locked
Listing the "Count" for the Monitors & Alert Rules associated to each MP RRS feed

  • Question

  • Good morning,

     

    I'm trying to list each Management Pack in the Management Group along with the "Count" of the number of associated Monitors & Alert Rules (I basically want to see everything that might generate an alert).

     

    Though I have come up with the following, the "Number of alert rules" column remains empty:

     

    Get-ManagementPack | Select-Object DisplayName, @{Name="Number of monitors"; Expression={(Get-Monitor -ManagementPack $_).Count}}, @{Name="Number of alert rules"; Expression={(Get-Rule -ManagementPack $_ | Where-Object {$_.Category = 'Alert'}).Count}}

     

    Something tells me that the problem lies near "$_.Category", where "$_" probably still refers to the Managament Pack object.

     

    Is this even possible using "Get-ManagementPack | Select-Object", or should I investigate the "Get-ManagementPack | ForEach-Object" path instead (or maybe another one)?

     

    Thanks,

     

    Larry

     

    Tuesday, April 20, 2010 3:27 PM

Answers

  • (Get-Monitor) returns a collection, not a monitor and there is no AlertSettings property on a collection

    Get-Monitor | gm would print out the members of the collection object

    Easier in general I guess to just declare a variable of the type you're interested in and pipe to get-member:

    [Microsoft.EnterpriseManagement.Configuration.ManagementPackMonitorAlertSettings] $a | get-member

    • Marked as answer by Nicholas Li Monday, April 26, 2010 8:56 AM
    Saturday, April 24, 2010 8:47 PM
  • Hi guys,

    Good discussion.  I tried some of the proposed scripts and wasn't able to get them to return MP and Count.  One additional suggestion I have is to check that "enabled" does not equal "false".  Some workflows will be enabled "OnStandardMonitoring" or "OnEssentialMonitoring".  We'll miss those if we are checking only if enabled equals "true".  I do like Joel's suggestion of checking AlertSettings -ne $null.  Good logic.  So, I took everyone's contributions, and believe I have what Larry asked for.

    Count all alert generating monitors in each MP:

    ForEach ($MP in Get-ManagementPack) {$MP | Select @{Name="MP"; Expression= {$MP.Name}}, @{Name="Count"; Expression= {Foreach-Object {($MP.GetMonitors() | Where {$_.AlertSettings -Ne $Null -And $_.Enabled -Ne "False"}).Count}}}}

    Count all alert generating rules in each MP:

    ForEach ($MP in Get-ManagementPack) {$MP | Select @{Name="MP"; Expression= {$MP.Name}}, @{Name="Count"; Expression= {Foreach-Object {($MP.GetRules() | Where {$_.WriteActionCollection -Match "Alert" -And $_.Enabled -Ne "False"}).Count}}}}


    HTH, Jonathan Almquist - MSFT
    • Edited by Jonathan Almquist Sunday, April 25, 2010 5:42 AM update with solution
    • Marked as answer by Nicholas Li Monday, April 26, 2010 8:56 AM
    Saturday, April 24, 2010 10:34 PM

All replies

  • Count alert-generating rules in MP:

    get-managementpack -name 'Microsoft.Windows.Server.2003' | foreach-object {$_.getrules() | where {$_.WriteActionCollection -match "GenerateAlert"}} | Measure-Object

    Count monitors in MP:

    get-managementpack -name 'Microsoft.Windows.Server.2003' | foreach-object {$_.getMonitors()} | Measure-Object


    HTH, Jonathan Almquist - MSFT
    Wednesday, April 21, 2010 2:34 AM
  • Hi Larry,

    Only one change you needs to do in this instead of $_.Category = 'Alert' use  $_.Category  -eq  'Alert'

    Modified script

    Get-ManagementPack | Select-Object DisplayName, @{Name="Number of monitors"; Expression={(Get-Monitor -ManagementPack $_).Count}}, @{Name="Number of alert rules"; Expression={(Get-Rule -ManagementPack $_ | Where-Object {$_.Category  -eq 'Alert'}).Count}}

     

