2

I have just installed SCOM and it is monitoring a subset of the Windows servers that we have installed.

There is one rule which is generating alerts which is giving me a little trouble: NTFS - Delayed Write Lost

This is being caused by VMware and our backup solution. All of the machines that are being monitored are VMware virtual machines running on either ESXi 5.5 or 6. They are being backed up by Commvault which generating a quiesced snapshot and backing up the snapshot. While the snapshot is being generated, Windows is generating these events which are being tracked by SCOM. This appears to be a known issue and VMware are doing nothing about it. See here: VMware Site

Since I can't do anything about the warning being generated, I would instead like to suppress the rule while the snapshot is being taken instead. Unfortunately, overrides in SCOM appear to be binary; the rule is either enabled or it isn't. I don't want to disable a rule like that, under any other circumstances a failed delayed write could be a serious matter.

Looking at the event logs on the server, the alert never seems to appear more than 10-15 times in the space of a few seconds. Can SCOM be set to not notify on that rule unless it appears more than X times over Y amount of time? Failing that, can it be set to suppress the rule during the backup window?

Would appreciate any advice :)

Improve this question

2 Answers 2

Reset to default
1

I think that using the "Maintenance Mode" is the right choice for you. Any server in SCOM can be switched to the maintenance mode for specific time period and it will suspend all monitoring workflows on that server for that time. Here is a link how to manage it in SCOM: https://technet.microsoft.com/en-us/library/hh212870.aspx

If your backup is a part of the automated workflow you may want to turn that machines into maintenance mode with PS command. Here is more details about PS that cmdlet: https://technet.microsoft.com/en-us/library/hh918505(v=sc.30).aspx

I hope it helps.

Thank you, Roman.

Improve this answer
2
  • Thank you for your answer. That was something that we had considered and if we could guarantee that the snapshot would happen at the same time every day, that's what we'd probably do. However, while the backup is part of a workflow of a sort, it can't be set to tun a PS script, take the snapshot and then run another. Using maintenance mode would therefore mean that it'd be in that mode for the entire window which is something like four to six hours. Different VMs also have different backup windows. Placing the hosts into maintenance mode really isn't an option.
    – Norphus
    Mar 17, 2016 at 22:03
  • Having slept on this, I think that your answer is more helpful than I gave it credit for initially. However, I still don't want to put the hosts into maintenance mode as that will disable all of the monitors. Instead, I'm looking at the Enable-SCOMRule and Disable-SCOMRule cmdlets. Putting those into a scheduled task or into a backup workflow is the way to go I think. So again, thankyou :)
    – Norphus
    Mar 18, 2016 at 10:56
0

You could disable the original rule and build a new rule or monitor.

Version 1: Instead of targeting the windows class, use the Logical Disk classa target. While the backup runs, set the logical disks in Maintenance Mode. So only the Workflows of the Logical disks are stopped. (You can use any other class for that)

When there are many instances that need to be set in Maintenance Mode at once, you should group them and set the Maintenance for the group. Iterating through the instances and setting Maintenance Mode for them with powershell is really slow in my experience.

Version 2: Use an event correlated rule or monitor. E.g: Alarm only, when the same event doesn't appear again in the next 5 minutes after the first event has risen.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.