Menu Close

How to override the Alert Name and Alert Description of a Sealed Monitor

Most people do not realize this is even possible.

Many times alerts are generated from sealed management packs, and SCOM Admins wish they could change the Alert Name, or the Alert Description.  Another common scenario, is that sometimes a monitor is designed by the MP author to change state only, and there is no “AlertSettings” configuration in the monitor XML.  In this case, if you override the monitor to create alerts, they are ugly, where the alert name is the ID of the monitor itself.

Changing the alert name/description is not normally possible, as it is not easily modified in the UI.  However, it CAN be done through XML.  There is on override-able property on alerts, called “AlertMessage”.  It is simply hidden from the UI.

 

Let’s use an example, for a monitor that does not alert by default, but we NEED this to alert, and have a decent alert name and description.

I will pick “Monitoring Host Private Bytes Threshold” monitor:

image

 

It does not alert by default:

image

 

The first thing I will do, is create an Override MP to contain these special overrides:

image

 

Then set some typical overrides to enable alerting for this Monitor:

image

 

Here is the problem:  When this monitor generates an alert, they are ugly.  Since the monitor had no AlertSettings configuration initially, the AlertName defaults to the ID of the monitor, and the Alert Description is completely empty ( YUCK! ):

image

 

To “fix” this, we have to Export the MP, open the MP XML file, and work in XML from here.  First, we need to create an Alert String Resource, and a typical DisplayString for our Override for name and description.

This will be placed in the <StringResources> section after <Folders>:

Here is my String Resource:

<Presentation> <Folders> <Folder ID="Folder_a04378a1dbaf424ba5b223376aea38c7" Accessibility="Public" ParentFolder="SystemCenter!Microsoft.SystemCenter.Monitoring.ViewFolder.Root" /> </Folders> <StringResources> <StringResource ID="Overrides.SCOM.Agent.Thresholds.Microsoft.SystemCenter.Agent.MonitoringHost.PrivateBytesThreshold.AlertMessage" /> </StringResources> </Presentation>

You can make this anything you want really.  We will actually reference this string to the monitor in an override a bit later.

In addition, I need to add a display string with the new name and description I wish to use:

<DisplayString ElementID="Overrides.SCOM.Agent.Thresholds.Microsoft.SystemCenter.Agent.MonitoringHost.PrivateBytesThreshold.AlertMessage"> <Name>Agent Resources Exceeded Threshold: MonitoringHost Private Bytes is too high.</Name> <Description>The Agent is consuming too many resources. MonitoringHost Private Bytes has exceeded a threshold.</Description> </DisplayString>

This is what my Presentation and LanguagePacks sections look like now:

<Presentation> <Folders> <Folder ID="Folder_a04378a1dbaf424ba5b223376aea38c7" Accessibility="Public" ParentFolder="SystemCenter!Microsoft.SystemCenter.Monitoring.ViewFolder.Root" /> </Folders> <StringResources> <StringResource ID="Overrides.SCOM.Agent.Thresholds.Microsoft.SystemCenter.Agent.MonitoringHost.PrivateBytesThreshold.AlertMessage" /> </StringResources> </Presentation> <LanguagePacks> <LanguagePack ID="ENU" IsDefault="false"> <DisplayStrings> <DisplayString ElementID="Overrides.SCOM.Agent.Thresholds"> <Name>Overrides - SCOM Agent Thresholds</Name> </DisplayString> <DisplayString ElementID="Folder_a04378a1dbaf424ba5b223376aea38c7"> <Name>Overrides - SCOM Agent Thresholds</Name> </DisplayString> <DisplayString ElementID="Overrides.SCOM.Agent.Thresholds.Microsoft.SystemCenter.Agent.MonitoringHost.PrivateBytesThreshold.AlertMessage"> <Name>Agent Resources Exceeded Threshold: MonitoringHost Private Bytes is too high.</Name> <Description>The Agent is consuming too many resources. MonitoringHost Private Bytes has exceeded a threshold.</Description> </DisplayString> </DisplayStrings> </LanguagePack> </LanguagePacks>

 

Now – we can import this MP with these changes.  This doesn’t change the alert yet, this is just setting up to create the override.  However, this type of override must reference the unique GUID of the StringResource, so we need to get that GUID first, before we continue.  We can easily do that now, using a SQL query to find the GUID for the string we just created.  Query your OpsDB:

SELECT StringResourceId FROM StringResource WHERE StringResourceName = 'Overrides.SCOM.Agent.Thresholds.Microsoft.SystemCenter.Agent.MonitoringHost.PrivateBytesThreshold.AlertMessage'

image

This what mine returned.  Yours will be different.  We have to get the GUID before creating the final step – the override.

