none
SCOM 2019 - Monitoring question RRS feed

  • Question

  • Hello,

    I've installed SCOM 2019 for the first time, imported some MPs and added some servers to be monitored by it.

    When I go to Monitoring > Windows Computers, I can one of my AD has the following warning:

    Making more testing seems to indicate there should be more warning that should be listed because if I go the Health Explorer for that same machine, I can see this:

    My question is: why this dhcp warning doesn't appear as a warning for that server in the Monitoring section ?

    Should I do something more than adding MPs  (maybe a configuration is required for them ?).

    Thank you by advance for all help you could provide.

    Have a good day.


    • Edited by dd-cges Tuesday, November 12, 2019 10:15 AM added images
    Tuesday, November 12, 2019 10:12 AM

All replies

  • Hi,

    The Windows Computers view does not show alerts - it shows health state of an object (for example a computer, a database, a service). It is not synchronized with for example the Active Alerts view.

    When a monitor is triggered, it changes the state of the object being monitored, so for example it might generate an alert, but it depends on the monitor.


    Best regards,
    Leon



    Blog: https://thesystemcenterblog.com LinkedIn:

    Tuesday, November 12, 2019 1:57 PM
  • First, thank you for your reply.

    I might be missing something (sorry if that's the case) but when I double click on the computer that has a warning or error icon, I used to see the list of unhealthy child monitors and so I was expected to see that there too (which is not the case there).

    If I take my example back, the DHCP warning doesn't appear neither in the Active Alerts view.

    Any idea on why ?

    Thanks.

    Tuesday, November 12, 2019 2:21 PM
  • The DHCP management pack creates its own folders and views, do you see it in the Active Alerts over there?


    Blog: https://thesystemcenterblog.com LinkedIn:

    Tuesday, November 12, 2019 3:01 PM
  • Hello,

    I can find it in that folder tree but under Component Health; not in Active Alert.

    Is there a way to simply see an overview of all warnings and errors for a monitored server ? I can't imagine we have to go under every health object in every MP folder tree.

    Thanks again for your help.

    Tuesday, November 12, 2019 4:20 PM
  • Is the monitor actually still in a warning state?

    If you right-click the DHCP Server 2016 and 1709+ IPV4 Individual Scope Addresses Available Percentage Monitor and select Open > Health Explorer, what is the status of the monitor?

    Sometimes the alert might not disappear immediately from the Operations Console, even though the monitor has been automatically resolved, closing the console or clearing the console's cache might help.


    Blog: https://thesystemcenterblog.com LinkedIn:

    Tuesday, November 12, 2019 5:13 PM
  • Hello,

    I found that monitor in another location but I think it's not an issue.

    I nevertheless can't Open the Health Explorer.
    If I click on an item on the right, I can select "Tasks > Health Explorer" and this leads to this:

    As I've never configured SCOM from scratch, I don't know if there's anything to do in order to have a single view of all of the warnings and errors (without having to check all sub-items for each monitor) for specific monitored servers.

    Thanks.

    Wednesday, November 13, 2019 1:33 PM
  • You first need to understand the difference between monitors and alerts.

    • Monitors are the "components" that run the actual monitoring actions (read event log, run powershell script, get performance data from perfmon counter, whatever).
    • What you see in the health explorer is the state of the monitors that are targetting the object for which you opened the health exporer.
    • A monitor usually (but not necessarily, it depends on how it is configured) creates an alert when it changes state from "healthy" to "warning" or "critical".
    • You can view all alerts from all objects in the "Active Alerts" view, at the top of the monitoring panel, but you can't see all monitors in one central location... that wouldn't make much sense anyway.
    • Edited by CyrAz Wednesday, November 13, 2019 3:02 PM
    Wednesday, November 13, 2019 1:40 PM
  • Hello,

    I think I understand.

    The part that I'm not sure is when you say that a monitor doesn't necessarily  creates an alert when the state change from healthy to something else. In the example I presented above, the monitor is in a warning state but the warning listed is not listed in the Active Alerts.

    You're right when you say it's should not be necessary to monitor monitors but I kind of expect it to rise something somewhere in the Active Alerts (or at least somewhere that is central like Active Alerts).

    Or maybe I didn't get something.

    The way I used an old version of SCOM in the past was:
    - Checking the state of monitored machines in Windows Computers. I liked the fact that you could then recalculate health after actions to see if it fixed the issue for a faulty server
    - Checking the Active Alerts and close errors then.

    Would you say I should only check Active Alerts and manually close them when I think I fixed the issue that triggered the error ?

    Thank you again for your help, I very appreciate.

    Thursday, November 14, 2019 10:50 AM
  • If you open the properties of a monitor, you will find an "Alerting" tab. The default and most common behavior is to have alerting enabled for a monitor, but there is no obligation for that.
    That being said, it looks like alerting is indeed enabled by default for the "DHCP Server 2016 and 1709+ IPV4 Individual Scope Addresses Available Percentage Monitor" monitor, BUT there may be an override disabling alerting in your environment. You can check this in the "Overrides" tab > view summary.

    For your other questions : 

    • You still can do that, but note that this will only let you see the health state of windows computers. Which means a few things : you can't see the health state of other objects that do not rollup to windows computers (unix computers, network monitoring, URL monitoring, various kinds of "unhosted" applications...). That will also prevent you from seeing alerts that come from rules instead of monitors. Last but not least, note that the "recalculate" button doesn't do anything most of the time : it needs some specific code implemented in the MP, and a large majority of them don't implement such code.
    • In SCOM 2019, you can't close an alert that comes from a monitor if that monitor is still unhealthy. So you should fix the problem and wait for the monitor to return to Healthy, which will in turn automatically close the alert; or manually force the monitor to reset to healthy.
    Thursday, November 14, 2019 11:19 AM