Most people do not realize this is even possible.
Many times alerts are generated from sealed management packs, and SCOM Admins wish they could change the Alert Name, or the Alert Description. Another common scenario, is that sometimes a monitor is designed by the MP author to change state only, and there is no “AlertSettings” configuration in the monitor XML. In this case, if you override the monitor to create alerts, they are ugly, where the alert name is the ID of the monitor itself.
Changing the alert name/description is not normally possible, as it is not easily modified in the UI. However, it CAN be done through XML. There is on override-able property on alerts, called “AlertMessage”. It is simply hidden from the UI.
Let’s use an example, for a monitor that does not alert by default, but we NEED this to alert, and have a decent alert name and description.
I will pick “Monitoring Host Private Bytes Threshold” monitor:
It does not alert by default:
The first thing I will do, is create an Override MP to contain these special overrides:
Then set some typical overrides to enable alerting for this Monitor:
Here is the problem: When this monitor generates an alert, they are ugly. Since the monitor had no AlertSettings configuration initially, the AlertName defaults to the ID of the monitor, and the Alert Description is completely empty ( YUCK! ):
To “fix” this, we have to Export the MP, open the MP XML file, and work in XML from here. First, we need to create an Alert String Resource, and a typical DisplayString for our Override for name and description.
This will be placed in the <StringResources> section after <Folders>:
Here is my String Resource:
<Presentation> <Folders> <Folder ID="Folder_a04378a1dbaf424ba5b223376aea38c7" Accessibility="Public" ParentFolder="SystemCenter!Microsoft.SystemCenter.Monitoring.ViewFolder.Root" /> </Folders> <StringResources> <StringResource ID="Overrides.SCOM.Agent.Thresholds.Microsoft.SystemCenter.Agent.MonitoringHost.PrivateBytesThreshold.AlertMessage" /> </StringResources> </Presentation>
You can make this anything you want really. We will actually reference this string to the monitor in an override a bit later.
In addition, I need to add a display string with the new name and description I wish to use:
<DisplayString ElementID="Overrides.SCOM.Agent.Thresholds.Microsoft.SystemCenter.Agent.MonitoringHost.PrivateBytesThreshold.AlertMessage"> <Name>Agent Resources Exceeded Threshold: MonitoringHost Private Bytes is too high.</Name> <Description>The Agent is consuming too many resources. MonitoringHost Private Bytes has exceeded a threshold.</Description> </DisplayString>
This is what my Presentation and LanguagePacks sections look like now:
<Presentation> <Folders> <Folder ID="Folder_a04378a1dbaf424ba5b223376aea38c7" Accessibility="Public" ParentFolder="SystemCenter!Microsoft.SystemCenter.Monitoring.ViewFolder.Root" /> </Folders> <StringResources> <StringResource ID="Overrides.SCOM.Agent.Thresholds.Microsoft.SystemCenter.Agent.MonitoringHost.PrivateBytesThreshold.AlertMessage" /> </StringResources> </Presentation> <LanguagePacks> <LanguagePack ID="ENU" IsDefault="false"> <DisplayStrings> <DisplayString ElementID="Overrides.SCOM.Agent.Thresholds"> <Name>Overrides - SCOM Agent Thresholds</Name> </DisplayString> <DisplayString ElementID="Folder_a04378a1dbaf424ba5b223376aea38c7"> <Name>Overrides - SCOM Agent Thresholds</Name> </DisplayString> <DisplayString ElementID="Overrides.SCOM.Agent.Thresholds.Microsoft.SystemCenter.Agent.MonitoringHost.PrivateBytesThreshold.AlertMessage"> <Name>Agent Resources Exceeded Threshold: MonitoringHost Private Bytes is too high.</Name> <Description>The Agent is consuming too many resources. MonitoringHost Private Bytes has exceeded a threshold.</Description> </DisplayString> </DisplayStrings> </LanguagePack> </LanguagePacks>
Now – we can import this MP with these changes. This doesn’t change the alert yet, this is just setting up to create the override. However, this type of override must reference the unique GUID of the StringResource, so we need to get that GUID first, before we continue. We can easily do that now, using a SQL query to find the GUID for the string we just created. Query your OpsDB:
SELECT StringResourceId FROM StringResource WHERE StringResourceName = 'Overrides.SCOM.Agent.Thresholds.Microsoft.SystemCenter.Agent.MonitoringHost.PrivateBytesThreshold.AlertMessage'
This what mine returned. Yours will be different. We have to get the GUID before creating the final step – the override.
