Subscriptions getting automatically disabled

I recently ran across and issue where our notification subscriptions were getting disabled every 30 minutes.  The strange thing was that only about half of our subscriptions were being disabled and they were the same subscriptions every time.  I tried re-enabling them with both with Powshell as well as the GUI and had the same result, subscriptions kept being disabled.  After digging through event logs I found this warning.
 

Log Name:      Operations Manager
Source:        Health Service Modules
Event ID:      11452
Task Category: None
Level:         Warning
 

Validate alert subscription data source module encountered an alert subscription data source with configuration that has gone out of scope. Disabling the alert subscription data source module.

Alert subscription name: Subscriptionaca6a276_e5a9_446b_9751_0ea539168e41

One or more workflows were affected by this. 
Workflow name: Microsoft.SystemCenter.ValidateAlertSubscription

 

The problem turned out to be that we recently cleaned up the SCOM Admins user group.  One of the users removed from the group had created half of the subscriptions.  By putting the user back in the SCOM Admins group and re-enabling the subscriptions the problem was solved.  But we really didn’t want this user in the SCOM Admins group as he had moved on to a different role. 

So why was this happening?    When a subscription is created the user who created the subscriptions SID is associated with that subscription.  There is a workflow that checks every half hour for SIDs no longer valid.  They could be invalid because their accounts access that had been removed, or possibly because the account has been disabled or deleted.

To fix it long term I had to export the “Microsoft.SystemCenter.Notifications.Internal” management pack.  This management pack is unsealed and contains all subscriptions.

Inside the management pack I searched for one of the subscriptions that were being disabled and one that was wasn’t.  I then replaced the SID of the bad subscription with the SID of the good subscription.

After doing replacing the SIDs I re-imported the management pack and re-enabled all subscriptions and the problem was solved for good.

Here is an example of one of the SIDs I had to replace.

 

</Criteria>
<ExpirationStartTime>10/11/2008 21:38:45</ExpirationStartTime>
<PollingIntervalMinutes>1</PollingIntervalMinutes>
<UserSid>S-1-5-21-3273141924-712819414-2074229892-500</UserSid>
<LanguageCode>ENU</LanguageCode>
<ExcludeNonNullConnectorIds>false</ExcludeNonNullConnectorIds>
<RuleId>$MPElement$</RuleId>

10 Responses to Subscriptions getting automatically disabled

  1. Ron Hagerman January 15, 2009 at 1:14 pm #

    Another way to fix this problem is to touch the offending subscriptions. If you change any property in the subscription and then change it back after saving it, the SID then gets tied to your user ID and problem solved.

    What we do where I’m at is we have a policy in place that basically states all subscriptions will be created using the SDK account only. This fixed our problem long term

    Regards,

    Ron Hagerman
    Product Manager – Microsoft System Center Operations Manager 2007
    The Boeing Company

  2. admin January 15, 2009 at 2:06 pm #

    Ron, I tried this and it didn’t seem to help. The only way I have found is manually editing the XML or Re-Creating them.

  3. manamonos May 26, 2009 at 5:24 pm #

    The only thing that works is editing the XML or Re-creating them. I had a hard time finding out which SID went with which subscription. I had to make all the SIDs the same.. then wait till they all the subscriptions went to false after 30 min. Then I created a temp subscription. I went into the xml and then copied and replaced all the SIDs with the temp SID. Works great so far. Thanks.

  4. dominique September 28, 2009 at 8:17 pm #

    Hello,

    I could not find the Management Pack “Microsoft.SystemCenter.Notifications.Internal” did it get renamed?
    Each 30 minutes the Exchange Subscriptions got disabled…

    Thanks,
    Dom

    • Tim September 28, 2009 at 8:27 pm #

      I see it now in R2 as Notifications Internal Library

  5. dominique October 15, 2009 at 3:43 pm #

    Thanks Tim. I got it now and I did the changes I will check if the subcriptions remain active now…
    All subscriptions have been enabled.

    Thanks,
    Dom

  6. James Longmire October 8, 2010 at 2:09 am #

    Having read through the thread on this I have found the workarounds work well. Having said that is anyone aware if Microsoft going to provide a fix for this. Our security model stipulates a unique admin account for each System Administrator so we can track config changes. While we have created and use a SCOM Admin account as a service account our System Administrators use their own unique admin account to configure subscriptions. Surely there is a better way for the Subscriptions to behave.

    Thanks,
    Jamie

  7. Ken February 18, 2011 at 9:38 am #

    Hey Guys, running R2, and can’t find either Systemcenter.notications nor Notifications Internal Library. Any other suggestions?

    Thx!

  8. AiratS March 24, 2011 at 7:56 am #

    It saved me much time if only I had found it at that time when I had such issue.
    Great Work!

    Ken, take a look on my instruction, it is almostly the same, but I did it for SCOM 2007 R2:
    http://sys-man.blogspot.com/2011/03/scom-2007-r2-subscriptions-getting.html

Trackbacks/Pingbacks

  1. Subscriptions getting automatically disabled | Everything System Center Operations Manager 2007 - Rod Trent at myITforum.com - December 9, 2008

    […] Subscriptions getting automatically disabled | Everything System Center Operations Manager 2007https://www.scom2k7.com/subscriptions-getting-automatically-disabled/ Published with BlogMailr Published Tuesday, December 09, 2008 7:46 AM by […]

Leave a Reply