locked
Rule/Monitor create critical alert for all sample RRS feed

  • Question

  • Hi All,

    I have a requirement in my account to configure critical alert for processor on every sample if sample is greater than 80%. And for Disk if sample value is below 8% free like for 7%, 6%, 5%, 4% etc...

    This can not be achieved from Monitor coz it can only be trigger a critical alert once only on a threshold. 

    Let me know how can i achieve this. i thought a rule can do this but how?


    Cheers, Gourav Please remember to mark the replies as answers if it helped.

    Monday, April 9, 2018 10:18 AM

Answers

  • Added alert for disk

    <?xml version="1.0" encoding="utf-8"?>
    <ManagementPack SchemaVersion="2.0" ContentReadable="true" xmlns:xsd="http://www.w3.org/2001/XMLSchema">
      <Manifest>
        <Identity>
          <ID>MP.For.Rule</ID>
          <Version>1.0.0.7</Version>
        </Identity>
        <Name>MP.For.Rule</Name>
        <References>
          <Reference Alias="SC">
            <ID>Microsoft.SystemCenter.Library</ID>
            <Version>7.0.8427.0</Version>
            <PublicKeyToken>31bf3856ad364e35</PublicKeyToken>
          </Reference>
          <Reference Alias="Windows">
            <ID>Microsoft.Windows.Library</ID>
            <Version>7.5.8501.0</Version>
            <PublicKeyToken>31bf3856ad364e35</PublicKeyToken>
          </Reference>
          <Reference Alias="Health">
            <ID>System.Health.Library</ID>
            <Version>7.0.8427.0</Version>
            <PublicKeyToken>31bf3856ad364e35</PublicKeyToken>
          </Reference>
          <Reference Alias="System">
            <ID>System.Library</ID>
            <Version>7.5.8501.0</Version>
            <PublicKeyToken>31bf3856ad364e35</PublicKeyToken>
          </Reference>
          <Reference Alias="Perf">
            <ID>System.Performance.Library</ID>
            <Version>7.0.8427.0</Version>
            <PublicKeyToken>31bf3856ad364e35</PublicKeyToken>
          </Reference>
        </References>
      </Manifest>
      <Monitoring>
        <Rules>
          <Rule ID="Custom.Windows.OperatingSystem.PercentProcessorTime.AlertRule" Target="Windows!Microsoft.Windows.OperatingSystem" Enabled="true" ConfirmDelivery="false" Remotable="true" Priority="Normal" DiscardLevel="100">
            <Category>Alert</Category>
            <DataSources>
              <DataSource ID="DS" TypeID="Perf!System.Performance.DataProvider">
                <ComputerName>$Target/Host/Property[Type="Windows!Microsoft.Windows.Computer"]/PrincipalName$</ComputerName>
                <CounterName>% Processor Time</CounterName>
                <ObjectName>Processor</ObjectName>
                <InstanceName>_Total</InstanceName>
                <AllInstances>false</AllInstances>
                <Frequency>300</Frequency>
              </DataSource>
            </DataSources>
            <ConditionDetection ID="CD" TypeID="System!System.ExpressionFilter">
              <Expression>
                <SimpleExpression>
                  <ValueExpression>
                    <XPathQuery Type="Integer">Value</XPathQuery>
                  </ValueExpression>
                  <Operator>GreaterEqual</Operator>
                  <ValueExpression>
                    <Value Type="Integer">90</Value>
                  </ValueExpression>
                </SimpleExpression>
              </Expression>
            </ConditionDetection>
            <WriteActions>
              <WriteAction ID="Alert" TypeID="Health!System.Health.GenerateAlert">
                <Priority>1</Priority>
                <Severity>2</Severity>
                <AlertMessageId>$MPElement[Name="Custom.Windows.OperatingSystem.PercentProcessorTime.AlertRule.AlertMessage"]$</AlertMessageId>
                <AlertParameters>
                  <AlertParameter1>$Target/Host/Property[Type="Windows!Microsoft.Windows.Computer"]/PrincipalName$</AlertParameter1>
                  <AlertParameter2>$Data/Value$</AlertParameter2>
                </AlertParameters>
              </WriteAction>
            </WriteActions>
          </Rule>
          <Rule ID="Custom.Windows.LogicalDisk.PercentFreeSpace.AlertRule" Target="Windows!Microsoft.Windows.LogicalDisk" Enabled="true" ConfirmDelivery="false" Remotable="true" Priority="Normal" DiscardLevel="100">
            <Category>Alert</Category>
            <DataSources>
              <DataSource ID="DS" TypeID="Perf!System.Performance.DataProvider">
                <ComputerName>$Target/Host/Property[Type="Windows!Microsoft.Windows.Computer"]/PrincipalName$</ComputerName>
                <CounterName>% Free Space</CounterName>
                <ObjectName>LogicalDisk</ObjectName>
                <InstanceName>$Target/Property[Type="Windows!Microsoft.Windows.LogicalDevice"]/DeviceID$</InstanceName>
                <Frequency>300</Frequency>
              </DataSource>
            </DataSources>
            <ConditionDetection ID="CD" TypeID="System!System.ExpressionFilter">
              <Expression>
                <SimpleExpression>
                  <ValueExpression>
                    <XPathQuery Type="Integer">Value</XPathQuery>
                  </ValueExpression>
                  <Operator>Equal</Operator>
                  <ValueExpression>
                    <Value Type="Integer">8</Value>
                  </ValueExpression>
                </SimpleExpression>
              </Expression>
            </ConditionDetection>
            <WriteActions>
              <WriteAction ID="Alert" TypeID="Health!System.Health.GenerateAlert">
                <Priority>1</Priority>
                <Severity>2</Severity>
                <AlertMessageId>$MPElement[Name="Custom.Windows.LogicalDisk.PercentFreeSpace.AlertRule.AlertMessage"]$</AlertMessageId>
                <AlertParameters>
                  <AlertParameter1>$Target/Property[Type="Windows!Microsoft.Windows.LogicalDevice"]/DeviceID$</AlertParameter1>
                  <AlertParameter2>$Target/Host/Property[Type="Windows!Microsoft.Windows.Computer"]/PrincipalName$</AlertParameter2>
                  <AlertParameter3>$Data/Value$</AlertParameter3>
                </AlertParameters>
              </WriteAction>
            </WriteActions>
          </Rule>
        </Rules>
      </Monitoring>
      <Presentation>
        <Folders>
          <Folder ID="Folder_518fa734af1c42a582a7ece44eb4139d" Accessibility="Public" ParentFolder="SC!Microsoft.SystemCenter.Monitoring.ViewFolder.Root" />
        </Folders>
        <StringResources>
          <StringResource ID="Custom.Windows.OperatingSystem.PercentProcessorTime.AlertRule.AlertMessage" />
          <StringResource ID="Custom.Windows.LogicalDisk.PercentFreeSpace.AlertRule.AlertMessage" />
        </StringResources>
      </Presentation>
      <LanguagePacks>
        <LanguagePack ID="ENU" IsDefault="true">
          <DisplayStrings>
            <DisplayString ElementID="MP.For.Rule">
              <Name>MP For Rule</Name>
              <Description />
            </DisplayString>
            <DisplayString ElementID="Folder_518fa734af1c42a582a7ece44eb4139d">
              <Name>MP For Rule</Name>
            </DisplayString>
            <DisplayString ElementID="Custom.Windows.OperatingSystem.PercentProcessorTime.AlertRule">
              <Name>% Processor Time</Name>
              <Description>This task generates alert when % Processor Time counter reaches the threshold.</Description>
            </DisplayString>
            <DisplayString ElementID="Custom.Windows.OperatingSystem.PercentProcessorTime.AlertRule.AlertMessage">
              <Name>% Processor Time is too high.</Name>
              <Description>% Processor Time counter has reached the threshold on the computer {0}. The value is {1}.</Description>
            </DisplayString>
            <DisplayString ElementID="Custom.Windows.LogicalDisk.PercentFreeSpace.AlertRule">
              <Name>Logical Disk Free Space (%) Low</Name>
              <Description>This rule monitors the percentage of free space remaining on a logical disk.</Description>
            </DisplayString>
            <DisplayString ElementID="Custom.Windows.LogicalDisk.PercentFreeSpace.AlertRule.AlertMessage">
              <Name>Percentage Logical Disk Free Space is low</Name>
              <Description>The disk {0} on computer {1} is running out of disk space. The value that exceeded the threshold is {2}% free space.</Description>
            </DisplayString>
          </DisplayStrings>
          <KnowledgeArticles></KnowledgeArticles>
        </LanguagePack>
      </LanguagePacks>
    </ManagementPack>


    Vladimir Zelenov | http://systemcenter4all.wordpress.com

    • Marked as answer by GouravIN Wednesday, May 9, 2018 5:45 PM
    Wednesday, May 9, 2018 12:05 PM

All replies

  • Hi Gourav,

    interesting requirement, but we provide whatever the customer wants, right :)

    Have you tried build your own consecutive samples or average monitor? This would be the easiest way.

    Otherwise you can do it the PowerShell way. You can use the PowerShell Community MP from Squared Up and create a simple script, which does your single sample. With PowerShell you can do it exactly as you need it.It won't be hard to find example script that allow you to read out the value of the CPU counter (current or average).

    I am curious what you think?

    Regards,


    Stoyan (Please take a moment to "Vote as Helpful" and/or "Mark as Answer" where applicable. This helps the community, keeps the forums tidy, and recognizes useful contributions. Thanks!) Blog: https://blog.pohn.ch/ Twitter: @StoyanChalakov

    Monday, April 9, 2018 10:58 AM
  • Hi Gourav,

    The Option here is to customize it using a script or some thing.

    Or

    You will have to create custom monitors for each thresholds based on the target you want to use to alert on.


    Gautam.75801


    Monday, April 9, 2018 3:32 PM
  • Hi Stoyan/Gautam,

    Yes...... I am trying to give this coz it is just like learning new and pushing limits ....  :P

    Could anyone please help me about these :- is there any chance possible to achieve my goal..... like critical alert on every sample after a given threshold....

    Or Could you please help me to configure this via script like how any reference link that would be very helpful....

    After running get-wmiobject
    win32_processor and win32_physicalmemory these field can help but how?

    And what about this if i will change "Match Monitor's health" to "Critical" then will it work means will it generate both alert with critical severity the value which i passed for "Warning threshold for system/non-system drive"  and "Error threshold" or this is not work like this ....

    I am thinking one critical can not trigger critical alert again? If i am not wrong  


    Cheers, Gourav Please remember to mark the replies as answers if it helped.




    • Edited by GouravIN Tuesday, April 10, 2018 7:11 AM
    Tuesday, April 10, 2018 6:09 AM
  • Hi Gourav,

    This is what these monitors can be used for. However I don't think they're going to suffice for your requirement. To achieve your particular need, you're probably going  to need a considerable knowledge of scripting and authoring I think.

    Further reading:

    Script Monitors

    How to create a monitor based on a script

    Hope this helps

    Cheers


    Sam (Please take a moment to "Vote as Helpful" and/or "Mark as Answer" wherever applicable. Thanks!)

    Tuesday, April 10, 2018 8:01 AM
  • Hey Sam, 

    Good to see you here!
    This is what i am also thinking but i am not that good in scripting at par. It would be great if anyone can provide any script here for the same. 


    Cheers, Gourav Please remember to mark the replies as answers if it helped.

    Tuesday, April 10, 2018 8:59 AM
  • Hi All,

    I have a requirement in my account to configure critical alert for processor on every sample if sample is greater than 80%. And for Disk if sample value is below 8% free like for 7%, 6%, 5%, 4% etc...

    This can not be achieved from Monitor coz it can only be trigger a critical alert once only on a threshold. 

    Let me know how can i achieve this. i thought a rule can do this but how?


    Cheers, Gourav Please remember to mark the replies as answers if it helped.


    As I understood you want to refresh Alert description which was generated by Monitor every time when value has changed?

    Vladimir Zelenov | http://systemcenter4all.wordpress.com

    Thursday, April 12, 2018 1:26 PM
  • Yes Sir,

    Its a kind of but i also want that it will write an alert and this alert should appear in active alerts tab only value refreshment is not a goal here the main objective is i want alert on every new sample ( if breaches ) at a given sample.  

