Alerting when performance counters cannot be resolved by SCOM
A customer of mine is seeing some random issues with SCOM not being able to resolve Exchange performance counters and would like to get an alert when this happens so we can troubleshoot right away.
When SCOM cannot resolve a performance counter, it will log one of two events:
- Event ID 10102 (could not resolve counter)
- Event ID 10103 (could not resolve counter instance)
I created a simple Management Pack with an Alert Rule to alert on these events. The attached MP contains one Rule with the following criteria:
Name: Alert on Missing Performance Counters
Target: Health Service
Criteria:
Event log: Operations Manager
Event Source: Health Service Modules
Event ID: 10102 / 10103
The Rule will generate an alert when event ID 10102 (could not resolve counter) or 10103 (could not resolve counter instance) are logged. Alert suppression is enabled for the Object, Counter, and Instance parameters so it will generate a separate alert for each counter that cannot be resolved on a monitored computer.
The Rule is disabled by default…I would generally recommend only enabling it on computers that you are having problems with at first, then on others if needed.
Here is a screen shot of the Alert:
