Home
  •  

OpsMgr 2012 Self Maintenance Detect Manually Closed Monitor Alerts Rule

OpsMgr.2012.Self.Maintenance.Detect.Manually.Closed.Monitor.Alerts.Rule (Rule)

Generate alerts if any monitor-generated alerts were manually closed by any OpsMgr operators

Knowledge Base article:

Summary

The “OpsMgr 2012 Self Maintenance Detect Manually Closed Monitor Alerts Rule” runs on a schedule and detects if any monitor-generated alerts have been closed manually by OpsMgr operators.

Configuration

By default, this rule runs once a day at 00:05am and detects if any monitor-generated alerts were closed manually since last run. The following parameters are configurable via overrides:

IntervalMinutes: Schedule frequency in minutes. The interval cannot be longer than the Operational DB Grooming setting for Resolved Alerts (by default 7 days).

SyncTime: Time when the rule runs.

ResetUnitMonitors: When set to 'true', the rule will also reset the health state of the monitor of which generated the alert if the monitor is an unit monitor and its state is warning or error.

TimeoutSeconds: Timeout in seconds for the PowerShell script within this rule. Default is 900 seconds (15 minutes). Increase it if it’s required.

Causes

Monitor generated alerts should not be closed manually.

Resolutions

You may need to reset health on the objects where the monitors are targeted.

Additional

Alerts that are raised by the monitors should not be manually resolved in Operations Manager

Impact of Closing an Alert

Please note that any monitor alerts closed by "Auto-Resolve" will also be alerted by this rule. It may indicate that the monitor alert has been closed by the system as a result of end of a maintenance mode. If this is the case, although the alert is closed and the monitor has been reset to healthy, the underlying problem may still exist.

Element properties:

TargetMicrosoft.SystemCenter.AllManagementServersPool
CategoryOperations
EnabledFalse
Alert GenerateTrue
Alert SeverityWarning
Alert PriorityLow
RemotableTrue
Alert Message
Monitor Generated Alerts Have been Manually Closed

Over the last {0} minutes, {1} monitor generated alert(s) have been closed manually by {2} users:
{3}

Member Modules:

ID Module Type TypeId RunAs 
DS DataSource OpsMgr.2012.Self.Maintenance.Detect.Manually.Closed.Monitor.Alerts.DataSource Default
FilterResult ConditionDetection System.ExpressionFilter Default
GenerateAlert WriteAction System.Health.GenerateAlert Default

Source Code:

<Rule ID="OpsMgr.2012.Self.Maintenance.Detect.Manually.Closed.Monitor.Alerts.Rule" Target="SC!Microsoft.SystemCenter.AllManagementServersPool" Enabled="false" ConfirmDelivery="false" Remotable="true" Priority="Normal" DiscardLevel="100">

  <Category>Operations</Category>

  <DataSources>

    <DataSource ID="DS" TypeID="OpsMgr.2012.Self.Maintenance.Detect.Manually.Closed.Monitor.Alerts.DataSource">

      <IntervalMinutes>1440</IntervalMinutes>

      <SyncTime>00:05</SyncTime>

      <ResetUnitMonitors>false</ResetUnitMonitors>

      <TimeoutSeconds>900</TimeoutSeconds>

    </DataSource>

  </DataSources>

  <ConditionDetection ID="FilterResult" TypeID="System!System.ExpressionFilter">

    <Expression>

      <SimpleExpression>

        <ValueExpression>

          <XPathQuery Type="Integer">Property[@Name='AlertsCount']</XPathQuery>

        </ValueExpression>

        <Operator>Greater</Operator>

        <ValueExpression>

          <Value Type="Integer">0</Value>

        </ValueExpression>

      </SimpleExpression>

    </Expression>

  </ConditionDetection>

  <WriteActions>

    <WriteAction ID="GenerateAlert" TypeID="Health!System.Health.GenerateAlert">

      <Priority>0</Priority>

      <Severity>1</Severity>

      <AlertMessageId>$MPElement[Name="OpsMgr.2012.Self.Maintenance.Detect.Manually.Closed.Monitor.Alerts.Rule.AlertMessage"]$</AlertMessageId>

      <AlertParameters>

        <AlertParameter1>$Data/Property[@Name='IntervalMinutes']$</AlertParameter1>

        <AlertParameter2>$Data/Property[@Name='AlertsCount']$</AlertParameter2>

        <AlertParameter3>$Data/Property[@Name='UserCount']$</AlertParameter3>

        <AlertParameter4>$Data/Property[@Name='Details']$</AlertParameter4>

      </AlertParameters>

    </WriteAction>

  </WriteActions>

</Rule>