Home
  •  

Office 365 Alert Autoclose rule

Microsoft.SystemCenter.O365.Rules.AlertAutoclose (Rule)

The rule is used to process the list of all Events for the Subscription via Office 365 API and to close obsolete Alerts in the Operations Manager.

Knowledge Base article:

Summary

The rule calls Office 365 Management API to get the list of Resolved Incidents, Planned Maintenances and Messages for the Subscription.

The rule also checks each Alert targeted to the Subscription in the Operations Manager, and verifies that a corresponding event exists in Office 365 monitoring data.

The rule automatically closes all Alerts that have no corresponding Events (e.g. resolved incidents that have not been updated during the period specified by the threshold measured in seconds).

Additionally, the rule can be configured to close alerts for resolved incidents and messages, which appear to be older than a certain threshold (see 'Max Alert Age (seconds)' overrides).

You can disable this rule using Override to avoid automatic closing of the Alerts.

Element properties:

TargetMicrosoft.SystemCenter.O365.Subscription
CategoryAlert
EnabledTrue
Alert GenerateTrue
Alert SeverityInformation
Alert PriorityLow
RemotableTrue
Alert Message
Resolved event has been closed automatically
The event does no longer exist and was closed.

Member Modules:

ID Module Type TypeId RunAs 
DS DataSource Microsoft.SystemCenter.O365.DataSource.AlertAutoclose Default
Alert WriteAction System.Health.GenerateAlert Default

Source Code:

<Rule ID="Microsoft.SystemCenter.O365.Rules.AlertAutoclose" Enabled="true" Target="Microsoft.SystemCenter.O365.Subscription" ConfirmDelivery="false" Remotable="true" Priority="Normal" DiscardLevel="100">

  <Category>Alert</Category>

  <DataSources>

    <DataSource ID="DS" TypeID="Microsoft.SystemCenter.O365.DataSource.AlertAutoclose">

      <TimeOut>300</TimeOut>

      <IntervalSeconds>86400</IntervalSeconds>

      <SyncTime/>

      <SubscriptionId>$Target/Property[Type="Microsoft.SystemCenter.O365.Subscription"]/SubscriptionId$</SubscriptionId>

      <MaxAlertAge>0</MaxAlertAge>

      <AuthorityUri>$Target/Property[Type="Microsoft.SystemCenter.O365.Subscription"]/AuthorityUri$</AuthorityUri>

      <OfficeResourceUri>$Target/Property[Type="Microsoft.SystemCenter.O365.Subscription"]/OfficeResourceUri$</OfficeResourceUri>

      <ManagementServiceUri>$Target/Property[Type="Microsoft.SystemCenter.O365.Subscription"]/ManagementServiceUri$</ManagementServiceUri>

      <TenantId>$Target/Property[Type="Microsoft.SystemCenter.O365.Subscription"]/TenantId$</TenantId>

    </DataSource>

  </DataSources>

  <WriteActions>

    <WriteAction ID="Alert" TypeID="Health!System.Health.GenerateAlert">

      <Priority>0</Priority>

      <Severity>0</Severity>

      <AlertOwner/>

      <AlertMessageId>$MPElement[Name="Microsoft.SystemCenter.O365.AlertAutoclose.AlertMessage"]$</AlertMessageId>

    </WriteAction>

  </WriteActions>

</Rule>