Monitor Alert

Applies To: System Center 2012 - Orchestrator, System Center 2012 R2 Orchestrator, System Center 2012 SP1 - Orchestrator

The Monitor Alert activity triggers a runbook when new System Center Operations Manager alerts are generated, and when existing System Center Operations Manager alerts are updated, according to filter criteria that you specify. You can use the Monitor Alert activity to trigger a diagnostic and corrective runbook that responds to critical alerts in your network.

The Monitor Alert activity uses filters to determine which properties of an alert will trigger the runbook. Each part of the alert is compared to the values of the filter to determine if they meet the criteria before triggering the runbook. When matching against text fields, you select one of three different methods of comparison. An option is provided to either match or not match the filter using each method. The "Does not" version of each method causes alerts that do not match the filter to trigger the runbook.

• Equals: the property of the alert exactly matches the text specified in the filter.

• Does not equal: the property of the alert does not exactly match the text specified in the filter.

• Contains: the property of the alert contains the exact text specified in the filter. Unlike the Equals behavior, there can be other text surrounding the matching text.

• Does not contain: the property of the alert does not contain the exact text specified in the filter. Unlike the Equals behavior, there can be other text surrounding the matching text.

• Matches pattern: use wildcards to specify a pattern that the text must match. The two wildcard values are the asterisk (*) and the question mark (?). The behavior of the wildcards is similar to the Command Prompt. The asterisk will match any number of characters, while the question mark will only match one character. For example, if you have a filter specified as "a*b", the pattern would match any text that has an "a" at the beginning and a "b" at the end. So, it will match "aab", "abbbbbb", and "abbcb", but it will not match "ba" or "abba". Using the question mark, if you have a filter specified as "a?b", the pattern will match any text that has an "a" at the beginning, any single character in the middle, and "b" at the end. So this filter will match "a b", "abb", and "aqb", but it will not match "abbb" or "ab".

• Does not match pattern: use wildcards to specify a pattern that the text must not match.

For the procedure to configure this object, see: Configuring the Monitor Alert Activity.

The following tables list the filters, properties, and published data for this activity. The activity publishes all of the data from the required and optional properties into published data.

Monitor Alert Filters

Monitor Alert Published Data

Configuring the Monitor Alert Activity

To configure the Monitor Alert activity

1. From the Activities pane, drag a Monitor Alert activity to the active runbook.

2. Double-click the Monitor Alert activity icon. The Properties dialog opens.

3. Configure the settings in the Details tab:

   1. In the Server section, click the ellipsis button (...), and select the Operations Manager server Connection that you want to use for this activity. Click OK.

   2. In the Triggers section, select the type(s) of alerts, New and/or Updated, that are applicable to this runbook. Each alert of the specified trigger type will be compared to the values of the filter(s) to determine if they meet the criteria before triggering the runbook.

   3. In the Filters section, at least one filter is required to define the activity. Click Add. In the Name box, click the down arrow and select a property from the list.

   4. In the Relation box, click the down arrow and select a filter type.

   5. In the Value box, enter the value you want to use.

      You can also use published data to automatically populate the value of the property from the data output by a previous activity in the runbook.

      To filter on NULL values

      1. In the Filters section, click Add. In the Name box, click the Down Arrow and select a property from the list.

      2. In the Relation box, select Equals.

      3. In the Value box, input the value NULL.

      To filter on IsNotNull values

      1. In the Filters section, click Add. In the Name box, click the Down Arrow and select a property from the list.

      2. In the Relation box, select Does not equal.

      3. In the Value box, input the value NULL.

      To use published data

      1. Right-click the property value box, click Subscribe, and then click Published Data.

      2. Click the Activity drop-down box and select the activity from which you want to obtain the data.

      3. To view additional data elements common across the runbook, select Show Common Published Data.

      4. Click the published data element you want to use, and then click OK.

         For a list of the data elements published by each activity, see the Published Data tables in the activity topic. For information about the Common Published Data items, see Published Data.

   6. Click OK to save the filter settings.

   7. Add additional filters as needed, and then click Finish.

      Tip

      Filter properties can only be used once in an activity. For example, if your search criteria for an alert includes a date range, you cannot use the TimeAdded filter property twice in the same activity. However, you may be able to use the TimeAdded After Date and TimeRaised Before Date filter properties to achieve the desired results.

4. To make changes to a filter, click the filter and then click Edit. Make the changes, and then click OK.

   To remove a filter, click the filter and then click Remove.

5. For information about the settings on the General and Run Behavior tabs, see Common Configuration Instructions for All Activities.

6. Click Finish.

Other Activities

The Integration Pack for System Center Operations Manager contains the following additional activities:

• Create Alert

• Get Alert

• Get Monitor

• Monitor State

• Start Maintenance Mode

• Stop Maintenance Mode

• Update Alert