    $_. represents the current pipeline object

    My understanding of $_  in your script

    To explain in more details, I've done small modification to your script (added $_.Category - eq 'Alert' in calculated property for Monitor)


    New script

    Get-ManagementPack | Select-Object DisplayName, @{Name="Number of monitors"; Expression={(Get-Monitor -ManagementPack $_ | Where {$_.Category - eq 'Alert'}).Count}}, @{Name="Number of alert rules"; Expression={(Get-Rule -ManagementPack $_ | Where-Object {$_.Category = 'Alert'}).Count}}

    1. Expression=(Get-Monitor -ManagementPack $_ | Where {$_.Category - eq 'Alert'})

    Get-Monitor -ManagementPack $_, Here $_ represents current pipeline object which is MP object you got from Get-ManagementPack

    But in other part of expression

    | Where {$_.Category - eq 'Alert'} , $_ represents current pipeline object but not mp object, it represents Monitor object you got from Get-Monitor which is local to this expression only and will not be available to next expression which is for Rule

    2.Expression=(Get-Rule -ManagementPack $_ | Where-Object {$_.Category = 'Alert'})

    Get-Rule -ManagementPack $_,Here $_ represents current pipeline object which is MP object you got from Get-ManagementPack  and not the object which got from the Get-Monitor which was local for that expression only


    And in other part of expression

    | Where {$_.Category - eq 'Alert'} , represents current pipeline object but not mp object or monitor object it represents Rule object you got from Get-Rule which is local to this expression only.

     

    Hope this will help


    Thanks, Babulal
    Wednesday, April 21, 2010 4:12 AM
  • Some nitpicks :)

    You'll also want to make sure you're not counting disabled monitors/rules, or enabled monitors that are not configured to generate alerts.

    Also -- using "category=alert" wont count rules where the MP author left the category blank or chose something else -- its just a text field not enforced by anything.

    And as far as using (-match "GenerateAlert") for rules, this will work except when a composite module has been created that wraps the GenerateAlert action, therefore not necessarily having "GenerateAlert" in the text of the PS object.

    Thursday, April 22, 2010 1:03 AM
  • I've created few alert generating rules which has {Alert} in WriteActionModule, and sealed MP has {GenerateAlert} or {Alert}

    And also

    I've tried creating Monitors which generate alerts and I can see this "AlertSettings   : Microsoft.EnterpriseManagement.Configuration.ManagementPackMonitorAlertSettings" and if I doesn't generate the alert for monitor then AlertSettings property is blank.

    I've slightly modified scripts mentioned above by Jonathan and  enabled option as suggested by Joel

     

    To find alert generating rules,

    Get-ManagementPack | Foreach-Object {$_.GetRules() | Where-Object {($_.WriteActionCollection -Match 'Alert') -and ($_.Enabled -eq "true")}} | Out-File "C:\Rules.csv"

     

    To find alert generating Monitor

    Get-ManagementPack | Foreach-Object {$_.GetMonitors() | Where-Object {($_.AlertSettings -eq 'Microsoft.EnterpriseManagement.Configuration.ManagementPackMonitorAlertSettings') -and ($_.Enabled -eq "true")}} | Out-File "C:\Monitor.csv"

     

    I've confirmed few rules and monitors manually if they are generating alerts or not and looks like this script gives alert generating rules/monitors.

     

    Is it safe to say that these will give all the alert generating rules and monitors? And How to find if monitor is set to Auto-Resolve, I can't any property for this?

     

     


    Thanks, Babulal
    Friday, April 23, 2010 4:46 PM
  • Looks good to me... I think "AlertSettings -ne $null" would work as well.

    A monitor with the alert set to auto resolve will have $monitor.AlertSettings.AutoResolve -eq $true.

    A monitor with a recovery that is set to auto-run will have a Recovery (get-recovery) with it's Monitor property set to the monitor and Enabled = true.

     

    Friday, April 23, 2010 5:03 PM
  • Excellent..... Thanks Joel,

    AutoResolve works good,

    Get-ManagementPack -Name 'MP Name' | Foreach-Object {$_.GetMonitors() | Where-Object {($_.AlertSettings -ne $null) -and
    ($_.AlertSettings.AutoResolve -eq $true)}} | Out-File "C:\Test.txt"

     

    But I've tried finding all the property of the Monitors

    Get-Monitor | Get-Member

    But can't see the Autoresolve which you mentioned, how did you find it? could you please help me?


