Subscription Issues

The organisation I am currently working with has used Alert rules in MOM 2005 to create an event on the management servers when a new alert comes in. There is an agent from their framework package that picks up these events. This is an old trick from the MOM 2000 days but works remarkably well if you just want a one way connection. You have to remember to clear the alert when the incident is fixed otherwise if it happens again it will increment the repeat count and not fire the alert rule.

They want to carry on doing that with 2007 but there are no Alert rules. The obvious place to start is with subscriptions. As their old script created an event then the command notification is the pace to start. Using the command notification channel has been posted by Steve Rachui and using it with eventcreate has been posted by Stefan Stranger and

I used a number of parameters that went into the description field and the framework could pull those out and put them into the fields they wanted. However a few rules got the Alert Source parameter the wrong way around so the computer name and the object were swapped around. Therefore the Managed Entity (aka computer name) is wrong. Not great when you are automating these especially as the 2 main culprits are for agent heartbeat.

The Agent Source parameter is $Data/Context/DataItem/ManagedEntityPath$\$Data/Context/DataItem/ManagedEntityDisplayName$ which normally turns into something like w2k302.domain.co.uk\Microsoft(R) Windows(R) Server 2003 Standard x64 Edition

But for “Health Service Heartbeat Failure”  and “Failed to Connect to Computer” you get it the wrong way around Microsoft.SystemCenter.AgentWatchersGroup\w2k301.domain.co.uk

And in SQL 2005 Percentage Change in DB % Used Space part of the object is tagged to the ManagedEntityPath so you get w2k301.domain.co.uk;MSSQLSERVER returned.

This can be verified by creating a console view with Path and Source as the columns.

The eventcreate notification does the job except for monitors without alerts. Subscriptions are only triggered by alerts. There are some monitors that do not create alerts and worse they do not allow you to override that parameter. So if you are relying on notifications by e-mail, SMS or in this case events triggering the framework to create a ticket there will be some monitors that you will not get.

This is a problem that I discovered in the early betas and noted in my post about RC2 so it has been around a while. Some monitors do not create alerts but change the health of the state view. All rules create alerts but there is no way to have a column in the state view to show the effect they are having on the server so there is no one view that displays the total health of the estate. The only option that Microsoft could come up with is to use a Dashboard view with both views in it. Not great.

Stefan Stranger has confirmed this and the feedback from the Product Group is that this is “by design”. The trouble with that is that if you are not looking at the console you will not get the health state change as there is no alert. And as these are not documented that is not good. Even worse if you can not overrode them. In which case if you want that alert you need to disable the original monitor and recreate a new custom one (if you can).

Stefan sent these PS scripts to help which I amended as it is only unit monitors that are the issue. It does not matter that rollup or aggregate monitors do not alert.

get-monitor | where { ($_.AlertSettings -eq $null) -and ($_.xmltag -eq “UnitMonitor”) } | sort displayname

get-monitor | where { ($_.AlertSettings -eq $null) -and ($_.xmltag -eq “UnitMonitor”) } | export-csv c:\unitmonsno.csv

To get a list of monitors that do alert change the first -eq in the line to -ne.

get-monitor | where { ($_.AlertSettings -ne $null) -and ($_.xmltag -eq “UnitMonitor”) } | export-csv c:\unitmonsalerts.csv

When I run these on the management group there were 168 monitors without alerts (mainly from IIS 5 and 6 MPs) and 615 with alerts. That is why I switched  from display on screen to CSV.

You can also use MP Viewer to look at each MP. This has the ability to sort columns and you can see which ones are set not to alert. You can then make a decision on whether or not to do something about it.

I also have a problem with the way recipients and subscriptions are done but that is another post!

Advertisements

Comments are closed.

%d bloggers like this: