Single Server View
The other month I wrote about views and how to use them to help focus on particular areas. One of the views that I sometimes want to create is for a single server to get a feel for all the alerts that are being generated by that server. In MOM 2005 it was trivial to create a view like that but with 2007 it is much harder with the object orientated nature of the product. You can, however, use the server name as a filter for a State view but not an Alert view.
Here are some ways I look at getting around the problem.
1 – Create a view using “Raised by an instance with a specific name”
2 – Create a view using the server name as part of the search “With specific text in the description”
3 – Create a computer group with that server as the only member (in fact I searched for the computer name and put all objects that were returned in the computer group) and create a view based on Entity but filtered with that computer group
The first one is closest to filtering on server name but it is not 100% as not all sources include the server name and in my test that server showed 12 alerts. The second one works better than I thought as even though the alert description does not appear to contain the server name it still picks up alerts from that server but still only came back with 9 alerts. The last one was the most comprehensive and picked up alerts from both other views (20 alerts) but it is a bit of a pain to create a computer group just for a single server. Perhaps that is something that a future version could do. Automatically create a computer group for each server and keep it up to date with all the relevant objects for that server.
In the end I suddenly realised that I could search on the list of alerts for that computer! And that came back with 20 alerts. So it looks like the easiest and simplest way to get a list of alerts from a single server is to use the server name in the search box for an alert view. However when I used the same server name in the search box in the main Active Alerts view rather than the one I had created in my workspace it only returned 18 alerts although in essence the views were the same. I did change it so it was exactly the same but my alert view still showed 20 alerts to the main Alert View showing 18. The main view did not pick up alerts where the source was sysvol or netlogon whereas the view I had created to mimic that view with the similar properties (just personalised differently) did pick those 2 alerts up. Very strange. I guess the moral is be careful when creating views as what you use to filter may filter more than you want.