    If i can do this so, coz a critical monitor can not trigger another alert again if its already in critical state.


    Cheers, Gourav Please remember to mark the replies as answers if it helped.

    Friday, April 13, 2018 4:51 PM
  • Hello Vladimir,

    Any update over it!

    @Stoyan/Gautam :- can you please suggest me any script which can do the same task ( like check samples )



    Cheers, Gourav Please remember to mark the replies as answers if it helped.

    Monday, April 30, 2018 9:41 AM
  • Hello Vladimir,

    Any update over it!

    @Stoyan/Gautam :- can you please suggest me any script which can do the same task ( like check samples )



    Cheers, Gourav Please remember to mark the replies as answers if it helped.


    In this case you should use Rule but not Monitor.

    Vladimir Zelenov | http://systemcenter4all.wordpress.com

    Tuesday, May 1, 2018 6:56 AM
  • But Sir, for this i need a script to to do this task or WMI query, i guess. Because we can not create an alert Rule directly for Disk.

    Correct me if i am wrong here! :D


    Cheers, Gourav Please remember to mark the replies as answers if it helped.

    Tuesday, May 1, 2018 8:18 AM
  • But Sir, for this i need a script to to do this task or WMI query, i guess. Because we can not create an alert Rule directly for Disk.

    Correct me if i am wrong here! :D


    Cheers, Gourav Please remember to mark the replies as answers if it helped.


    No, you don't need WMI or script, the best is to use performance counters for this task. You can manually combine one rule from two if you don't want to do it in a VSAE (or MP Authoring).

    Vladimir Zelenov | http://systemcenter4all.wordpress.com

    Tuesday, May 1, 2018 12:59 PM
  • Here is your Management Pack fragment:

    <ManagementPackFragment SchemaVersion="2.0" xmlns:xsd="http://www.w3.org/2001/XMLSchema">
      <Monitoring>
        <Rules>
          <Rule ID="Custom.Windows.OperatingSystem.PercentProcessorTime.AlertRule" Target="Windows!Microsoft.Windows.OperatingSystem" Enabled="true" ConfirmDelivery="false" Remotable="true" Priority="Normal" DiscardLevel="100">
            <Category>Alert</Category>
            <DataSources>
              <DataSource ID="DS" TypeID="Perf!System.Performance.DataProvider">
                <ComputerName>$Target/Host/Property[Type="Windows!Microsoft.Windows.Computer"]/PrincipalName$</ComputerName>
                <CounterName>% Processor Time</CounterName>
                <ObjectName>Processor</ObjectName>
                <InstanceName>_Total</InstanceName>
                <AllInstances>false</AllInstances>
                <Frequency>300</Frequency>
              </DataSource>
            </DataSources>
            <ConditionDetection ID="CD" TypeID="System!System.ExpressionFilter">
              <Expression>
                <SimpleExpression>
                  <ValueExpression>
                    <XPathQuery Type="Integer">Value</XPathQuery>
                  </ValueExpression>
                  <Operator>GreaterEqual</Operator>
                  <ValueExpression>
                    <Value Type="Integer">80</Value>
                  </ValueExpression>
                </SimpleExpression>
              </Expression>
            </ConditionDetection>
            <WriteActions>
              <WriteAction ID="Alert" TypeID="Health!System.Health.GenerateAlert">
                <Priority>1</Priority>
                <Severity>2</Severity>
                <AlertMessageId>$MPElement[Name="Custom.Windows.OperatingSystem.PercentProcessorTime.AlertRule.AlertMessage"]$</AlertMessageId>
                <AlertParameters>
                  <AlertParameter1>$Target/Host/Property[Type="Windows!Microsoft.Windows.Computer"]/PrincipalName$</AlertParameter1>
                  <AlertParameter2>$Data/Value$</AlertParameter2>
                </AlertParameters>
              </WriteAction>
            </WriteActions>
          </Rule>
        </Rules>
      </Monitoring>
      <Presentation>
        <StringResources>
          <StringResource ID="Custom.Windows.OperatingSystem.PercentProcessorTime.AlertRule.AlertMessage" />
        </StringResources>
      </Presentation>
      <LanguagePacks>
        <LanguagePack ID="ENU" IsDefault="true">
          <DisplayStrings>
            <DisplayString ElementID="Custom.Windows.OperatingSystem.PercentProcessorTime.AlertRule">
              <Name>% Processor Time</Name>
              <Description>This task generates alert when % Processor Time counter reaches the threshold.</Description>
            </DisplayString>
            <DisplayString ElementID="Custom.Windows.OperatingSystem.PercentProcessorTime.AlertRule.AlertMessage">
              <Name>% Processor Time is too high.</Name>
              <Description>% Processor Time counter has reached the threshold on the computer {0}. The value is {1}.</Description>
            </DisplayString>
          </DisplayStrings>
        </LanguagePack>
      </LanguagePacks>
    </ManagementPackFragment>


    Vladimir Zelenov | http://systemcenter4all.wordpress.com


    Tuesday, May 1, 2018 1:12 PM
  • Hello Vladimir,

    Thanks for the Help here!

    I will take this MP fragmentation and will import in MP author. This will take sample after 300 seconds and when it will find value equal or greater then 80 than only it create alert. if i am not wrong?

    Correct me if i am wrong.....


    Cheers, Gourav Please remember to mark the replies as answers if it helped.

    Tuesday, May 1, 2018 3:38 PM
  • Hello Vladimir,

    Thanks for the Help here!

    I will take this MP fragmentation and will import in MP author. This will take sample after 300 seconds and when it will find value equal or greater then 80 than only it create alert. if i am not wrong?

    Correct me if i am wrong.....


    Cheers, Gourav Please remember to mark the replies as answers if it helped.


    Yes, you're right! All as you described.

    Vladimir Zelenov | http://systemcenter4all.wordpress.com

    Tuesday, May 1, 2018 3:51 PM
  • Thanks for everything here ! Give me 2 days maximum will update the thread after testing.

    Cheers, Gourav Please remember to mark the replies as answers if it helped.

    Tuesday, May 1, 2018 4:29 PM
  • Hi Sir,

    Just a quick question ,i am just keen to know Is there any way to add fragment into MP without using MPAuthor, VSAE, Authoring Kit.

