locked
How to get alerts out of SCOM and into a 3rd party management tool RRS feed

  • Question

  • Hi

    I  am creating an integration between a 3rd party management tool and System Center Operations Manager 2012 R2.  I need to export alerts such as Power Off / Power On / Configuration change for both virtual machines and hyperv servers from SCOM into our application. Our application runs on linux so I cannot do any .NET programming, however I can run Powershell scripts remotely using WinRM.

    What is the best way to do this? I am aware of using the powershell cmdlet Get-SCOMAlert but is there any other way that does not involve polling?

    thanks in advance



    • Edited by bhelgeson Thursday, June 26, 2014 5:15 AM
    Thursday, June 26, 2014 4:56 AM

Answers

  • Think of Orchestrator as a "router", that will route information and workflows between SCOM, and [insert 3rd party product here].  Depending on your 3rd party product, there may be an "integration pack" for it that Orchestrator can use for out of the box tasks.

    So what's an integration pack?  Well - think of it like a management pack, but for Orchestrator.  SCOM does monitoring, but it doesn't know how to monitor something unless you install the relevant management pack.  The management pack contains all the rules/monitors for monitoring whatever it is you wish to monitor.

    Well, an integration pack is similar in concept, except it tells Orchestrator how to interface and integrate with whatever it is you're trying to perform tasks with. 

    For what you want to do, there is a SCOM integration pack.  This is a set of tasks that can get alerts and events out of Operations Manager (there are also tasks that can create and close alerts in Operations Manager). 

    From what I can imagine - you would want to get alerts out of SCOM when they happen (so you would use one of the SCOM orchestrator tasks to "get alert if status = new, and source = myapplication"), and then you can pass that alert to another task - such as write it to a CSV file or something.  You could then have another task that picks up that CSV file, and passes it to your application where it can be captured.  Or you could use the CSV to populate variables in a powershell script, and then powershell that information into your app.

    There are many ways you could do this, but I do believe that Orchestrator would be the better option. 


    http://www.dreamension.net

    • Marked as answer by Yan Li_ Monday, July 7, 2014 1:36 AM
    Friday, June 27, 2014 12:04 AM
  • You might want to have a look at SCOM connectors:

    http://msdn.microsoft.com/en-us/library/hh328935


    Cheers,

    Martin

    Blog: http://sustaslog.wordpress.com  LinkedIn:   

    Note: Posts are provided “AS IS” without warranty of any kind, either expressed or implied, including but not limited to the implied warranties of merchantability and/or fitness for a particular purpose.

    • Marked as answer by Yan Li_ Monday, July 7, 2014 1:37 AM
    Friday, June 27, 2014 12:41 PM

All replies

  • Hi, you can use Orchestrator for this purpose

    http://technet.microsoft.com/en-us/library/hh830707.aspx

    Thursday, June 26, 2014 9:06 AM
  • Thanks Alexis for your response.

    I already looked into the Orchestrator Monitor Alert activity but I am not clear as to how to access the output from an Orchestrator runbook from a 3rd party tool or even a powershell script. Nor could I find any documentation on that. can you point me to any good links?

    I realized last night that I can actually use .NET assemblies in a powershell script, I didnt know that before. This opens up the SCOM Connectors to us. Does that sound like a fit for what we are trying to do? I just need to import the alerts, I do not need to edit them.

    thanks

    Thursday, June 26, 2014 8:45 PM
  • Think of Orchestrator as a "router", that will route information and workflows between SCOM, and [insert 3rd party product here].  Depending on your 3rd party product, there may be an "integration pack" for it that Orchestrator can use for out of the box tasks.

    So what's an integration pack?  Well - think of it like a management pack, but for Orchestrator.  SCOM does monitoring, but it doesn't know how to monitor something unless you install the relevant management pack.  The management pack contains all the rules/monitors for monitoring whatever it is you wish to monitor.

    Well, an integration pack is similar in concept, except it tells Orchestrator how to interface and integrate with whatever it is you're trying to perform tasks with. 

    For what you want to do, there is a SCOM integration pack.  This is a set of tasks that can get alerts and events out of Operations Manager (there are also tasks that can create and close alerts in Operations Manager). 

    From what I can imagine - you would want to get alerts out of SCOM when they happen (so you would use one of the SCOM orchestrator tasks to "get alert if status = new, and source = myapplication"), and then you can pass that alert to another task - such as write it to a CSV file or something.  You could then have another task that picks up that CSV file, and passes it to your application where it can be captured.  Or you could use the CSV to populate variables in a powershell script, and then powershell that information into your app.

    There are many ways you could do this, but I do believe that Orchestrator would be the better option. 


    http://www.dreamension.net

    • Marked as answer by Yan Li_ Monday, July 7, 2014 1:36 AM
    Friday, June 27, 2014 12:04 AM
  • You might want to have a look at SCOM connectors:

    http://msdn.microsoft.com/en-us/library/hh328935


    Cheers,

    Martin

    Blog: http://sustaslog.wordpress.com  LinkedIn:   

    Note: Posts are provided “AS IS” without warranty of any kind, either expressed or implied, including but not limited to the implied warranties of merchantability and/or fitness for a particular purpose.

    • Marked as answer by Yan Li_ Monday, July 7, 2014 1:37 AM
    Friday, June 27, 2014 12:41 PM
  • Thanks a lot Noel, your response was very helpful
    Friday, June 27, 2014 2:41 PM
  • Thanks Martin for your suggestion.

    Yes, I was particularly interested in the SCOM connector approach.  Today I implemented an outbound connector in powershell and it does return alerts to me. But one thing that is not clear to me is whether i need to write code to keep asking for new alerts? I used this article as a guide http://www.flexecom.com/deleting-scom-connector-programmatically/ 

    The AlertSubscriptionConfiguration class (see link below) with members PollingInterval and ExpirationStartTime implies my code does not need to handle polling (ie calling the GetMonitoringAlerts method in a loop) 

    http://msdn.microsoft.com/en-us/library/microsoft.enterprisemanagement.administration.alertsubscriptionconfiguration_members.aspx

    It would be great if my powershell script could just listen for new alerts, it is a subscription after all.

    Can you clarify? 

    thanks a lot Martin.

    B

    Friday, June 27, 2014 9:45 PM
  • From what I understand the connector will publish new alert data based on PollingInterval. So no loop is needed to be setup in side the powershell script as it should be triggered by the PollingInterval.



    Cheers,

    Martin

    Blog: http://sustaslog.wordpress.com  LinkedIn:   

    Note: Posts are provided “AS IS” without warranty of any kind, either expressed or implied, including but not limited to the implied warranties of merchantability and/or fitness for a particular purpose.

    Saturday, June 28, 2014 2:02 AM