none
Is SCOM autoclosing rules? RRS feed

  • Question

  • Hi,

    Bear with me, a somewhat complicated story here.

    One of our servers ASR booted two some days ago but we didn't notice it (the Heartbeat Failure and Failed to Connect to Computer went from new to close and thus we didn't see it because our View only shows New alerts).

    Although, since it was an ASR boot, our "HP Windows (WMI ASR reboot occorued."-alert should trigger, and it did! But somehow it went to Closed immediatley with no sign on who closed it. So the question is, why did SCOM close it automatically? Since its a rule, no auto-resolve is configured (screenshots attached below).

    We also have a custom rule that reacts on Eventid 6008 in the System log (The previous shutdown at xx:xx:xx on xxxx-xx-xx was unexpected) that is also set to Closed with no trace on who actually Closed it.

    Also - we received the "SQL Server Broker disabled"-alert two days before all this, could that have something to do with it?

    Thanks for your help.

    Wednesday, February 17, 2016 7:04 AM

Answers

  • Hello,

    Rules cannot automatically resolve alerts. I suppose those alerts are fired by monitor instead of rules. Heartbeat failure is kind of monitor which can fire alerts.

    You may open the details of the closed alert to check whether it is fired by rule or monitor.

    In addition, here is a setting in SCOM to set automatic Alert Resolution, such as resolve active alerts when the alert source is healthy after X days:

    https://technet.microsoft.com/en-us/library/hh212897.aspx

    Regards,

    Yan Li


    Please remember to mark the replies as answers if they help and unmark them if they provide no help. If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com.

    Thursday, February 18, 2016 6:15 AM
    Moderator
  • All rule alerts cannot be auto-resolute except it is closed by the automatic alert reolution setting in Management Group. Please check
    1) whether the alert is generated by monitor or rule: Select the closed alert and view detail pane in which will show the alert is generated by alert monitor or alert rule
    2) Open the alert and view it history tab to check the who resolved the alert
    3) check the alert reolution setting under Administration workspace --> Settings --> Alerts --> Automatic Alert Resolution tab --> Resolve all active alerts in the new resolution state after(by default is 30 days)

    Roger

    Thursday, February 18, 2016 8:00 AM

All replies

  • Hello,

    Rules cannot automatically resolve alerts. I suppose those alerts are fired by monitor instead of rules. Heartbeat failure is kind of monitor which can fire alerts.

    You may open the details of the closed alert to check whether it is fired by rule or monitor.

    In addition, here is a setting in SCOM to set automatic Alert Resolution, such as resolve active alerts when the alert source is healthy after X days:

    https://technet.microsoft.com/en-us/library/hh212897.aspx

    Regards,

    Yan Li


    Please remember to mark the replies as answers if they help and unmark them if they provide no help. If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com.

    Thursday, February 18, 2016 6:15 AM
    Moderator
  • All rule alerts cannot be auto-resolute except it is closed by the automatic alert reolution setting in Management Group. Please check
    1) whether the alert is generated by monitor or rule: Select the closed alert and view detail pane in which will show the alert is generated by alert monitor or alert rule
    2) Open the alert and view it history tab to check the who resolved the alert
    3) check the alert reolution setting under Administration workspace --> Settings --> Alerts --> Automatic Alert Resolution tab --> Resolve all active alerts in the new resolution state after(by default is 30 days)

    Roger

    Thursday, February 18, 2016 8:00 AM
  • Thank you, I'll check that out.
    Thursday, February 25, 2016 9:15 AM