    What i am asking is , if i will create a new blank MP in SCOM and export its XML afterwards how can i add  this fragments to that exported XML.

    Below is the XML of my created custom MP, where i need to place this fragment ( between which tags ) can i do this?

    <?xml version="1.0" encoding="utf-8"?><ManagementPack ContentReadable="true" SchemaVersion="2.0" OriginalSchemaVersion="1.1" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsl="http://www.w3.org/1999/XSL/Transform">
      <Manifest>
        <Identity>
          <ID>MP.For.Rule</ID>
          <Version>1.0.0.0</Version>
        </Identity>
        <Name>MP For Rule</Name>
        <References>
          <Reference Alias="SystemCenter">
            <ID>Microsoft.SystemCenter.Library</ID>
            <Version>7.0.8433.0</Version>
            <PublicKeyToken>31bf3856ad364e35</PublicKeyToken>
          </Reference>
        </References>
      </Manifest>
      <Presentation>
        <Folders>
          <Folder ID="Folder_518fa734af1c42a582a7ece44eb4139d" Accessibility="Public" ParentFolder="SystemCenter!Microsoft.SystemCenter.Monitoring.ViewFolder.Root" />
        </Folders>
      </Presentation>
      <LanguagePacks>
        <LanguagePack ID="ENU" IsDefault="false">
          <DisplayStrings>
            <DisplayString ElementID="MP.For.Rule">
              <Name>MP For Rule</Name>
              <Description />
            </DisplayString>
            <DisplayString ElementID="Folder_518fa734af1c42a582a7ece44eb4139d">
              <Name>MP For Rule</Name>
            </DisplayString>
          </DisplayStrings>
        </LanguagePack>
      </LanguagePacks>
    </ManagementPack>


    Cheers, Gourav Please remember to mark the replies as answers if it helped.


    • Edited by GouravIN Wednesday, May 2, 2018 12:46 PM
    Wednesday, May 2, 2018 12:42 PM
  • <?xml version="1.0" encoding="utf-8"?>
    <ManagementPack SchemaVersion="2.0" ContentReadable="true" xmlns:xsd="http://www.w3.org/2001/XMLSchema">
      <Manifest>
        <Identity>
          <ID>MP.For.Rule</ID>
          <Version>1.0.0.5</Version>
        </Identity>
        <Name>MP.For.Rule</Name>
        <References>
          <Reference Alias="SC">
            <ID>Microsoft.SystemCenter.Library</ID>
            <Version>7.0.8427.0</Version>
            <PublicKeyToken>31bf3856ad364e35</PublicKeyToken>
          </Reference>
          <Reference Alias="Windows">
            <ID>Microsoft.Windows.Library</ID>
            <Version>7.5.8501.0</Version>
            <PublicKeyToken>31bf3856ad364e35</PublicKeyToken>
          </Reference>
          <Reference Alias="Health">
            <ID>System.Health.Library</ID>
            <Version>7.0.8427.0</Version>
            <PublicKeyToken>31bf3856ad364e35</PublicKeyToken>
          </Reference>
          <Reference Alias="System">
            <ID>System.Library</ID>
            <Version>7.5.8501.0</Version>
            <PublicKeyToken>31bf3856ad364e35</PublicKeyToken>
          </Reference>
          <Reference Alias="Perf">
            <ID>System.Performance.Library</ID>
            <Version>7.0.8427.0</Version>
            <PublicKeyToken>31bf3856ad364e35</PublicKeyToken>
          </Reference>
        </References>
      </Manifest>
      <Monitoring>
        <Rules>
          <Rule ID="Custom.Windows.OperatingSystem.PercentProcessorTime.AlertRule" Target="Windows!Microsoft.Windows.OperatingSystem" Enabled="true" ConfirmDelivery="false" Remotable="true" Priority="Normal" DiscardLevel="100">
            <Category>Alert</Category>
            <DataSources>
              <DataSource ID="DS" TypeID="Perf!System.Performance.DataProvider">
                <ComputerName>$Target/Host/Property[Type="Windows!Microsoft.Windows.Computer"]/PrincipalName$</ComputerName>
                <CounterName>% Processor Time</CounterName>
                <ObjectName>Processor</ObjectName>
                <InstanceName>_Total</InstanceName>
                <AllInstances>false</AllInstances>
                <Frequency>300</Frequency>
              </DataSource>
            </DataSources>
            <ConditionDetection ID="CD" TypeID="System!System.ExpressionFilter">
              <Expression>
                <SimpleExpression>
                  <ValueExpression>
                    <XPathQuery Type="Integer">Value</XPathQuery>
                  </ValueExpression>
                  <Operator>GreaterEqual</Operator>
                  <ValueExpression>
                    <Value Type="Integer">90</Value>
                  </ValueExpression>
                </SimpleExpression>
              </Expression>
            </ConditionDetection>
            <WriteActions>
              <WriteAction ID="Alert" TypeID="Health!System.Health.GenerateAlert">
                <Priority>1</Priority>
                <Severity>2</Severity>
                <AlertMessageId>$MPElement[Name="Custom.Windows.OperatingSystem.PercentProcessorTime.AlertRule.AlertMessage"]$</AlertMessageId>
                <AlertParameters>
                  <AlertParameter1>$Target/Host/Property[Type="Windows!Microsoft.Windows.Computer"]/PrincipalName$</AlertParameter1>
                  <AlertParameter2>$Data/Value$</AlertParameter2>
                </AlertParameters>
              </WriteAction>
            </WriteActions>
          </Rule>
        </Rules>
      </Monitoring>
      <Presentation>
        <Folders>
          <Folder ID="Folder_518fa734af1c42a582a7ece44eb4139d" Accessibility="Public" ParentFolder="SC!Microsoft.SystemCenter.Monitoring.ViewFolder.Root" />
        </Folders>
        <StringResources>
          <StringResource ID="Custom.Windows.OperatingSystem.PercentProcessorTime.AlertRule.AlertMessage" />
        </StringResources>
      </Presentation>
      <LanguagePacks>
        <LanguagePack ID="ENU" IsDefault="false">
          <DisplayStrings>
            <DisplayString ElementID="MP.For.Rule">
              <Name>MP For Rule</Name>
              <Description />
            </DisplayString>
            <DisplayString ElementID="Folder_518fa734af1c42a582a7ece44eb4139d">
              <Name>MP For Rule</Name>
            </DisplayString>
            <DisplayString ElementID="Custom.Windows.OperatingSystem.PercentProcessorTime.AlertRule">
              <Name>% Processor Time</Name>
              <Description>This task generates alert when % Processor Time counter reaches the threshold.</Description>
            </DisplayString>
            <DisplayString ElementID="Custom.Windows.OperatingSystem.PercentProcessorTime.AlertRule.AlertMessage">
              <Name>% Processor Time is too high.</Name>
              <Description>% Processor Time counter has reached the threshold on the computer {0}. The value is {1}.</Description>
            </DisplayString>
          </DisplayStrings>
          <KnowledgeArticles></KnowledgeArticles>
        </LanguagePack>
      </LanguagePacks>
    </ManagementPack>


