3 Replies Latest reply on Jan 1, 2011 4:36 PM by dvanorder

    Question about the SCOM 1.1 MP and Node/Interface monitoring with Orion 10.1

    dvanorder

      Hi,

      Is it an accurate statement that the node and interface status monitors in the management pack work independently of any alert suppression rules that may be configured? In other words, suppose router A and downstream nodes 1-3 are monitored (checked) in the MP configuration utility. In Orion we have a rule that suppresses node down alerts for nodes 1-3 if router A is down. Because the SCOM node and interface status monitors use the value of the status perf counter, it sure looks like we will get 4 SCOM down alerts when router A goes down while we get the one through the suppression rule.

       

      Thanks!

        • Re: Question about the SCOM 1.1 MP and Node/Interface monitoring with Orion 10.1
          bshopp

          SCOM does not process alert data.  It simply reads the data from the database and then SCOM uses its own built in logic to do whatever you tell it to do.  The two systems are independent. 

            • Re: Question about the SCOM 1.1 MP and Node/Interface monitoring with Orion 10.1
              dvanorder

              Thanks for confirming! Guess it's curtains for the management pack. I'll submit a separate feature request for the connector code to include an option for scraping correlated alerts configured in Orion. We want to make Orion our enterprise platform, and I'm trying to develop a way to do this without writing code that locks me into maintaining it.

              Orion customers, any of you successfully sending correlated (suppressed) Orion alerts to OpsMgr as a monitor versus alert rule? It's real easy to send alerts to OpsMgr via the event log. Since Orion sends up and down alerts with the same severity and event ID it's looking trickier to develop a monitor that can handle this:

              OpsMgr event log monitor goes unhealthy when Informational event 3003 received with DOWN in description. Goes healthy when same event received (severity and id are fixed) with UP in description. Piece of cake except when there are multiple nodes/interfaces down.

              Servers A and B go down, you get two node down alerts in OpsMgr.

              Server A comes back up, OpsMgr event log monitor reads event with UP in description. Which alert is closed?

              If Orion alert vars were written to the event log as parameters, problem solved. Unfortunately testing showed this doesn't happen. Am I overlooking something?

              Appreciate any feedback, and thank you all in advance!

              --Drew