Menu Close

How to override the Alert Name and Alert Description of a Sealed Monitor

Most people do not realize this is even possible.

Many times alerts are generated from sealed management packs, and SCOM Admins wish they could change the Alert Name, or the Alert Description.  Another common scenario, is that sometimes a monitor is designed by the MP author to change state only, and there is no “AlertSettings” configuration in the monitor XML.  In this case, if you override the monitor to create alerts, they are ugly, where the alert name is the ID of the monitor itself.

Changing the alert name/description is not normally possible, as it is not easily modified in the UI.  However, it CAN be done through XML.  There is on override-able property on alerts, called “AlertMessage”.  It is simply hidden from the UI.


Let’s use an example, for a monitor that does not alert by default, but we NEED this to alert, and have a decent alert name and description.

I will pick “Monitoring Host Private Bytes Threshold” monitor:



It does not alert by default:



The first thing I will do, is create an Override MP to contain these special overrides:



Then set some typical overrides to enable alerting for this Monitor:



Here is the problem:  When this monitor generates an alert, they are ugly.  Since the monitor had no AlertSettings configuration initially, the AlertName defaults to the ID of the monitor, and the Alert Description is completely empty ( YUCK! ):



To “fix” this, we have to Export the MP, open the MP XML file, and work in XML from here.  First, we need to create an Alert String Resource, and a typical DisplayString for our Override for name and description.

This will be placed in the <StringResources> section after <Folders>:

Here is my String Resource:

<Presentation> <Folders> <Folder ID="Folder_a04378a1dbaf424ba5b223376aea38c7" Accessibility="Public" ParentFolder="SystemCenter!Microsoft.SystemCenter.Monitoring.ViewFolder.Root" /> </Folders> <StringResources> <StringResource ID="Overrides.SCOM.Agent.Thresholds.Microsoft.SystemCenter.Agent.MonitoringHost.PrivateBytesThreshold.AlertMessage" /> </StringResources> </Presentation>

You can make this anything you want really.  We will actually reference this string to the monitor in an override a bit later.

In addition, I need to add a display string with the new name and description I wish to use:

<DisplayString ElementID="Overrides.SCOM.Agent.Thresholds.Microsoft.SystemCenter.Agent.MonitoringHost.PrivateBytesThreshold.AlertMessage"> <Name>Agent Resources Exceeded Threshold: MonitoringHost Private Bytes is too high.</Name> <Description>The Agent is consuming too many resources. MonitoringHost Private Bytes has exceeded a threshold.</Description> </DisplayString>

This is what my Presentation and LanguagePacks sections look like now:

<Presentation> <Folders> <Folder ID="Folder_a04378a1dbaf424ba5b223376aea38c7" Accessibility="Public" ParentFolder="SystemCenter!Microsoft.SystemCenter.Monitoring.ViewFolder.Root" /> </Folders> <StringResources> <StringResource ID="Overrides.SCOM.Agent.Thresholds.Microsoft.SystemCenter.Agent.MonitoringHost.PrivateBytesThreshold.AlertMessage" /> </StringResources> </Presentation> <LanguagePacks> <LanguagePack ID="ENU" IsDefault="false"> <DisplayStrings> <DisplayString ElementID="Overrides.SCOM.Agent.Thresholds"> <Name>Overrides - SCOM Agent Thresholds</Name> </DisplayString> <DisplayString ElementID="Folder_a04378a1dbaf424ba5b223376aea38c7"> <Name>Overrides - SCOM Agent Thresholds</Name> </DisplayString> <DisplayString ElementID="Overrides.SCOM.Agent.Thresholds.Microsoft.SystemCenter.Agent.MonitoringHost.PrivateBytesThreshold.AlertMessage"> <Name>Agent Resources Exceeded Threshold: MonitoringHost Private Bytes is too high.</Name> <Description>The Agent is consuming too many resources. MonitoringHost Private Bytes has exceeded a threshold.</Description> </DisplayString> </DisplayStrings> </LanguagePack> </LanguagePacks>


Now – we can import this MP with these changes.  This doesn’t change the alert yet, this is just setting up to create the override.  However, this type of override must reference the unique GUID of the StringResource, so we need to get that GUID first, before we continue.  We can easily do that now, using a SQL query to find the GUID for the string we just created.  Query your OpsDB:

SELECT StringResourceId FROM StringResource WHERE StringResourceName = 'Overrides.SCOM.Agent.Thresholds.Microsoft.SystemCenter.Agent.MonitoringHost.PrivateBytesThreshold.AlertMessage'


This what mine returned.  Yours will be different.  We have to get the GUID before creating the final step – the override.