    Vladimir Zelenov | http://systemcenter4all.wordpress.com

    Wednesday, May 2, 2018 3:20 PM
  • Hello,

    How fast do you need to be notified when the CPU is over 80% and when you are lower than 8% on storage?  I have the default monitors for CPU and HD enabled, and I get an e-mail within a minute for either CPU or HD.  I would recommend switching from % free space to MB free space. 

    Tuesday, May 8, 2018 9:08 PM
  • Hi There,

    I want this between 30 Min to 1 hour. But my concern is once a Monitor gets critical then it will not trigger alert till the time it will not come in healthy state. So i am looking for rule and if you have something then please share. Its interesting to find other ways as well. 


    Cheers, Gourav Please remember to mark the replies as answers if it helped.

    Wednesday, May 9, 2018 3:32 AM
  • Added alert for disk

    <?xml version="1.0" encoding="utf-8"?>
    <ManagementPack SchemaVersion="2.0" ContentReadable="true" xmlns:xsd="http://www.w3.org/2001/XMLSchema">
      <Manifest>
        <Identity>
          <ID>MP.For.Rule</ID>
          <Version>1.0.0.7</Version>
        </Identity>
        <Name>MP.For.Rule</Name>
        <References>
          <Reference Alias="SC">
            <ID>Microsoft.SystemCenter.Library</ID>
            <Version>7.0.8427.0</Version>
            <PublicKeyToken>31bf3856ad364e35</PublicKeyToken>
          </Reference>
          <Reference Alias="Windows">
            <ID>Microsoft.Windows.Library</ID>
            <Version>7.5.8501.0</Version>
            <PublicKeyToken>31bf3856ad364e35</PublicKeyToken>
          </Reference>
          <Reference Alias="Health">
            <ID>System.Health.Library</ID>
            <Version>7.0.8427.0</Version>
            <PublicKeyToken>31bf3856ad364e35</PublicKeyToken>
          </Reference>
          <Reference Alias="System">
            <ID>System.Library</ID>
            <Version>7.5.8501.0</Version>
            <PublicKeyToken>31bf3856ad364e35</PublicKeyToken>
          </Reference>
          <Reference Alias="Perf">
            <ID>System.Performance.Library</ID>
            <Version>7.0.8427.0</Version>
            <PublicKeyToken>31bf3856ad364e35</PublicKeyToken>
          </Reference>
        </References>
      </Manifest>
      <Monitoring>
        <Rules>
          <Rule ID="Custom.Windows.OperatingSystem.PercentProcessorTime.AlertRule" Target="Windows!Microsoft.Windows.OperatingSystem" Enabled="true" ConfirmDelivery="false" Remotable="true" Priority="Normal" DiscardLevel="100">
            <Category>Alert</Category>
            <DataSources>
              <DataSource ID="DS" TypeID="Perf!System.Performance.DataProvider">
                <ComputerName>$Target/Host/Property[Type="Windows!Microsoft.Windows.Computer"]/PrincipalName$</ComputerName>
                <CounterName>% Processor Time</CounterName>
                <ObjectName>Processor</ObjectName>
                <InstanceName>_Total</InstanceName>
                <AllInstances>false</AllInstances>
                <Frequency>300</Frequency>
              </DataSource>
            </DataSources>
            <ConditionDetection ID="CD" TypeID="System!System.ExpressionFilter">
              <Expression>
                <SimpleExpression>
                  <ValueExpression>
                    <XPathQuery Type="Integer">Value</XPathQuery>
                  </ValueExpression>
                  <Operator>GreaterEqual</Operator>
                  <ValueExpression>
                    <Value Type="Integer">90</Value>
                  </ValueExpression>
                </SimpleExpression>
              </Expression>
            </ConditionDetection>
            <WriteActions>
              <WriteAction ID="Alert" TypeID="Health!System.Health.GenerateAlert">
                <Priority>1</Priority>
                <Severity>2</Severity>
                <AlertMessageId>$MPElement[Name="Custom.Windows.OperatingSystem.PercentProcessorTime.AlertRule.AlertMessage"]$</AlertMessageId>
                <AlertParameters>
                  <AlertParameter1>$Target/Host/Property[Type="Windows!Microsoft.Windows.Computer"]/PrincipalName$</AlertParameter1>
                  <AlertParameter2>$Data/Value$</AlertParameter2>
                </AlertParameters>
              </WriteAction>
            </WriteActions>
          </Rule>
          <Rule ID="Custom.Windows.LogicalDisk.PercentFreeSpace.AlertRule" Target="Windows!Microsoft.Windows.LogicalDisk" Enabled="true" ConfirmDelivery="false" Remotable="true" Priority="Normal" DiscardLevel="100">
            <Category>Alert</Category>
            <DataSources>
              <DataSource ID="DS" TypeID="Perf!System.Performance.DataProvider">
                <ComputerName>$Target/Host/Property[Type="Windows!Microsoft.Windows.Computer"]/PrincipalName$</ComputerName>
                <CounterName>% Free Space</CounterName>
                <ObjectName>LogicalDisk</ObjectName>
                <InstanceName>$Target/Property[Type="Windows!Microsoft.Windows.LogicalDevice"]/DeviceID$</InstanceName>
                <Frequency>300</Frequency>
              </DataSource>
            </DataSources>
            <ConditionDetection ID="CD" TypeID="System!System.ExpressionFilter">
              <Expression>
                <SimpleExpression>
                  <ValueExpression>
                    <XPathQuery Type="Integer">Value</XPathQuery>
                  </ValueExpression>
                  <Operator>Equal</Operator>
                  <ValueExpression>
                    <Value Type="Integer">8</Value>
                  </ValueExpression>
                </SimpleExpression>
              </Expression>
            </ConditionDetection>
            <WriteActions>
              <WriteAction ID="Alert" TypeID="Health!System.Health.GenerateAlert">
                <Priority>1</Priority>
                <Severity>2</Severity>
                <AlertMessageId>$MPElement[Name="Custom.Windows.LogicalDisk.PercentFreeSpace.AlertRule.AlertMessage"]$</AlertMessageId>
                <AlertParameters>
                  <AlertParameter1>$Target/Property[Type="Windows!Microsoft.Windows.LogicalDevice"]/DeviceID$</AlertParameter1>
                  <AlertParameter2>$Target/Host/Property[Type="Windows!Microsoft.Windows.Computer"]/PrincipalName$</AlertParameter2>
                  <AlertParameter3>$Data/Value$</AlertParameter3>
                </AlertParameters>
              </WriteAction>
            </WriteActions>
          </Rule>
        </Rules>
      </Monitoring>
      <Presentation>
        <Folders>
          <Folder ID="Folder_518fa734af1c42a582a7ece44eb4139d" Accessibility="Public" ParentFolder="SC!Microsoft.SystemCenter.Monitoring.ViewFolder.Root" />
        </Folders>
        <StringResources>
          <StringResource ID="Custom.Windows.OperatingSystem.PercentProcessorTime.AlertRule.AlertMessage" />
          <StringResource ID="Custom.Windows.LogicalDisk.PercentFreeSpace.AlertRule.AlertMessage" />
        </StringResources>
      </Presentation>
      <LanguagePacks>
        <LanguagePack ID="ENU" IsDefault="true">
          <DisplayStrings>
            <DisplayString ElementID="MP.For.Rule">
              <Name>MP For Rule</Name>
              <Description />
            </DisplayString>
            <DisplayString ElementID="Folder_518fa734af1c42a582a7ece44eb4139d">
              <Name>MP For Rule</Name>
            </DisplayString>
            <DisplayString ElementID="Custom.Windows.OperatingSystem.PercentProcessorTime.AlertRule">
              <Name>% Processor Time</Name>
              <Description>This task generates alert when % Processor Time counter reaches the threshold.</Description>
            </DisplayString>
            <DisplayString ElementID="Custom.Windows.OperatingSystem.PercentProcessorTime.AlertRule.AlertMessage">
              <Name>% Processor Time is too high.</Name>
              <Description>% Processor Time counter has reached the threshold on the computer {0}. The value is {1}.</Description>
            </DisplayString>
            <DisplayString ElementID="Custom.Windows.LogicalDisk.PercentFreeSpace.AlertRule">
              <Name>Logical Disk Free Space (%) Low</Name>
              <Description>This rule monitors the percentage of free space remaining on a logical disk.</Description>
            </DisplayString>
            <DisplayString ElementID="Custom.Windows.LogicalDisk.PercentFreeSpace.AlertRule.AlertMessage">
              <Name>Percentage Logical Disk Free Space is low</Name>
              <Description>The disk {0} on computer {1} is running out of disk space. The value that exceeded the threshold is {2}% free space.</Description>
            </DisplayString>
          </DisplayStrings>
          <KnowledgeArticles></KnowledgeArticles>
        </LanguagePack>
      </LanguagePacks>
    </ManagementPack>


