How to filter SCOM alerts based on Resolution state

Document ID : KB000046552
Last Modified Date : 14/02/2018
Show Technical Document Details

Problem:

In SCOM, in our connector criteria we defined that only the alerts that have a resolution "state = SendToSOI". It is working fine. The problem is when we recycle the catalyst connector, all the SCOM events are sent to SOI. Why it happens and how can we solve it?

Environment:

SCOM 4.3 & 4.4

SOI 3.3 & 4.0

Resolution:

We can filter alerts based on resolution state & we can configure a resolution state in configuration file. 

Specifies the Alert query to fetch the Alerts from the SCOM connector. Connector uses this query to fetch the Alerts from the SCOM server. The default query is to fetch all open Alerts. If no Alert Query is specified, then the connector fetches all open Alerts. 

Example:

To fetch all open Alerts, the AlertQuery parameter is as follows: 

             <AlertQuery>ResolutionState &lt; '255'</AlertQuery> 

The resolution state sent to SOI is 100 in customers configuration.

Please change resolution state query as below: 

File Path : \CA\Catalyst\CatalystConnector\container\lib\scom\SCOMConnectorConfig

Change alert queue resolution state as: 

            <AlertQuery>ResolutionState = '100'</AlertQuery> 

After this remove the connector from SOI Dashboard as mentioned below...

1) Stop Catalyst Container service 

2) Remove this connector from SOI Dashboard

3) Start Catalyst Container services