System Center Orchestrator 2012 Updating SCOM alerts using Integration Pack

Hi, I am Mark Manty Microsoft Premier Field Engineer for SCOM.

Today I wanted to touch on Orchestrator and the SCOM 2007 R2 Integration pack.

With the new version of SCOM 2012 on the horizon you may have already begun planning your migration. The Universal connector will not be supported in SCOM 2012.  The recommendation for replacing this functionality is Orchestrator.

Here is a example of how you can utilize Orchestrator with the SCOM integration pack to update alerts.

Launch System Center Orchestrator Runbook Designer.

Expand Runbooks folder in Connections view and Right click to create new folder.

Enter a name for the folder.

 

 Expand Activities – Operations Manager 2007 R2 and drag over Get Alert and Update Alert.

 

 

Select Get Alert object and drag arrow over to connect to Update Alert object to create the flow.

 Select the Get Alert object and right click for properties.

Select “…” to add connection.

 

Choose your SCOM RMS connection.

Select “Add…” to select what alerts you want to update.

 

In this case I selected all alerts that have a Resolution state of AUCForward. You could refine to make much more granular to meet your requirements.

 

Select Arrow and right click Properties to bring up Link properties.

 

Change Include to AlertCount from GetAlert is Greater than 0. We only want to update alerts if we find any.

 

Right Click Alert Update object and select Properties.

Right click in Alert ID properties to Subscribe -> Published Data.

  

Select Id from GetAlert and select Ok.

Click “Select Fields…” to select fields to update.

 

I selected Resolution state to change to SCORCH. You can select additional fields to update as needed.

 

Now you can select Runbook tester to verify that the alerts are updated.

 

 

Select Run to Breakpoint and then Alerts should be updated.

 

 See status in Log window.

Note that the resolution state was successfully updated.

 

See the properties on alert History tab to validate Orchestrator updated the alert.

 

Next add the Activity – Scheduling – Monitor Date/Time object by dragging and dropping in your runbook.

Drag arrow to create flow from Monitor Date/Time to GetAlert object.

 

Select Properties on Monitor Date/Time object and select for this to run every 10 seconds and select Finish.

  

Check In your changes.

 

Right click the tab of the runbook in the designer and select Properties. Note that you can override the default runbook server to select which servers to run this on.

Right click the runbook tab and select Run to start the processing of alerts runbook you created.

If you encounter this error then start Runbook service.

 

This service (Orchestrator Runbook Service).

 

This is an example of how you can automate updating SCOM alerts using System Center Orchestrator 2012. Orchestrator is a very powerful resource for any tasks that you plan to automate.

Comments

• Anonymous
  January 01, 2003
  Thank you Abdul.

• Anonymous
  May 16, 2012
  Great Post !!! Keep up the great work !!

• Anonymous
  August 27, 2012
  why are you not using MonitorAlert ? I am using it, but when it runs for a long time > 24 hrs I seem to run into troubles, but I cannot figure out why... and the technet description is not clear either. based on that page, it seems the perfect solution technet.microsoft.com/.../hh830707

• Anonymous
  November 07, 2012
  What do you do in the scenario where Monitor Alert fails.  So its pointed at a server and that server fails, there is no failure detection that we can get working, it just keeps chugging along.

• Anonymous
  March 01, 2016
  Really valuable thank you. I appreciate the walkthrough :-)
  It's nice to take something we're familiar with--the Alert Update Connector--and show how to implement it in a new technology.

• Anonymous
  April 20, 2016
  Hi Mark, I use the Monitor Alert activity. But I noticed it always processes the alert twice. Would like to know if you have noticed this.