    Vladimir Zelenov | http://systemcenter4all.wordpress.com

    • Marked as answer by GouravIN Wednesday, May 9, 2018 5:45 PM
    Wednesday, May 9, 2018 12:05 PM
  • Hello,

    This is what you need to do to get alerts for CPU usage and HD space low:

    1.  Create an MP for these monitors, if you do not have one already.

    2.  Go to the Authoring tab, and choose monitors.

    3.  Search for total cpu utilization.  In the results, look for the type of server, whether it's for Server 2003, 2008, 208 R2, or 2012.

    4.  Right click on Total CPU Utilization Percentage, and choose override for all objects of class:Windows Server XXXX.

    5.  Change the settings in the screens shots I provided.

    6.  Do the same thing for the HD monitor, which is Windows Server XXXX Logical Disk Free Space (MB) Low.  The monitor I have warns me when a server falls below 5GB and over 2GB.  It generates and error when it falls below 2GB.  You can change them to your liking.  They will post in Active Alerts, and you can have them e-mailed to you.

    7.  If you need the monitors for Windows Server 2003, 2008, 2008 R2, 2012, and 2016, you will have to override the monitor for each version.

    8.  Go to the Administration tab, and create a new subscription.  Add all of the monitors you modified into this subscription.

    9.  Download the Resource Kit tool called consume.exe.  You run this tool on the server, and it simulates, cpu usage, memory usage, HD full, etc.  You MUST copy it to the server you want to test.  It cannot be run from a share.

    Wednesday, May 9, 2018 2:01 PM
  • Hey,

    That's a very detailed answer indeed, but I think the question is a little different than that :)

    Cheers!


    Sam (Please take a moment to "Vote as Helpful" and/or "Mark as Answer" wherever applicable. Thanks!)

    Wednesday, May 9, 2018 2:06 PM
  • How so?
    Wednesday, May 9, 2018 2:11 PM
  • Hi,

    Sam was right here! I want alert on every sample after a given polling interval. So this task can not be achieved with monitor because once it will be in critical state that it will not critical alert for lower sample if any action has not taken by any team.

    So i am looking for Rule here, which Vladimir has given.


    Cheers, Gourav Please remember to mark the replies as answers if it helped.

    Wednesday, May 9, 2018 5:35 PM
  • Thanks for the MP and its XML,

    Request you to please check these two threads thread 1 and thread 2 of mine and share your thoughts on it.  


    Cheers, Gourav Please remember to mark the replies as answers if it helped.

    Wednesday, May 9, 2018 5:48 PM
  • Hello,

    So if you setup a monitor to poll a server, and it takes sample #1, and it's high, then you want an alert?  Is that what you are trying to achieve?

