locked
Event Monitor issue RRS feed

 > 

  • Question

  • Question
    Sign in to vote
    0
    Sign in to vote

    There is a one watcher service that at  every configured time tries out 4 operations on a  server and every time an error occurs an event is logged. This is the same event id for all the 4 kind of operations.So what happens is even if an alert is generated because of one event  from a server, it immediately gets closed because of a success event from another server ( all these transaction runs from same watcher so event id is logged in same ).

    So how we can generate one alert per server.there is one parameter in event data that will identify the server.and how we can close the alert for a server.Alert should be closed only when all 4 operations are successful on a server.


    • Edited by scom learner Thursday, November 21, 2013 6:06 PM
    Thursday, November 21, 2013 4:21 PM

All replies

  • Question
    Sign in to vote
    0
    Sign in to vote

    Hi 

    looks like monitor is of event reset monitor type and you can not achieve the desired results with one monitor for for event id's. 

    need to disable current monitor and create 4 different monitors one for each with criteria on uniquely event data, so that each monitor will track one event id. if you are looking for only one alert  from 4 event id create an aggregate monitor with all new 4 monitors with alerting disabled under aggregate monitor and enable alerting on aggregate monitor, so that you will receive only one alert and will only close if 4 monitors are healthy.

    Regards

     

    sridhar v

    Friday, November 22, 2013 2:22 PM
  • Question
    Sign in to vote
    0
    Sign in to vote
    EventId is same for all the 4 operations and these 4 operations are getting eecuted on multiple urls and url is event parameter that  same for 4 operations and we want show only one alert per url and if all 4 operations are successful then alert for a url should get closed
    Friday, November 22, 2013 2:43 PM
  • Question
    Sign in to vote
    0
    Sign in to vote

    Hi,

    I know you want the Alert get closed when all 4 operations are successful. However, I'm afraid it cannot be achieved.

    How to Close an Alert Generated by a Monitor
    http://technet.microsoft.com/en-us/library/hh212689.aspx

     

    Niki Han

    TechNet Community Support

    Tuesday, November 26, 2013 7:31 AM
  • Question
    Sign in to vote
    0
    Sign in to vote
    How can we read the value of event parameter in event expression in monitor?
    Thursday, November 28, 2013 9:06 AM