Archive / December, 2007

Drastically reduce alert noise in SCOM

I noticed a way to reduce our alert noise by up to about 80%. This may seem very obvious but it wasn’t to me till after I realized it.

In my environment we are using a ton of different applications by various software vendors. Some of these applications automatically restart their windows services during the day and night. Other times we will get a heartbeat notification in the middle of the night.

With the majority of these notifications we will get an open and then a closed alert almost immediately. In my environment SCOM is setup to send an SMS alert to the on-call admin. This meant that the on-call admin would often be getting woken up in the middle of the night for an issue that automatically resolved itself.

I wanted to reduce the number of alerts that the on-call person (which is sometimes me). I came up with the idea to set alert aging on initial alert by 5 minutes.

We were already using alert aging for escalation but by aging the initial alert drastically reduced the number of alerts that the on-call person gets. The majority of the Open and Closed alerts are no longer bothering the on-call person in middle of the night

 

 

 

 

 

 

Being that SCOM is state based anything that is really down or causing an issue will still page the on-call person.

SCOM 2007 Targeting

A new SCOM 2007 targeting poster has been posted to help everyone understand targeting.

http://download.microsoft.com/download/f/a/7/fa73e146-ab8a-4002-9311-bfe69a570d28/BestPractices_Rule_Monitor_REV_110607.pdf

To sum it up

Target all new monitors at Windows Server or one of the targets that Microsoft has created such as IIS or SQL Servers.

Set the rule to be disabled by default.

Create an override that will enable the rule only for the computers or group of computers you want the monitor to run on.

Here are a couple of KB articles that describe this.

http://support.microsoft.com/kb/938999/en-us

http://support.microsoft.com/kb/943239

SCOM 2007 Script to Monitor File Count inside a Directory

Below is a script that I wrote to monitor file count in a directory.

To Implement this please reference my earlier post on how to setup a Script-Based monitor.  http://www.scom2k7.com/create-a-script-based-unit-monitor-in-opsmgr2007-via-the-gui/

In the Parameters: Dialog box you will need to specify a directory path in quotes then a space and the type in the number of files you what to have in your directory before you want to alarm.

For Unhealthy Expression: Property[@Name='State'] Equals BAD

For Healthy Expresion: Property[@Name='State'] Equals GOOD

‘ Script Start

Dim oAPI, oBag, objFSO, objFldr, bSendError, strOut

bSendError = False

Set oAPI = CreateObject(“MOM.ScriptAPI”)
Set oBag = oAPI.CreateTypedPropertyBag(StateDataType)
Set eBag = oAPI.CreateTypedPropertyBag(StateDataType)
Set oArgs = WScript.Arguments

If oArgs.Count < 2 Then
strReturn = “Script aborted. Not enough parameters provided”
Call eBag.AddValue(“State”,”BAD”)
Call eBag.AddValue(“ret”,strReturn)
Call oAPI.Return(eBag)
WScript.Quit -1
End If 

strOut = checkfolder(oArgs(0),int(oArgs(1)))

If bSendError Then
 strReturn = strOut
 Call oBag.AddValue(“State”,”BAD”)
 Call oBag.AddValue(“ret2″, objFldr.Files.Count)
 Call oBag.AddValue(“ret”,strReturn)

 
Else
 ’WScript.Echo(“GOOD “& vbNewLine &  strOut)
 Call oBag.AddValue(“State”,”GOOD”)
 
End If
if 0 <> Err.number Then
    strReturn = “An Error occured: ” &  Err.Description
    Call eBag.AddValue(“State”,”BAD”)
    Call eBag.AddValue(“ret”,strReturn)
    Call oAPI.Return(eBag)
else

Call oAPI.Return(oBag)

end if
Function checkfolder(strfldname,numberfiles)

Set objFSO=CreateObject(“Scripting.FileSystemObject”)
Set objFldr=objFSO.GetFolder(strfldname)
If objFldr.Files.Count > numberfiles Then

checkfolder = numberfiles
bSendError = True

End If

End Function

‘Script End

http://www.scom2k7.com/downloads/FolderFileCount.txt