Now that I have my GUID for my custom Alert String Resource, I can create my override in XML:
<MonitorPropertyOverride ID="OverrideForMonitor.Microsoft.SystemCenter.Agent.MonitoringHost.PrivateBytesThreshold.AlertMessage" Context="SystemCenter!Microsoft.SystemCenter.Agent" Enforced="false" Monitor="SystemCenter1!Microsoft.SystemCenter.Agent.MonitoringHost.PrivateBytesThreshold" Property="AlertMessage"> <Value>DD29971E-6C67-1901-D242-15742629285D</Value> </MonitorPropertyOverride>
Notice I used the GUID I got from my SQL query.
Now – the above part is easy to get messed up on.
You need to match up the References to the MP containing “Microsoft.SystemCenter.Agent” and the MP containing the monitor: “Microsoft.SystemCenter.Agent.MonitoringHost.PrivateBytesThreshold”
These will be in the Manifest > References section of your MP:
<References> <Reference Alias="SystemCenter"> <ID>Microsoft.SystemCenter.Library</ID> <Version>7.0.8443.6</Version> <PublicKeyToken>31bf3856ad364e35</PublicKeyToken> </Reference> <Reference Alias="SystemCenter1"> <ID>Microsoft.SystemCenter.2007</ID> <Version>10.19.10311.0</Version> <PublicKeyToken>31bf3856ad364e35</PublicKeyToken> </Reference> </References>
You need to match up the Reference Alias with what is in your MP. These might already match fine, or might need to be changed – depending on how the Override MP was initially created, and what tools added references….. as the aliases are not standardized.
Now Import the MP.
New alerts look MUCH better:
Now, the question might be – what kind of additional, dynamic data can we include in this alert to make it even better?
I’m glad you asked!
We can also include any context that is part of the monitor state change. These are usually propertybags that are part of the module output.
The override is for “AlertParameter1”, “AlertParameter2”, etc.
You can see these Context properties in Health Explorer, if your monitor has them:
So in this specific case, I can add into the Alert Description, the InstanceName, which will tell me specifically which process in Perfmon was the problem, and the Last Sampled Value.
First, I will add in overrides for each of these above. You can get examples from this link.
<MonitorPropertyOverride ID="OverrideForMonitor.Microsoft.SystemCenter.Agent.MonitoringHost.PrivateBytesThreshold.AlertParameter1" Context="SystemCenter!Microsoft.SystemCenter.Agent" Enforced="false" Monitor="SystemCenter1!Microsoft.SystemCenter.Agent.MonitoringHost.PrivateBytesThreshold" Property="AlertParameter1"> <Value>$Data/Context/InstanceName$</Value> </MonitorPropertyOverride> <MonitorPropertyOverride ID="OverrideForMonitor.Microsoft.SystemCenter.Agent.MonitoringHost.PrivateBytesThreshold.AlertParameter2" Context="SystemCenter!Microsoft.SystemCenter.Agent" Enforced="false" Monitor="SystemCenter1!Microsoft.SystemCenter.Agent.MonitoringHost.PrivateBytesThreshold" Property="AlertParameter2"> <Value>$Data/Context/SampleValue$</Value> </MonitorPropertyOverride>
Lastly – we need to include these in our AlertDescription.
AlertParameter1 = {0}
AlertParameter2 = {1}
AlertParameter3 = {2}
etc…etc…
<DisplayString ElementID="Overrides.SCOM.Agent.Thresholds.Microsoft.SystemCenter.Agent.MonitoringHost.PrivateBytesThreshold.AlertMessage"> <Name>Agent Resources Exceeded Threshold: MonitoringHost Private Bytes is too high.</Name> <Description>The Agent is consuming too many resources. MonitoringHost Private Bytes has exceeded a threshold. Last Sampled Value: {1} Instance Name: {0} </Description> </DisplayString>
Now look at these alerts!
You can use this process to override the Alert Name and Description for pretty much any SCOM Monitor.
Recap:
1. Create a new StringResource (in the Presentation/StringResources section of the XML)
2. Create a new DisplayString (in the LanguagePacks section of the XML) that references your string resource and includes your modified Alert Name and AlertDescription.
3. Import this MP.
4. Get the GUID of your StringResource from SQL
5. Create a new Override in the XML, for “AlertMessage” property, with the GUID from above.
That’s it! The first couple times you do this it can feel a bit complicated, but once you do it a few times it gets easier, especially once you understand the issues with getting the right Reference Aliases for your MP you are using.
