locked
Identifying all enabled, alert-generating rules and monitors with an alert priority setting of ‘High’ RRS feed

  • Question

  • Good day,

     

    The Goal To identify all enabled, alert-generating rules and monitors with an alert priority setting of ‘High’.

     

    As per thread http://social.technet.microsoft.com/Forums/en-US/operationsmanagerextensibility/thread/6ee7b278-e16a-41cb-b026-78c1200ac3b3, the following query displays the count of each alert-generating rule & monitor associated to each MP:

     

    Rules

    ForEach ($MP in Get-ManagementPack) {$MP | Select @{Name="MP"; Expression= {$MP.Name}}, @{Name="Count"; Expression= {Foreach-Object {($MP.GetRules() | Where-Object {$_.WriteActionCollection -Match "Alert" -And $_.Enabled -Ne "False"}).Count}}}}

     

    Monitors

    ForEach ($MP in Get-ManagementPack) {$MP | Select @{Name="MP"; Expression= {$MP.Name}}, @{Name="Count"; Expression= {ForEach-Object {($MP.GetMonitors() | Where-Object {$_.AlertSettings -ne $null -And $_.Enabled -Ne "False"}).Count}}}}

     

    Question #1

     

    Though I was able to modify the command to further limit the scope to monitors that raise alerts with a priority of ‘High’, I am unable to do the same with rules.  The rule’s ‘Priority’ attribute does not reflect ‘Priority’ setting of the corresponding alert.  Also, there is no ‘AlertSettings’ field that I can query to get the ‘AlertPriority’ setting as is the case with monitors.

    Question #2

     

    As mentioned in the aforementioned thread:

     

     

     

    "And as far as using (-match "GenerateAlert") for rules, this will work except when a composite module has been created that wraps the GenerateAlert action, therefore not necessarily having "GenerateAlert" in the text of the PS object."

     

    Can the command be modified in such a way as to identify the monitors & rules that employ composite modules that wrap the Alert action?  Otherwise, is there a way to list each monitor & rule that leverages composite modules, such that they may be inspected by hand?

     

    Question #3

     

    I have come up with the following command that lists each of the enabled, alert-generating (with a ‘High’ priority) monitors:

     

    ForEach-Object ($objManagementPack in Get-ManagementPack)

    {

    ForEach-Object ($objMonitor in $objManagementPack.GetMonitors() | Where-Object {$_.AlertSettings -ne $null -And $_.Enabled -Ne "False" -And $_.AlertSettings.AlertPriority -eq 'High'})

    {

    $objMonitor | Select

    @{Name="MP"; Expression= {$objManagementPack.Name}},

    @{Name="Monitor"; Expression= {$objMonitor.DisplayName}},

    @{Name="Target"; Expression= {$objMonitor.Target}},

    @{Name="Category"; Expression= {$objMonitor.Category}},

    @{Name="Alert Severity"; Expression= {$objMonitor.AlertSettings.AlertSeverity}},

    @{Name="Alert Priority"; Expression= {$objMonitor.AlertSettings.AlertPriority}},

    @{Name="Auto Resolve"; Expression= {$objMonitor.AlertSettings.AutoResolve}} | Format-Table

    }

    }

     

    The resulting output is such that a separate table is created for each monitor, rather than a single table with all monitors.  How can I create a single collection that is then piped over to Format-Table?

     

    Thanks,

     

    Larry

    Monday, June 7, 2010 3:43 PM

Answers

  • Hi. No activity for 30 days. Will mark as answer. Feel free to re-open. Thanks
    Anders Bengtsson | Microsoft PFE | blog at http://www.contoso.se
    Friday, December 31, 2010 9:50 AM