Now that I have my GUID for my custom Alert String Resource, I can create my override in XML:

<MonitorPropertyOverride ID="OverrideForMonitor.Microsoft.SystemCenter.Agent.MonitoringHost.PrivateBytesThreshold.AlertMessage" Context="SystemCenter!Microsoft.SystemCenter.Agent" Enforced="false" Monitor="SystemCenter1!Microsoft.SystemCenter.Agent.MonitoringHost.PrivateBytesThreshold" Property="AlertMessage"> <Value>DD29971E-6C67-1901-D242-15742629285D</Value> </MonitorPropertyOverride>

Notice I used the GUID I got from my SQL query.

Now – the above part is easy to get messed up on.

You need to match up the References to the MP containing “Microsoft.SystemCenter.Agent” and the MP containing the monitor: “Microsoft.SystemCenter.Agent.MonitoringHost.PrivateBytesThreshold”

These will be in the Manifest > References section of your MP:

<References> <Reference Alias="SystemCenter"> <ID>Microsoft.SystemCenter.Library</ID> <Version>7.0.8443.6</Version> <PublicKeyToken>31bf3856ad364e35</PublicKeyToken> </Reference> <Reference Alias="SystemCenter1"> <ID>Microsoft.SystemCenter.2007</ID> <Version>10.19.10311.0</Version> <PublicKeyToken>31bf3856ad364e35</PublicKeyToken> </Reference> </References>

You need to match up the Reference Alias with what is in your MP.  These might already match fine, or might need to be changed – depending on how the Override MP was initially created, and what tools added references….. as the aliases are not standardized.

Now Import the MP.

New alerts look MUCH better:



Now, the question might be – what kind of additional, dynamic data can we include in this alert to make it even better?

I’m glad you asked!

We can also include any context that is part of the monitor state change.  These are usually propertybags that are part of the module output.

The override is for “AlertParameter1”, “AlertParameter2”, etc.

You can see these Context properties in Health Explorer, if your monitor has them:


So in this specific case, I can add into the Alert Description, the InstanceName, which will tell me specifically which process in Perfmon was the problem, and the Last Sampled Value.

First, I will add in overrides for each of these above.  You can get examples from this link.

<MonitorPropertyOverride ID="OverrideForMonitor.Microsoft.SystemCenter.Agent.MonitoringHost.PrivateBytesThreshold.AlertParameter1" Context="SystemCenter!Microsoft.SystemCenter.Agent" Enforced="false" Monitor="SystemCenter1!Microsoft.SystemCenter.Agent.MonitoringHost.PrivateBytesThreshold" Property="AlertParameter1"> <Value>$Data/Context/InstanceName$</Value> </MonitorPropertyOverride> <MonitorPropertyOverride ID="OverrideForMonitor.Microsoft.SystemCenter.Agent.MonitoringHost.PrivateBytesThreshold.AlertParameter2" Context="SystemCenter!Microsoft.SystemCenter.Agent" Enforced="false" Monitor="SystemCenter1!Microsoft.SystemCenter.Agent.MonitoringHost.PrivateBytesThreshold" Property="AlertParameter2"> <Value>$Data/Context/SampleValue$</Value> </MonitorPropertyOverride>

Lastly – we need to include these in our AlertDescription. 

AlertParameter1 = {0}

AlertParameter2 = {1}

AlertParameter3 = {2}


<DisplayString ElementID="Overrides.SCOM.Agent.Thresholds.Microsoft.SystemCenter.Agent.MonitoringHost.PrivateBytesThreshold.AlertMessage"> <Name>Agent Resources Exceeded Threshold: MonitoringHost Private Bytes is too high.</Name> <Description>The Agent is consuming too many resources. MonitoringHost Private Bytes has exceeded a threshold. Last Sampled Value: {1} Instance Name: {0} </Description> </DisplayString>

Now look at these alerts!



You can use this process to override the Alert Name and Description for pretty much any SCOM Monitor.


1. Create a new StringResource (in the Presentation/StringResources section of the XML)

2. Create a new DisplayString (in the LanguagePacks section of the XML) that references your string resource and includes your modified Alert Name and AlertDescription.

3. Import this MP.

4. Get the GUID of your StringResource from SQL

5. Create a new Override in the XML, for “AlertMessage” property, with the GUID from above.


That’s it!  The first couple times you do this it can feel a bit complicated, but once you do it a few times it gets easier, especially once you understand the issues with getting the right Reference Aliases for your MP you are using.


Credit for this article goes to Marius Sutara, who wrote about this capability many years ago:  LINK


That’s great Kevin.  What about rules?

Sad smile

I have not figured out a way to make this work with rules.  Rules generate Alerts differently, using a WriteAction.  More specifically:  “System.Health.GenerateAlert” in the System.Health management pack.  This write action only allows for Priority and Severity to be overridden.  So for rules, the best solution is likely the old way – disable the rule, then create your own copy of the rule and customize your Alert Name and Description.


  1. Curtiss

    Can we edit the notifications mp so it will put the word “warning” or “critical” for the severity in a notification email, instead of the number 1 or 2?

