Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm creating a rule to look for a missing event in a windows log using SCOM and I need to override the rule for different groups of servers to set different timings.

For example server A needs to have an alert raised if the event is missing for 30mins but on server B, we only produce the alert for 60mins without the event.

Is there any way to allow overriding this property of the missing event detection unit monitor?

share|improve this question

1 Answer 1

up vote 0 down vote accepted

The Missing Event Schedule, and the, Auto Reset Timer, properties are not values that can be overridden on a unit monitor. A brief overview of the overridable properties can be found at How to Create an Override for a Monitor.

We always follow the pattern of "target a class, but override for a group". I think this generally means in this situation we would create the following assets:

  1. classA and classB
  2. Missing Event Unit Monitor for ClassA (30)
  3. Missing Event Unit Monitor for ClassB (60)

Something like that.

Its not as clean, or as reusable, as we might like, so I'm hoping someone will post a more 'reusable' / DRY'er way to achieve this.

I wonder if an alternative might be to have a custom script monitor reading the event log at some interval, which is configured outside of SCOM (e.g. registry, config service, etc)? Just thinking out loud..

share|improve this answer
    
Thanks for your comments. I'm marking this as an answer for now - even though the answer is basically "no". –  mjaggard Mar 8 '12 at 14:19

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.