

    Import-Module OperationsManager
    $AgeHours = 48
    Get-SCOMAlert |where {$_.ResolutionState -eq '0' -and $_.IsMonitorAlert -eq 'False' -and $_.timeraised -le (Get-Date).addhours(-$AgeHours)} | Resolve-SCOMAlert -Comment 'Closure of rule generated alerts' -PassThru | Set-SCOMAlert -ResolutionState 255

    Note: This will close alerts older than 48 hours and are generated by rule. You can increase timeframe as per your requirement.

    (Please "Mark as Answer/Vote as Helpful" if applicable)

    Tuesday, February 20, 2018 5:55 AM

All replies

  • Hey,

    there are lots of ready to use scripts on the Internet. I would suggest you take a look here in the future, in case you need  scripts:

    TechNet Gallery - resources for IT professionals

    Here the particular contributions regarding closing alerts from rules:

    SCOM 2012 script to close old alerts coming from Rules

    This aplies also to SCOM 2016 as the cmdlets are the same. 

    P.S. Please read also the author's blog post on the topic. You might find it intereresting. 

    Cheers,


    Stoyan (Please take a moment to "Vote as Helpful" and/or "Mark as Answer" where applicable. This helps the community, keeps the forums tidy, and recognizes useful contributions. Thanks!) Blog: https://blog.pohn.ch/ Twitter: @StoyanChalakov





    Monday, February 19, 2018 4:08 PM
    Moderator
  • Hello,

    You can use below PS script, or simply follow link provided by Stoyan:

    Import-Module OperationsManager
    $AgeHours = 48
    Get-SCOMAlert |where {$_.ResolutionState -eq '0' -and $_.IsMonitorAlert -eq 'False' -and $_.timeraised -le (Get-Date).addhours(-$AgeHours)} | Resolve-SCOMAlert -Comment 'Closure of rule generated alerts' -PassThru | Set-SCOMAlert -ResolutionState 255

    Note: This will close alerts older than 48 hours and are generated by rule. You can increase timeframe as per your requirement.

    (Please "Mark as Answer/Vote as Helpful" if applicable)

    Tuesday, February 20, 2018 5:55 AM
  • What if, you get the following errors?  I am wanting to get rid of ALL alerts and start from Scratch.  Nobody has been monitoring this for a long time.

    Resolve-SCOMAlert : The alert with Id = "58d7eb19-e260-4745-a13e-790f552ffda6" and Name = "Configuration Has Expired Certificates Warning" cannot be closed 
    in SCOMas the monitor which generated this alert is still unhealthy.
    At line:3 char:143
    + ... geHours)} | Resolve-SCOMAlert -Comment 'Closure of rule generated ale ..

    David

    Monday, September 30, 2019 8:59 PM
  • That's because that alert comes from a monitor and not a rule, and because you're running SCOM 2019.

    Starting with that version, you can't close an alert that comes from a monitor if the monitor is still unhealthy, so what you need to do is to reset the monitor state instead of closing the alert.

    If the alert is set to "auto resolve", it will close in the meantime; otherwise you will have to close it after having reset the monitor

    Monday, September 30, 2019 9:56 PM