    Thanks, Babulal
    Friday, April 23, 2010 5:22 PM
  • All members of a monitor are themselves instances of some other class with their own members. Most everyone is familiar with the members of strings, booleans, etc. so you don't need to look any deeper on those properties (like "Comment") but when you have something more complex like AlertSettings, you might want to Get-Member on it:

    ((get-monitor)[0]).AlertSettings | Get-Member

    This will show you the auto-resolve property.

    Friday, April 23, 2010 5:31 PM
  • I've tried but this gives me error

    ((Get-Monitor)[0]).AlertSettings | Get-member
    Get-Member : No object has been specified to get-member.
    At line:1 char:45
    + ((Get-Monitor)[0]).AlertSettings | Get-member <<<<


    Thanks, Babulal
    Friday, April 23, 2010 5:39 PM
  • probably your first monitor has a null alertsettings... you'll need to find one that doesn't
    Friday, April 23, 2010 6:05 PM
  • Excellent..... Thanks Joel

     

    I've tried this and it worked

    ((Get-Monitor | Where-Object {$_.AlertSettings -ne $null})[0]).AlertSettings | Get-Member

     

    I've also tried this but it also gave me same error as mentioned previousely

    (Get-Monitor).AlertSettings | Get-member

    Looks like this doesn't work on collection but not able to understand if I use

    Get-Monitor | Get-Member it gives me member of monitor but Get-Monitor also returns collection and Get-Member works fine here but strange it doesn't work when I use (Get-Monitor).AlertSettings | Get-member ?

     


    Thanks, Babulal
    Saturday, April 24, 2010 6:52 AM
  • (Get-Monitor) returns a collection, not a monitor and there is no AlertSettings property on a collection

    Get-Monitor | gm would print out the members of the collection object

    Easier in general I guess to just declare a variable of the type you're interested in and pipe to get-member:

    [Microsoft.EnterpriseManagement.Configuration.ManagementPackMonitorAlertSettings] $a | get-member

    • Marked as answer by Nicholas Li Monday, April 26, 2010 8:56 AM
    Saturday, April 24, 2010 8:47 PM
  • Hi guys,

    Good discussion.  I tried some of the proposed scripts and wasn't able to get them to return MP and Count.  One additional suggestion I have is to check that "enabled" does not equal "false".  Some workflows will be enabled "OnStandardMonitoring" or "OnEssentialMonitoring".  We'll miss those if we are checking only if enabled equals "true".  I do like Joel's suggestion of checking AlertSettings -ne $null.  Good logic.  So, I took everyone's contributions, and believe I have what Larry asked for.

    Count all alert generating monitors in each MP:

    ForEach ($MP in Get-ManagementPack) {$MP | Select @{Name="MP"; Expression= {$MP.Name}}, @{Name="Count"; Expression= {Foreach-Object {($MP.GetMonitors() | Where {$_.AlertSettings -Ne $Null -And $_.Enabled -Ne "False"}).Count}}}}

    Count all alert generating rules in each MP:

    ForEach ($MP in Get-ManagementPack) {$MP | Select @{Name="MP"; Expression= {$MP.Name}}, @{Name="Count"; Expression= {Foreach-Object {($MP.GetRules() | Where {$_.WriteActionCollection -Match "Alert" -And $_.Enabled -Ne "False"}).Count}}}}


    HTH, Jonathan Almquist - MSFT
    • Edited by Jonathan Almquist Sunday, April 25, 2010 5:42 AM update with solution
    • Marked as answer by Nicholas Li Monday, April 26, 2010 8:56 AM
    Saturday, April 24, 2010 10:34 PM
  • Excellent.......

     

    Thanks Joel, Thanks Jonathan

    Now I've very good understanding of this after very good explanation from Joel and Jonathan.


    Thanks, Babulal
    Sunday, April 25, 2010 4:03 PM