Community
- Command Central
- MVP Program
- Monthly Mission
- Blogs
- Groups
- Events
- Media Vault
Products
- Observability
- Network Management
- Application Management
- IT Security
- IT Service Management
- System Management
- Database Management
Content Exchange
- SolarWinds Platform
- Server & Application Monitor
- Database Performance Analyzer
- Server Configuration Monitor
- Network Performance Monitor
- Network Configuration Manager
- SQL Sentry
- Web Help Desk
Free Tools & Trials

Question about the SCOM 1.1 MP and Node/Interface monitoring with Orion 10.1

Hi,

Is it an accurate statement that the node and interface status monitors in the management pack work independently of any alert suppression rules that may be configured? In other words, suppose router A and downstream nodes 1-3 are monitored (checked) in the MP configuration utility. In Orion we have a rule that suppresses node down alerts for nodes 1-3 if router A is down. Because the SCOM node and interface status monitors use the value of the status perf counter, it sure looks like we will get 4 SCOM down alerts when router A goes down while we get the one through the suppression rule.

Thanks!

Find more posts tagged with

Accepted answers

All comments

bshopp

SCOM does not process alert data. It simply reads the data from the database and then SCOM uses its own built in logic to do whatever you tell it to do. The two systems are independent.

dvanorder

Thanks for confirming! Guess it's curtains for the management pack. I'll submit a separate feature request for the connector code to include an option for scraping correlated alerts configured in Orion. We want to make Orion our enterprise platform, and I'm trying to develop a way to do this without writing code that locks me into maintaining it.

Orion customers, any of you successfully sending correlated (suppressed) Orion alerts to OpsMgr as a monitor versus alert rule? It's real easy to send alerts to OpsMgr via the event log. Since Orion sends up and down alerts with the same severity and event ID it's looking trickier to develop a monitor that can handle this:

OpsMgr event log monitor goes unhealthy when Informational event 3003 received with DOWN in description. Goes healthy when same event received (severity and id are fixed) with UP in description. Piece of cake except when there are multiple nodes/interfaces down.

Servers A and B go down, you get two node down alerts in OpsMgr.

Server A comes back up, OpsMgr event log monitor reads event with UP in description. Which alert is closed?

If Orion alert vars were written to the event log as parameters, problem solved. Unfortunately testing showed this doesn't happen. Am I overlooking something?

Appreciate any feedback, and thank you all in advance!

--Drew

dvanorder

Never mind folks, I failed to consider using a trigger to run an external .vbs/.ps1 script or C# console app to manipulate the data as needed to create and close OpsMgr alerts.