    Wednesday, May 9, 2018 6:43 PM
  • Hi,

    I want alert should be created on all samples after a given sample no matter Monitor is critical or healthy. 

    Suppose, i have set 80% for CPU now it breaches the condition and creates an alert and monitor is in critical state but after 300 seconds SCOM will check for another sample and if server is in par 80 like 85,87, etc. and monitor is already in critical state but now i want alert on it as well. And now monitor will write an alert coz its already in critical state. 

    Hope this clarifies!  


    Cheers, Gourav Please remember to mark the replies as answers if it helped.

    Thursday, May 10, 2018 4:55 AM
  • Hello,

    But servers CPU tend to spike sometimes when they are working.  I think you will get many false positives.  That's the purpose of samples.  If sample 1 is over 80%, then sample 2 is 5%, you will get a critical alert for no reason.  I have been using the default monitor for over a year, and I am happy with the settings.  If you try it, and run the consume.exe to test the monitor, you will see that you will be alerted within a few minutes from when the CPU is spiked.

    Thursday, May 10, 2018 12:58 PM
  • Hello,

    But servers CPU tend to spike sometimes when they are working.  I think you will get many false positives.  That's the purpose of samples.  If sample 1 is over 80%, then sample 2 is 5%, you will get a critical alert for no reason.  I have been using the default monitor for over a year, and I am happy with the settings.  If you try it, and run the consume.exe to test the monitor, you will see that you will be alerted within a few minutes from when the CPU is spiked.

    This is a great argument, and I agree with you completely. I've warned Gourav about this up front, but maybe his requirement is "very special". :)

    Either way, I think there's no point having a discussion on this over this thread, maybe we can open a separate "discussion thread" for this :)

    Cheers


    Sam (Please take a moment to "Vote as Helpful" and/or "Mark as Answer" wherever applicable. Thanks!)

    Friday, May 11, 2018 7:10 AM
  • Hi Vladimir,

    I have imported MP in SCOM but it didn't work. So to check this i have checked both the rules and what i found is there is no value in both rule. Could you please help me to fix this:-

    Please check the below screenshot:-

     


    Cheers, Gourav Please remember to mark the replies as answers if it helped.

    Wednesday, May 16, 2018 3:50 PM
  • Hi Vladimir,

    I have imported MP in SCOM but it didn't work. So to check this i have checked both the rules and what i found is there is no value in both rule. Could you please help me to fix this:-

    Please check the below screenshot:-

     


    Cheers, Gourav Please remember to mark the replies as answers if it helped.


    There is no overridable threshold values. Yes, I can add them. If it doesn't work check Operations Manager log on an agent.

    Vladimir Zelenov | http://systemcenter4all.wordpress.com

    Wednesday, May 16, 2018 7:45 PM
  • Hi Sir, 

    I have imported this and wait for couple of hours but no luck!

    And i have also changed the thresholds in XML to confirm but still same, no alert. Below is the XML after the threshold change;-