Now that I have my GUID for my custom Alert String Resource, I can create my override in XML:

<MonitorPropertyOverride ID="OverrideForMonitor.Microsoft.SystemCenter.Agent.MonitoringHost.PrivateBytesThreshold.AlertMessage" Context="SystemCenter!Microsoft.SystemCenter.Agent" Enforced="false" Monitor="SystemCenter1!Microsoft.SystemCenter.Agent.MonitoringHost.PrivateBytesThreshold" Property="AlertMessage"> <Value>DD29971E-6C67-1901-D242-15742629285D</Value> </MonitorPropertyOverride>

Notice I used the GUID I got from my SQL query.

Now – the above part is easy to get messed up on.

You need to match up the References to the MP containing “Microsoft.SystemCenter.Agent” and the MP containing the monitor: “Microsoft.SystemCenter.Agent.MonitoringHost.PrivateBytesThreshold”

These will be in the Manifest > References section of your MP:

<References> <Reference Alias="SystemCenter"> <ID>Microsoft.SystemCenter.Library</ID> <Version>7.0.8443.6</Version> <PublicKeyToken>31bf3856ad364e35</PublicKeyToken> </Reference> <Reference Alias="SystemCenter1"> <ID>Microsoft.SystemCenter.2007</ID> <Version>10.19.10311.0</Version> <PublicKeyToken>31bf3856ad364e35</PublicKeyToken> </Reference> </References>

You need to match up the Reference Alias with what is in your MP.  These might already match fine, or might need to be changed – depending on how the Override MP was initially created, and what tools added references….. as the aliases are not standardized.

Now Import the MP.

New alerts look MUCH better:

image

 

Now, the question might be – what kind of additional, dynamic data can we include in this alert to make it even better?

I’m glad you asked!

We can also include any context that is part of the monitor state change.  These are usually propertybags that are part of the module output.

The override is for “AlertParameter1”, “AlertParameter2”, etc.

You can see these Context properties in Health Explorer, if your monitor has them:

image

So in this specific case, I can add into the Alert Description, the InstanceName, which will tell me specifically which process in Perfmon was the problem, and the Last Sampled Value.

First, I will add in overrides for each of these above.  You can get examples from this link.

<MonitorPropertyOverride ID="OverrideForMonitor.Microsoft.SystemCenter.Agent.MonitoringHost.PrivateBytesThreshold.AlertParameter1" Context="SystemCenter!Microsoft.SystemCenter.Agent" Enforced="false" Monitor="SystemCenter1!Microsoft.SystemCenter.Agent.MonitoringHost.PrivateBytesThreshold" Property="AlertParameter1"> <Value>$Data/Context/InstanceName$</Value> </MonitorPropertyOverride> <MonitorPropertyOverride ID="OverrideForMonitor.Microsoft.SystemCenter.Agent.MonitoringHost.PrivateBytesThreshold.AlertParameter2" Context="SystemCenter!Microsoft.SystemCenter.Agent" Enforced="false" Monitor="SystemCenter1!Microsoft.SystemCenter.Agent.MonitoringHost.PrivateBytesThreshold" Property="AlertParameter2"> <Value>$Data/Context/SampleValue$</Value> </MonitorPropertyOverride>

Lastly – we need to include these in our AlertDescription. 

AlertParameter1 = {0}

AlertParameter2 = {1}

AlertParameter3 = {2}

etc…etc…

<DisplayString ElementID="Overrides.SCOM.Agent.Thresholds.Microsoft.SystemCenter.Agent.MonitoringHost.PrivateBytesThreshold.AlertMessage"> <Name>Agent Resources Exceeded Threshold: MonitoringHost Private Bytes is too high.</Name> <Description>The Agent is consuming too many resources. MonitoringHost Private Bytes has exceeded a threshold. Last Sampled Value: {1} Instance Name: {0} </Description> </DisplayString>

Now look at these alerts!

image

 

You can use this process to override the Alert Name and Description for pretty much any SCOM Monitor or Rule.

Recap:

1. Create a new StringResource (in the Presentation/StringResources section of the XML)

2. Create a new DisplayString (in the LanguagePacks section of the XML) that references your string resource and includes your modified Alert Name and AlertDescription.

3. Import this MP.

4. Get the GUID of your StringResource from SQL

5. Create a new Override in the XML, for “AlertMessage” property, with the GUID from above.

 

That’s it!  The first couple times you do this it can feel a bit complicated, but once you do it a few times it gets easier, especially once you understand the issues with getting the right Reference Aliases for your MP you are using.

 

Credit for this article goes to Marius Sutara, who wrote about this capability many years ago:  LINK

 

That’s great Kevin.  What about rules?

Sad smile

I have not figured out a way to make this work with rules.  Rules generate Alerts differently, using a WriteAction.  More specifically:  “System.Health.GenerateAlert” in the System.Health management pack.  This write action only allows for Priority and Severity to be overridden.  So for rules, the best solution is likely the old way – disable the rule, then create your own copy of the rule and customize your Alert Name and Description.

9 Comments

  1. Curtiss

    Can we edit the notifications mp so it will put the word “warning” or “critical” for the severity in a notification email, instead of the number 1 or 2?

  2. Chris McIntyre

    I’m guessing the GUID is going to be unique for each Management Group? I have a synchronization process in place that synchronizes MPs across multiple Management Group. If the GUID is unique that would complicate things a bit for me. I could just create a MP just for this that isn’t synced, but my first choice would be to include it in an existing synchronized MP.

    • Kevin Holman

      I don’t think so. I believe we use an algorithm to assign GUID and it should be the same across MG’s.

  3. Tom

    Hi Kevin;

    This is an excellent feature that I hope I can take advantage of; but I’m having trouble with the last piece – matching the reference aliases for the final override. Any advice you can offer to work this out?
    I’m trying to override the error message for the monitor “ICMP Ping” (scope Node > Availability > Network Device Responsiveness > ICMP Ping)

  4. Tom

    Well – happily, the law of “making a fool of onesself” stepped in – as soon as I’d posted your comment I went back to troubleshooting the XML and got the issue resolved.

    My solution was to make a new MP with just one override (enabling the alert which would otherwise be disabled) and then copying & modifying that override with the value pulled from the DB. In this way, all that needed to be modified was the override ID and the value – the Context and Monitor values were already correct.

    However! I’m now encountering an issue with adding extra information to the alert:

    The monitor:
    ICMP Ping (again – Node > Availability > Network Device Responsiveness > ICMP Ping) is overridden to generate an alert, and I’ve now been able to change the alert name to something useful.
    In the health Explorer, I can see the value I’m looking for to add to the description: “Ping Destination”.
    I’d like to add this plus “Display Name” to the alert description – but when I try, I either get XML reference errors when I try to add it in, or “{0}”, or both.

    The last override I made that imported was:

    $Target/Property[Type=”NetworkManagement!System.NetworkManagement.Node”]/SNMPAddress$

    I used this as the reference for the monitor’s data sources:
    https://systemcenter.wiki/?GetElement=System.NetworkManagement.Node&Type=ClassType&ManagementPack=System.NetworkManagement.Library&Version=10.19.10050.0

    Thanks for any assistance you can offer!

  5. Trent

    Hi Kevin –

    I’m struggling with the last piece where you inserted alert parameters – can you include your XML where you’re defining the parameters (where you’ve got “AlertParameter1 = {0}” and so on defined) so I can see what I’m doing wrong?

    All I get in my alert body is ” {0} “

    • Kevin Holman

      I am defining these in the overrides for AlertParameter1, etc. One you have this override in place for AlertParameter1 with a value that is correct, you can use {0} in the alert description. If it does not resolve correctly, then you will just see {0} in the Alert Description, and probably get an alert that an alert variable could not be resolved.

Leave a Reply

Your email address will not be published. Required fields are marked *