« Blogging 3 yearsOperations Manager Internal Connector »

11 comments

  1. § Sven Email said on :
    Hello,
    I tried using your script on our only SCOM 2007 R2 environment. It's fairly small, only about 86 agents at this time.

    At the moment there are about 40 New/Open rule-based alerts that are at least 2 weeks old.

    I thought your poweshell script would be ideal for this.

    When I run the script directly on the RMS, the output on the screen shows:

    Windows PowerShell
    Copyright (C) 2009 Microsoft Corporation. All rights reserved.

    PS C:\Windows\system32> C:\Windows\system32\windowspowershell\v1.0\CloseOldAlertsFromRules.ps1

    PathName :
    ManagementGroup : PPDI
    ManagementServerName : wilscrms001.americas.ppdi.local
    Drives :

    PS Microsoft.EnterpriseManagement.OperationsManager.Client\OperationsManagerMonitoring::wilscrms001.americas.ppdi.local>

    The old alerts never close and nothing else comes up.

    Am I missing something?

    Thanks,
    Sven
  2. § Bob Cornelissen® Email said on :
    *****
    Hi Sven,
    Just to be sure first try to see if your console is not trying tricks on you. Check out this old post: http://www.bict​t.com/blogs/bic​tt.php/2011/05/​26/scom-trick-1​0-scom-console
    Perhaps its just a cache thing why you are seeing these.

    Next thing I can think of... my script closes alerts coming from RULES, and not monitors. If you open the script you will quickly see where that is. Normally you would not close alerts from monitors as they should close themselves, however there are exceptions such as manual reset monitors. In those cases you can just adjust IsMonitorAlert=​''False'' to true. You can see quickly enough if the alerts come from rules or monitors from the SCOM console.

    Let me know if these two things help you.
  3. § Sven Email said on :
    Hello again,

    Yup, I've already got the /clearcache option in the Console startup shortcut.

    Also, the Open/New Alerts I'm looking to remove are definitely Rule Alerts. There is a mix of Critical and Warning alerts, and the Alert Details clearly state "Alert Rule:". The majority of the Alerts are Active Directory alerts produced by the Active Directory MP.

    One other thing, I ran this script directly on the RMS in question, just in case running it from my desktop was an issue.

    Regards,
    Sven
  4. § Bob Cornelissen® Email said on :
    One more thing I can think of is if the alerts have been changed to another resolution state. You see my script picks up the ones with resolution state 0 (New). Otherwise there might be something else blocking.
  5. § Sven Email said on :
    Yes, I noticed the verbiage in the script for resolution state. All the alerts I am interested inon my console are in a New state.

    One other question, is this script complaint for both SCOM 2007 SP1 and SCOM 2007 R2, or just one?

    Sven
  6. § Bob Cornelissen® Email said on :
    I have not tried it in an 2007 SP1 actually. I think it should work. I do know that it does not work with SCOM 2012 as they have changed things.
    You could try to run the command from an opsmgr shell session. And leave out the last bit of the command (where it close3s the alert) and output that to the screen. Make the time not 24 hours but 1 hour, so you can try to see if any of the more recent new alerts from rules show up in your screen and hopefully the old ones as well. CHeck to see if a more recent alert will close with the script. That it is only the very old ones which keep nagging.
  7. § chris said on :
    **---
    def does not work in scom 2012. also the where needs -ge. resolve-scomalert doesn't do it, it just modifies it and sends it back out the channel. for 2012 use set-scomalert.
  8. § Bob Cornelissen® Email said on :
    HI Chris, The article says it is for SCOM 2007 version.
    The 2012 version can be found here http://www.bictt.com/blogs/bictt.php/2012/12/22/scom-2012-close-old-alerts
  9. § HKA Email said on :
    **---
    Hi Bob,
    Tried your script on SCOM 2007 R2 and seems it is not working. I tried to check without the close alert option and it does list the open alerts from rules. However nothing happens when I run the complete command.
  10. § Bob Cornelissen® Email said on :
    Thats strange HKA, I have been using this at several customer sites.
  11. § Bob Cornelissen® Email said on :
    Also if you keep seeing alerts there, try to check again for the alerts from rules in New state (rsolutionstate = 0) and see if they are still there. Because at times you might see them in the scom console when they are not there anymore. in that case close the console and re-start it with the /clearcache option.

Leave a comment

You must be a member of this blog to comment. Log in now!

Contact / Help. ©2014 by Bob Cornelissen. open source blog.
Design & icons by N.Design Studio. Skin by Tender Feelings / Evo Factory.