SCOM 2019 Report for Closed alerts per week or a day

D D 6 Reputation points
2022-05-24T16:02:17.913+00:00

Is there a good report available online or a SQL query to the Data Warehouse to show all Closed Alerts per week and the user who closed them. The built in reports won't allow you to specify resolution state. I found an Article by Kevin Holman but I need weekly and daily report for all closed alerts to include the Alert name the user who closed it and the date...

Operations Manager
Operations Manager
A family of System Center products that provide infrastructure monitoring, help ensure the predictable performance and availability of vital applications, and offer comprehensive monitoring for datacenters and cloud, both private and public.
1,410 questions
0 comments

2 answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. SChalakov 10,261 Reputation points MVP
    2022-05-25T06:09:23.647+00:00

    Hi,

    there are plenty of them, but it would be hard to find one that is 100% matching your requirments. You will have to dev it yourslef. I have currently no access to SCOM, but I would start like this: 

    --To view a count of all alerts closed by all users:
select statesetbyuserid, count(*) as 'Number of Alerts' 
from Alert.vAlertResolutionState ars 
where resolutionstate = '255' 
group by statesetbyuserid 
order by 'Number of Alerts' DESC

    You can add additional resolution states here.
    After you check the results, you could limit the results byy using filtering coondition on the time frame.

    This comes again from Kevin.

    (If the reply was helpful please don't forget to upvote or accept as answer, thank you)
    Regards,
    Stoyan

    0 comments
  2. D D 6 Reputation points
    2022-05-25T16:31:05.777+00:00

    Stoyan,

    I already have this but it doesn't even allow you to specify for a specific timeframe. Like if i want to list closed alerts for this week. Veeam has a report library that has a report for alerts but its not very helpful either. In your query I would need it to show the name of the alert and also timeframe like for the last week. How would this query look like ?

    0 comments