SCOM Alert Notification Triggers when Modified by User


  • Hi All,

    I have configured the SCOM alert notification to trigger when the Resolution State is "New" or "Closed". But I am getting three notifications:

    1) When the New alert is created, I got a notification with Resolution State New and Last Modified by System in alert description.

    2) I again get a notification with resolution state New and Last modified by SCOM account. This is something that we update every new alert with certain custom fields but the resolution state remains the same i.e. "New".

    3) Third notification is of resolution state Closed. 

    It is strange that I am getting the email notification for case 2 as well which it shouldn't since the resolution state remains the "New". Can anyone advise if it is by design or we can somehow limit this 2nd alert notification.


    Daya Ram

    Thursday, June 7, 2018 8:32 AM

All replies

  • Updating the resolution state to something like "under review" or whatever at the same time you update the alert fields would be a good practice, and would very likely solve your issue
    Thursday, June 7, 2018 9:03 AM
  • Hi CyrAz,

    I can do that but why it is sending notification for the 2nd case when the resolution state doesn't change. Is it by design or something wrong?

    Daya Ram

    Thursday, June 7, 2018 9:14 AM
  • How do you update the alert? I guess that depending on the method you use, SCOM may consider the alert as new
    Thursday, June 7, 2018 9:52 AM
  • I am simply using powershell script to update the custom field 3 of the alerts. 


    Daya Ram

    Thursday, June 7, 2018 11:16 AM
  • The subscription also triggers on update, so since your subscription filter still matches restate = new when you update the alert it will trigger a new mail.

    I'm doing some of the same with customfields and the simple solution is to use the resolutionstates to your advantage by simply updating customfields and resolutionstate on "new" alerts, and the running subscriptions after you did initial processing of alerts and have a new resolutionstate or specific content in a customfield.

    • Proposed as answer by s.kjaerhus Wednesday, June 13, 2018 1:42 PM
    Wednesday, June 13, 2018 1:42 PM