    <?xml version="1.0" encoding="utf-8"?>
    <ManagementPack SchemaVersion="2.0" ContentReadable="true" xmlns:xsd="http://www.w3.org/2001/XMLSchema">
      <Manifest>
        <Identity>
          <ID>MP.For.Rule</ID>
          <Version>1.0.0.7</Version>
        </Identity>
        <Name>MP.For.Rule</Name>
        <References>
          <Reference Alias="SC">
            <ID>Microsoft.SystemCenter.Library</ID>
            <Version>7.0.8427.0</Version>
            <PublicKeyToken>31bf3856ad364e35</PublicKeyToken>
          </Reference>
          <Reference Alias="Windows">
            <ID>Microsoft.Windows.Library</ID>
            <Version>7.5.8501.0</Version>
            <PublicKeyToken>31bf3856ad364e35</PublicKeyToken>
          </Reference>
          <Reference Alias="Health">
            <ID>System.Health.Library</ID>
            <Version>7.0.8427.0</Version>
            <PublicKeyToken>31bf3856ad364e35</PublicKeyToken>
          </Reference>
          <Reference Alias="System">
            <ID>System.Library</ID>
            <Version>7.5.8501.0</Version>
            <PublicKeyToken>31bf3856ad364e35</PublicKeyToken>
          </Reference>
          <Reference Alias="Perf">
            <ID>System.Performance.Library</ID>
            <Version>7.0.8427.0</Version>
            <PublicKeyToken>31bf3856ad364e35</PublicKeyToken>
          </Reference>
        </References>
      </Manifest>
      <Monitoring>
        <Rules>
          <Rule ID="Custom.Windows.OperatingSystem.PercentProcessorTime.AlertRule" Target="Windows!Microsoft.Windows.OperatingSystem" Enabled="true" ConfirmDelivery="false" Remotable="true" Priority="Normal" DiscardLevel="100">
            <Category>Alert</Category>
            <DataSources>
              <DataSource ID="DS" TypeID="Perf!System.Performance.DataProvider">
                <ComputerName>$Target/Host/Property[Type="Windows!Microsoft.Windows.Computer"]/PrincipalName$</ComputerName>
                <CounterName>% Processor Time</CounterName>
                <ObjectName>Processor</ObjectName>
                <InstanceName>_Total</InstanceName>
                <AllInstances>false</AllInstances>
    <Frequency>60</Frequency>
              </DataSource>
            </DataSources>
            <ConditionDetection ID="CD" TypeID="System!System.ExpressionFilter">
              <Expression>
                <SimpleExpression>
                  <ValueExpression>
                    <XPathQuery Type="Integer">Value</XPathQuery>
                  </ValueExpression>
                  <Operator>GreaterEqual</Operator>
                  <ValueExpression>
      <Value Type="Integer">20</Value>
                  </ValueExpression>
                </SimpleExpression>
              </Expression>
            </ConditionDetection>
            <WriteActions>
              <WriteAction ID="Alert" TypeID="Health!System.Health.GenerateAlert">
                <Priority>1</Priority>
                <Severity>2</Severity>
                <AlertMessageId>$MPElement[Name="Custom.Windows.OperatingSystem.PercentProcessorTime.AlertRule.AlertMessage"]$</AlertMessageId>
                <AlertParameters>
                  <AlertParameter1>$Target/Host/Property[Type="Windows!Microsoft.Windows.Computer"]/PrincipalName$</AlertParameter1>
                  <AlertParameter2>$Data/Value$</AlertParameter2>
                </AlertParameters>
              </WriteAction>
            </WriteActions>
          </Rule>
          <Rule ID="Custom.Windows.LogicalDisk.PercentFreeSpace.AlertRule" Target="Windows!Microsoft.Windows.LogicalDisk" Enabled="true" ConfirmDelivery="false" Remotable="true" Priority="Normal" DiscardLevel="100">
            <Category>Alert</Category>
            <DataSources>
              <DataSource ID="DS" TypeID="Perf!System.Performance.DataProvider">
                <ComputerName>$Target/Host/Property[Type="Windows!Microsoft.Windows.Computer"]/PrincipalName$</ComputerName>
                <CounterName>% Free Space</CounterName>
                <ObjectName>LogicalDisk</ObjectName>
                <InstanceName>$Target/Property[Type="Windows!Microsoft.Windows.LogicalDevice"]/DeviceID$</InstanceName>
    <Frequency>60</Frequency>
              </DataSource>
            </DataSources>
            <ConditionDetection ID="CD" TypeID="System!System.ExpressionFilter">
              <Expression>
                <SimpleExpression>
                  <ValueExpression>
                    <XPathQuery Type="Integer">Value</XPathQuery>
                  </ValueExpression>
                  <Operator>Equal</Operator>
                  <ValueExpression>
    <Value Type="Integer">50</Value>
                  </ValueExpression>
                </SimpleExpression>
              </Expression>
            </ConditionDetection>
            <WriteActions>
              <WriteAction ID="Alert" TypeID="Health!System.Health.GenerateAlert">
                <Priority>1</Priority>
                <Severity>2</Severity>
                <AlertMessageId>$MPElement[Name="Custom.Windows.LogicalDisk.PercentFreeSpace.AlertRule.AlertMessage"]$</AlertMessageId>
                <AlertParameters>
                  <AlertParameter1>$Target/Property[Type="Windows!Microsoft.Windows.LogicalDevice"]/DeviceID$</AlertParameter1>
                  <AlertParameter2>$Target/Host/Property[Type="Windows!Microsoft.Windows.Computer"]/PrincipalName$</AlertParameter2>
                  <AlertParameter3>$Data/Value$</AlertParameter3>
                </AlertParameters>
              </WriteAction>
            </WriteActions>
          </Rule>
        </Rules>
      </Monitoring>
      <Presentation>
        <Folders>
          <Folder ID="Folder_518fa734af1c42a582a7ece44eb4139d" Accessibility="Public" ParentFolder="SC!Microsoft.SystemCenter.Monitoring.ViewFolder.Root" />
        </Folders>
        <StringResources>
          <StringResource ID="Custom.Windows.OperatingSystem.PercentProcessorTime.AlertRule.AlertMessage" />
          <StringResource ID="Custom.Windows.LogicalDisk.PercentFreeSpace.AlertRule.AlertMessage" />
        </StringResources>
      </Presentation>
      <LanguagePacks>
        <LanguagePack ID="ENU" IsDefault="true">
          <DisplayStrings>
            <DisplayString ElementID="MP.For.Rule">
              <Name>MP For Rule</Name>
              <Description />
            </DisplayString>
            <DisplayString ElementID="Folder_518fa734af1c42a582a7ece44eb4139d">
              <Name>MP For Rule</Name>
            </DisplayString>
            <DisplayString ElementID="Custom.Windows.OperatingSystem.PercentProcessorTime.AlertRule">
              <Name>% Processor Time</Name>
              <Description>This task generates alert when % Processor Time counter reaches the threshold.</Description>
            </DisplayString>
            <DisplayString ElementID="Custom.Windows.OperatingSystem.PercentProcessorTime.AlertRule.AlertMessage">
              <Name>% Processor Time is too high.</Name>
              <Description>% Processor Time counter has reached the threshold on the computer {0}. The value is {1}.</Description>
            </DisplayString>
            <DisplayString ElementID="Custom.Windows.LogicalDisk.PercentFreeSpace.AlertRule">
              <Name>Logical Disk Free Space (%) Low</Name>
              <Description>This rule monitors the percentage of free space remaining on a logical disk.</Description>
            </DisplayString>
            <DisplayString ElementID="Custom.Windows.LogicalDisk.PercentFreeSpace.AlertRule.AlertMessage">
              <Name>Percentage Logical Disk Free Space is low</Name>
              <Description>The disk {0} on computer {1} is running out of disk space. The value that exceeded the threshold is {2}% free space.</Description>
            </DisplayString>
          </DisplayStrings>
          <KnowledgeArticles></KnowledgeArticles>
        </LanguagePack>
      </LanguagePacks>
    </ManagementPack>

    Please help to fix this :)


    Cheers, Gourav Please remember to mark the replies as answers if it helped.

    Thursday, May 17, 2018 4:43 AM
  • I found the problem. Just replace in text editor this

    Type="Integer"

    on this:

    Type="Double"


    Vladimir Zelenov | http://systemcenter4all.wordpress.com

    Friday, May 18, 2018 3:44 PM
  • Thanks a ton Sir!

    Changed the code and it worked partially ( only for CPU alert )

    It is not generating alert for disk, I thought we need to change this condition

    <Operator>Equal</Operator>
                  <ValueExpression>
                    <Value Type="Integer">8</Value>

    Since we are only using equal it should be lesserequal or else?

    Please suggest where i need to do changes for getting disk alert.


    Cheers, Gourav Please remember to mark the replies as answers if it helped.

    Tuesday, May 22, 2018 9:02 AM
  • Thanks a ton Sir!

    Changed the code and it worked partially ( only for CPU alert )

    It is not generating alert for disk, I thought we need to change this condition

    <Operator>Equal</Operator>
                  <ValueExpression>
                    <Value Type="Integer">8</Value>

    Since we are only using equal it should be lesserequal or else?

    Please suggest where i need to do changes for getting disk alert.


    Cheers, Gourav Please remember to mark the replies as answers if it helped.


    Sure, should be LessEqual.

    Vladimir Zelenov | http://systemcenter4all.wordpress.com

    Tuesday, May 22, 2018 11:11 AM