locked
Events not triggering alerts RRS feed

  • Question

  • I have two separate SCOM instances (test and production) that have stopped sending alerts or the first occurrence of an event. As a test I have set up both a monitor and a rule to watch a log for the occurrence of an entry. I am finding that I need to create the entry in the monitored log 3 times to trigger an alert. One of my instances is at cu9, the other I just updated to cu13 to try to fix this. Has anyone seen this and/or is anyone aware of any setting that might govern this? I'm suspecting that a patch somewhere along the line caused this.

    Dan Gleason

    Friday, June 30, 2017 3:19 PM

Answers

  • This ended up being a two part problem. the first was related to how the subscriptions were set up. I'd pointed to the data capture instead of the monitor. I am puzzled as to how things were working originally and then stopped and the only thing I can think of is that someone modified the subscriptions. I'll never know. The second issue...not receiving alerts when logs changed....seemed to be related to how I was updating the logs during testing. When I changed over to updating the logs via a command echo script things got consistent. Thanks much though to those who offered solutions!

    Dan Gleason

    • Marked as answer by anyofus Tuesday, July 25, 2017 3:56 PM
    Tuesday, July 25, 2017 3:56 PM

All replies

  • I have two separate SCOM instances (test and production) that have stopped sending alerts or the first occurrence of an event. As a test I have set up both a monitor and a rule to watch a log for the occurrence of an entry.
    1) what is your event monitor setting?
    2) stopped sending alerts or the first occurrence of an event: does it means that your your does not receive email alert for first occurrence of an event? If yes, pleas echeck your subscription alert aging setting
    Roger
    • Proposed as answer by Elton_Ji Tuesday, July 25, 2017 3:35 PM
    Monday, July 3, 2017 3:39 AM
  • Hi Dan,

    Have you tried to alert when any new line was generated :

    https://blogs.technet.microsoft.com/schadinio/2010/07/20/scom-how-to-monitor-new-line-entries-in-a-log-or-text-file-using-opsmgr-2007/

    Still same issue ?

    Best Regards,

    Elton


    Please remember to mark the replies as answers if they help.
    If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com.

    Monday, July 3, 2017 5:04 AM
  • This ended up being a two part problem. the first was related to how the subscriptions were set up. I'd pointed to the data capture instead of the monitor. I am puzzled as to how things were working originally and then stopped and the only thing I can think of is that someone modified the subscriptions. I'll never know. The second issue...not receiving alerts when logs changed....seemed to be related to how I was updating the logs during testing. When I changed over to updating the logs via a command echo script things got consistent. Thanks much though to those who offered solutions!

    Dan Gleason

    • Marked as answer by anyofus Tuesday, July 25, 2017 3:56 PM
    Tuesday, July 25, 2017 3:56 PM