Searching through SCOM 2012 Notification Subscriptions using PowerShell.

Imagine a scenario where you have more than 270 notification subscriptions configured in System Center 2012 Operations Manager.  Then, out of the blue you get a request from someone else at your company wanting to know why they are not getting e-mails about the servers they manage, but other people are.  You need to find out what notification subscriptions exist for these servers, so that you can add the appropriate administrator as a recipient.

The problem is that searching through the configuration of notification subscriptions is typically a manual task which can be difficult, and time time consuming.  So the question is how to automate, and speed up the process of searching through subscriptions to find any references to the servers in question.  The answer, of course, is PowerShell.

I created a script which performs the following actions:

1. Inputs

The script takes a list of one or more server names into the $computers variable using fully qualified domain names.

2. Searches

First the script searches and compiles a list of all groups the computers are members of, and searches for any subscriptions which contain references to the groups found.

Then it searches for notifications subscriptions referring to the servers by using the servers name specifically.

Finally, it queries the notification subscriptions for all objects related to the server name.  This ancillary object search accounts for things like Logical Disks, Network Adapters, the Windows Operating System, IIS Web Server role, IIS web sites, IIS Application Pools, DNS Server roles, SCOM Health Service, etc.

3. Output

The script then outputs a list of any and all found notification subscriptions which contain references to the searched servers, objects they contain, or groups which contain the servers.

 

Caveats

There had to be a downside, right?  Well, in this case the downside is performance.  The script execution may take a long time, especially if the management group has a large number of groups and/or a large number of notification subscriptions.  Additionally, this script does not account for the possibility of notification subscriptions based on a specific class, as such a search would be far too complex to execute.

Without further ado:

 

  1 #Script searches for SCOM Notification Subscriptions to find which subscriptions a computer might be referenced in
 2 #Subscriptions by classes are not covered here.
 3 #Written by: Andres Naranjo
 4 #Provided as a sample only.
 5 
 6 $subscriptions = get-scomnotificationsubscription
 7 $computers = @("sqllit.litware.com","rmslit.litware.com","sqllit.litware.com")
 8 $groupMasterList = @()
 9 $global:subscriptionsMasterList = @()
10 
11 Function searchSubscriptionCriteria
12 {
13     Param ($searchString)
14     foreach ($subscription in $subscriptions)
15     {
16        if ($subscription.configuration.criteria.length -ne 0 )
17        {
18            if ($subscription.configuration.criteria.Contains($searchString))
19            {
20                #write-host $subscription.DisplayName -foreground "red"
21                $global:subscriptionsMasterList += $subscription.DisplayName
22            }
23        } 
24     }
25 }
26 
27 Function searchSubscriptionGroups
28 {
29     Param ($searchString)
30     foreach ($subscription in $subscriptions)
31     {
32         if ($subscription.configuration.MonitoringObjectgroupIds -ne $null)
33         {
34             foreach ($item in $subscription.configuration.MonitoringObjectGroupIds)
35             {
36                 if ($item.Guid -eq $searchString)
37                 {
38                     #write-host $subscription.DisplayName -foreground "red"
39                     $global:subscriptionsMasterList += $subscription.DisplayName
40                 }
41             }  
42         }
43      }  
44 }
45 
46 Function searchForGroupMembership
47 {
48     Param($searchString)
49     $groups = get-scomgroup
50 
51     foreach ($group in $groups)
52     {
53         $members = $group | get-scomclassinstance
54         foreach ($member in $members)
55         {
56             if (($member.Path -eq $searchString) -or ($member.DisplayName -eq $searchString))
57             {
58                 $groupMasterList +=  $group.DisplayName
59                 break;
60             } 
61         }
62     }
63 
64 }
65 
66 foreach ($computer in $computers)
67 {
68     "For Computer $computer : "
69     #Search for groups the computer is a member of
70     "Searching group memberships."
71     searchForGroupMembership($computer)
72     #searching for the groups in all notifications
73     "Searching groups in notifications."
74     foreach($grp in $groupMasterList)
75     {
76         $Id = (get-scomgroup -DisplayName "$grp").Id
77         searchSubscriptionGroups($Id)
78     }
79 
80     #searching for subscriptions by FQDN computer name
81     "Searching notifications for computer objects."
82     $computerGUIDs = get-scomclassinstance -displayname "*$computer*"
83     foreach ($cGUID in $computerGUIDs)
84     {    
85         searchSubscriptionCriteria($cGUID.Id)
86     }
87 
88     #searching for contained classes of the object
89     "Searching notifications for contained/ancillary objects"
90     $containedGUIDs = get-scomclassinstance | where-object {$_.Path -eq "$computer"}
91     foreach($containedGUID in $containedGUIDs)
92     {
93         searchSubscriptionCriteria($containedGUID.Id)
94     }
95 }
96 
97 write-host "The following subscriptions reference the specified computers or their objects:" -ForegroundColor "red"
98 $global:subscriptionsMasterList | select -Unique 
99