Not receiving alerts via SCOM Connector for alerts which OPEN and CLOSE very quickly. Only getting CLOSE RRS feed

  • Question

  • We use a SCOM connector (2012 R2) to receive alerts and all works fine, until we get a alert OPEN and CLOSE in a very small space of time. In this case, we only receive the CLOSE. 

    Is this normal functionality/limitation? Is there any way to force SCOM to send both? 

    Many thanks

    Adam Smith

    Wednesday, October 17, 2018 1:29 PM

All replies

  • Hi,

    I've witnessed this behaviour before and i think it's because the Open alert gets "overridden" by the closed before it gets processed by the connector or email subscription.

    I'm not very sure about the technical reasoning of it however.


    Sam (Please take a moment to "Vote as Helpful" and/or "Mark as Answer" wherever applicable. Thanks!) Blog:AnalyticOps Insights Twitter:Sameer Mhaisekar

    Wednesday, October 17, 2018 2:55 PM
  • What sort of monitors are generating this problem? What's the threshold, polling interval, etc?

    "Fear disturbs your concentration"

    Wednesday, October 17, 2018 3:43 PM
  • What specific monitors are actually doing this and what connector are you using? One workaround could be to set them to a certain resolution state when it turns to new, then that may get captured in your connector first hand. Then again the polling interval on your connector could maybe be tweaked to pick them up
    Wednesday, October 17, 2018 6:47 PM
  • Thanks for all the useful replies. 

    I think the OPEN/CLOSE scenario might be valid for most of these scenarios.

    We did however see one OPEN/CLOSE event, and only received CLOSE event 20 minutes after the OPEN. 

    This is a Product Connector we have created to forward SCOM events to a 3rd party tool 

    Thursday, November 8, 2018 10:45 AM
  • Have you tried to stagger your alerts where you get one open alert forwarded through your connector and make sure that it doesnt close so you can see it through yours logs/product connector?
    Then once you do that close it and see how long it takes.

    If yours is taking 20 minutes there would either be lag between your connector and the SCOM database, or do you have similar issues with SCOM in general?

    Friday, November 9, 2018 3:36 PM