  2. Chris McIntyre

    I’m guessing the GUID is going to be unique for each Management Group? I have a synchronization process in place that synchronizes MPs across multiple Management Group. If the GUID is unique that would complicate things a bit for me. I could just create a MP just for this that isn’t synced, but my first choice would be to include it in an existing synchronized MP.

  3. Tom

    Hi Kevin;

    This is an excellent feature that I hope I can take advantage of; but I’m having trouble with the last piece – matching the reference aliases for the final override. Any advice you can offer to work this out?
    I’m trying to override the error message for the monitor “ICMP Ping” (scope Node > Availability > Network Device Responsiveness > ICMP Ping)

  4. Tom

    Well – happily, the law of “making a fool of onesself” stepped in – as soon as I’d posted your comment I went back to troubleshooting the XML and got the issue resolved.

    My solution was to make a new MP with just one override (enabling the alert which would otherwise be disabled) and then copying & modifying that override with the value pulled from the DB. In this way, all that needed to be modified was the override ID and the value – the Context and Monitor values were already correct.

    However! I’m now encountering an issue with adding extra information to the alert:

    The monitor:
    ICMP Ping (again – Node > Availability > Network Device Responsiveness > ICMP Ping) is overridden to generate an alert, and I’ve now been able to change the alert name to something useful.
    In the health Explorer, I can see the value I’m looking for to add to the description: “Ping Destination”.
    I’d like to add this plus “Display Name” to the alert description – but when I try, I either get XML reference errors when I try to add it in, or “{0}”, or both.

    The last override I made that imported was:


    I used this as the reference for the monitor’s data sources:

    Thanks for any assistance you can offer!

  5. Trent

    Hi Kevin –

    I’m struggling with the last piece where you inserted alert parameters – can you include your XML where you’re defining the parameters (where you’ve got “AlertParameter1 = {0}” and so on defined) so I can see what I’m doing wrong?

    All I get in my alert body is ” {0} “

    • Kevin Holman

      I am defining these in the overrides for AlertParameter1, etc. One you have this override in place for AlertParameter1 with a value that is correct, you can use {0} in the alert description. If it does not resolve correctly, then you will just see {0} in the Alert Description, and probably get an alert that an alert variable could not be resolved.

  6. Andy Perry

    Hi Kevin,

    With regards to the string resources, what is the benefit of using this in Management Packs? I am documenting the SharePoint pack at the moment using MP Author and have noticed that all of the Display Name and Descriptions are blank. I have a feeling that this may be the case with others too but I had just assumed that they had left them blank!

    What seems to be going on is that all of these descriptions are linked to as String Resources. So I can see those in MP Author but this makes a job of documentation that is already hard, even harder! 🙁

    Is this just a time saver when authoring or are there actual performance benefits to doing it this way?


      • ANDY PERRY

        No worries. Currently using a combination of MP Viewer and MP Studio to get the info. Just thought it was strange.

        Not sure why MP Viewer can see it though, but MP Author can’t.

        I guess it would be too easy if everything just worked 🙂


  7. Jarrad Walters

    This is really good to know.
    I’m now writing a sealed MP to monitor all our services based off CMDB data.
    I was hoping to find a way to make the alert description overrideable in case some customers require a specific action on a specific group of services but i can’t find any examples of solutions with alerts strings inside the monitor type.

    Do you have any recommendations for future developers to make this easier for clients?

  8. Mitch Luedy

    Hi Kevin,

    Thank you for publishing this great information, we’ve made some valuable changes to our alerts already after reading this.

    Is it possible to add $Target$ variables into the alert description with an override or are only the monitor output items available for use? I tried something like this, but it ended up causing the monitor to not initialize.


  9. Peter Moore

    Hi Kevin,
    This has worked nicely for a monitor, but for a rule the syntax is rather different and struggling to fine a way to apply the same kind of thinking to a alert from a rule.

  10. Peter Moore

    this is what I have but i get an error – The ‘ElementID’ attribute is invalid – The value ‘’ is invalid according to its datatype ‘ManagementPackIdentifierReference’ – The Pattern constraint failed.
    for myserver – P2 Incident to be created send to Platforms-Global team to restart Service in “my Machines Manager” KB0022377.

    more display strings blablabla

    • Kevin Holman

      I do not believe this is possible for a rule…. all rules use System.Health.GenerateAlert as the Write Action.

      The only Overrideable parameters on that Write Action are for Priority and Severity.

      So the only way to make this work for rules, would be to file a bug and ask the product group to modify this write action, and expand the scope of overrideable properties. I doubt they would, at this stage of the game, as this module hasn’t been changed in 15 years, and the workaround is simply disable the rule, and re-write an exact copy of the rule in your own MP, if you want a different alert name/description.

  11. Mohan

    Hi Kevin,

    I’ve challenge in getting Diagnostic Output result in SCOM alert description in Custom MP.

    If you could help me it will great …

    Thank you

    Regards | Mohan Ram K

Leave a Reply

Your email address will not be published.