Orchestrator Event Monitor fires multiple times for new events

What is Microsoft Orchestrator?! This blog now covers SC VMM as well as Orchestrator System Center components. To learn more about Orchestrator follow this link. Now on to troubleshooting…

The Runbook shown below is set up to monitor and send an alert for any new Application log events that have an Event ID of 808. This is a simple Runbook and is an ideal use of Orchestrator. There is a problem in that each time a new event such as the 808 event is logged to the event log, the Orchestrator Event Monitor executes a few times. It should fire only once per new event.

So how do we get around this? Simple. We use the Link following the Event Monitor activity as an additional filter. This of course is not an ideal setup, but it does get around an issue currently in Orchestrator 2012 SP1.

Here is the Runbook

 

Here are the details of the Event Monitor activity:

 

Here is the command we use to kick off the monitor.

 

Here we see that the event caused multiple firings of the Event Monitor.

 

 

Here, in the details of the link we set an Include filter for the same event. This will prevent the Event Monitor from firing more than once per new event log event.

With the additional Link setting in place we now have an Event Monitor that performs as we would expect. This issue should be corrected in a future release. No ETA at this time.

 

 

 

 

 

  jonjor

Comments

• Anonymous
  January 01, 2003
  Thanks for sharing

• Anonymous
  January 01, 2003
  thank you