Credit for this article goes to Marius Sutara, who wrote about this capability many years ago: LINK
That’s great Kevin. What about rules?
I have not figured out a way to make this work with rules. Rules generate Alerts differently, using a WriteAction. More specifically: “System.Health.GenerateAlert” in the System.Health management pack. This write action only allows for Priority and Severity to be overridden. So for rules, the best solution is likely the old way – disable the rule, then create your own copy of the rule and customize your Alert Name and Description.
Can we edit the notifications mp so it will put the word “warning” or “critical” for the severity in a notification email, instead of the number 1 or 2?
Unfortunately there is no displayname value for Severity. Only Integer. However, as a workaround, you can:
1. Use SCOM 2019 – which has the ability to modify text, and colors, based on something like Severity, with the new HTML format.
2. Create different SMTP channels, one for warning and one for critical, with the text names of the severity in the title.
3. Use something to edit the email format, such as http://blog.tyang.org/2012/08/16/scom-enhanced-email-notification-script-version-2/
I’m guessing the GUID is going to be unique for each Management Group? I have a synchronization process in place that synchronizes MPs across multiple Management Group. If the GUID is unique that would complicate things a bit for me. I could just create a MP just for this that isn’t synced, but my first choice would be to include it in an existing synchronized MP.
I don’t think so. I believe we use an algorithm to assign GUID and it should be the same across MG’s.
Yep, IDs are generated by an algorithm. This blogs goes in the details of how it works, for those who are interested : https://maxcoreblog.com/2019/05/02/are-scom-ids-random/
That is awesome!
His whole blog is awesome, the last time I stumble upon a blog with that level of expertise whas forever ago 😀
In this case we shouldn’t check GUID in our database. In this example we should use $MPElement$ instead of GUID. In other words, just replace
DD29971E-6C67-1901-D242-15742629285D
on
$MPElement[Name=”Overrides.SCOM.Agent.Thresholds.Microsoft.SystemCenter.Agent.MonitoringHost.PrivateBytesThreshold.AlertMessage”]$
Hi Kevin;
This is an excellent feature that I hope I can take advantage of; but I’m having trouble with the last piece – matching the reference aliases for the final override. Any advice you can offer to work this out?
I’m trying to override the error message for the monitor “ICMP Ping” (scope Node > Availability > Network Device Responsiveness > ICMP Ping)
What’s the problem or error you are getting?
Well – happily, the law of “making a fool of onesself” stepped in – as soon as I’d posted your comment I went back to troubleshooting the XML and got the issue resolved.
My solution was to make a new MP with just one override (enabling the alert which would otherwise be disabled) and then copying & modifying that override with the value pulled from the DB. In this way, all that needed to be modified was the override ID and the value – the Context and Monitor values were already correct.
However! I’m now encountering an issue with adding extra information to the alert:
The monitor:
ICMP Ping (again – Node > Availability > Network Device Responsiveness > ICMP Ping) is overridden to generate an alert, and I’ve now been able to change the alert name to something useful.
In the health Explorer, I can see the value I’m looking for to add to the description: “Ping Destination”.
I’d like to add this plus “Display Name” to the alert description – but when I try, I either get XML reference errors when I try to add it in, or “{0}”, or both.
The last override I made that imported was:
$Target/Property[Type=”NetworkManagement!System.NetworkManagement.Node”]/SNMPAddress$
I used this as the reference for the monitor’s data sources:
https://systemcenter.wiki/?GetElement=System.NetworkManagement.Node&Type=ClassType&ManagementPack=System.NetworkManagement.Library&Version=10.19.10050.0
Thanks for any assistance you can offer!
Hi Kevin –
I’m struggling with the last piece where you inserted alert parameters – can you include your XML where you’re defining the parameters (where you’ve got “AlertParameter1 = {0}” and so on defined) so I can see what I’m doing wrong?
All I get in my alert body is ” {0} “
I am defining these in the overrides for AlertParameter1, etc. One you have this override in place for AlertParameter1 with a value that is correct, you can use {0} in the alert description. If it does not resolve correctly, then you will just see {0} in the Alert Description, and probably get an alert that an alert variable could not be resolved.
Hi Kevin,
With regards to the string resources, what is the benefit of using this in Management Packs? I am documenting the SharePoint pack at the moment using MP Author and have noticed that all of the Display Name and Descriptions are blank. I have a feeling that this may be the case with others too but I had just assumed that they had left them blank!
What seems to be going on is that all of these descriptions are linked to as String Resources. So I can see those in MP Author but this makes a job of documentation that is already hard, even harder! 🙁
Is this just a time saver when authoring or are there actual performance benefits to doing it this way?
Thanks
I have no idea…. that was designed way before I came along.
No worries. Currently using a combination of MP Viewer and MP Studio to get the info. Just thought it was strange.
Not sure why MP Viewer can see it though, but MP Author can’t.
I guess it would be too easy if everything just worked 🙂
Thanks
This is really good to know.
I’m now writing a sealed MP to monitor all our services based off CMDB data.
I was hoping to find a way to make the alert description overrideable in case some customers require a specific action on a specific group of services but i can’t find any examples of solutions with alerts strings inside the monitor type.
Do you have any recommendations for future developers to make this easier for clients?
Thanks
Hi Kevin,
Thank you for publishing this great information, we’ve made some valuable changes to our alerts already after reading this.
Is it possible to add $Target$ variables into the alert description with an override or are only the monitor output items available for use? I tried something like this, but it ended up causing the monitor to not initialize.
$Target/Property[Type=”Windows!Microsoft.Windows.Computer”]/PrincipalName$
No $Target variables are not allowed, only $Data context from the monitor output. 🙁
Marius talked about this here: https://docs.microsoft.com/en-us/archive/blogs/mariussutara/dynamic-alert-settings-for-monitor-which-never-had-any-done-thru-overrides
Hi Kevin,
This has worked nicely for a monitor, but for a rule the syntax is rather different and struggling to fine a way to apply the same kind of thinking to a alert from a rule.
this is what I have but i get an error – The ‘ElementID’ attribute is invalid – The value ‘Overide.for.my.server.restart.Service.KB0022377.AlertMessage’ is invalid according to its datatype ‘ManagementPackIdentifierReference’ – The Pattern constraint failed.
Overide.for.my.server.restart.Service.KB0022377.
for myserver – P2 Incident to be created send to Platforms-Global team to restart Service in “my Machines Manager” KB0022377.
more display strings blablabla
I do not believe this is possible for a rule…. all rules use System.Health.GenerateAlert as the Write Action.
The only Overrideable parameters on that Write Action are for Priority and Severity.
So the only way to make this work for rules, would be to file a bug and ask the product group to modify this write action, and expand the scope of overrideable properties. I doubt they would, at this stage of the game, as this module hasn’t been changed in 15 years, and the workaround is simply disable the rule, and re-write an exact copy of the rule in your own MP, if you want a different alert name/description.
Hi Kevin,
I’ve challenge in getting Diagnostic Output result in SCOM alert description in Custom MP.
If you could help me it will great …
Thank you
Regards | Mohan Ram K
Not possible.
Hi Kevin,
this process dint work for me for some reason
Hi Kevin,
There is another SCOM Alert : Failed to Connect to Computer (Alert Monitor:Computer Not Reachable)
the Alert description states The computer was not accessible.
This isn’t giving specific details or the context ..like what is failed to connect to computer, inaccessible in terms of any specific IP, port etc.
is there a possibility MS would modify the Alert Tite/Description in future releases..
You suggestion / advise on this issue please
Very doubtful. You should open a case and file this as a bug/Design Change Request.
Understand, thank you Kevin
What happens when I want to remove this? Should I just delete the Display Strings, String Resource and Override from the override MP and reimport?
I’d have no concerns about this normally, but clearly the String Resource creates a GUID in the OPSDB. Will this be tidied up?
You got it exactly, deleting those Display Strings, String Resource and Override from the MP will remove them from the database.
Hi Kevin,
Very nice article. I have been trying to disable a few alerts that monitor services in Exchange and other servers we monitor in SCOM 2022. However, some of these services we would like to not monitor anymore, primarily because they are intermittent. So each time they stop, we get alerts. Looking at the alerts tab, i noticed that “Generate Alerts for this monitor” box is checked but grayed out. Is almost as if i had no elevated access, but to my knowledge i do. Not sure how to disable these alerts. Please help.
Thanks,
Omar
I forgot to mention the monitor description. The monitor is ” MSExchangeNotificationsBroker” and ” ECP” also from exchange. I have tried a few things such as creating a new MP and set override to true, but that does not help one bit. SCOM is so frustrating, but my employer needs me to configure it. Any help will be appreciated
.
I got GUID from database now where do i need to add the GUID in XML?
Where do i add the following XML code.
DD29971E-6C67-1901-D242-15742629285D