This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(300.8, 71%, 39%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ERB%3C/text%3E%3C/svg%3E)
Hi,
Thanks for helping me out earlier.
We are facing a new issue in SCOM. We have set the resolution state for closed alert as 255 but for some alert it is behaving different. Even if the alert is closed in SCOM, the resolution state does not change. It shows its resolution state as 0. We are working on automation for the closure of alert. Like if any alert gets closed in SCOM the related incident also gets closed in Service now. But this is causing a breaker in the path.
Pease help me with this.
Best Regards,
Ravi Bhushan
Hi @Ravi Bhushan ,
To get a better understanding, could you please describe in detail how you are attempting to change the resolution states of your alerts?
When an alert gets generated the resolution state will always start with the resolution state of New (ID: 0), have you also made sure that it's simply the Operations Console that has not refreshed the resolution state status?
----------
(If the reply was helpful please don't forget to upvote or accept as answer, thank you)
Best regards,
Leon
Yes when any alert gets generated it has a resolution state of 0 and for closed it is seta as 255 in the SCOM. This is what set in our SCOM Environment.
The issue is the state is not getting changed for certain alert even if it is closed in SCOM. It is howing resolution state as 0 even if it gets closed
If the alert is for a monitor (like a service stopped, logical disk space, etc.) and you close the alert without fixing the underlying issue (like restarting the service), the state of the monitor will still be in error/warning because the condition is still true. If you want the state of the monitor to change, you have to fix the issue.
It's bad practice to close an alert for a monitor without fixing the issue.
Hi AndrewTabar-2806,
This alert automatically gets closed in SCOM. It was for some other team and yes the work has been done for this alert. checked with the concerned team.
OK, just making sure that you weren't doing something wrong.
I notice in the history (screen capture) of your example alert that the alert is generated at 02:32 and then resolved by the system at 02:33 (one minute later). I wonder if that's an issue. Is this happening for other alerts where they're open for a short time?
Alert opened on 11th at 02:32 and closed on 12th at 02:33.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(92.8, 31%, 18%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EC%3C/text%3E%3C/svg%3E)
Nope he's right, alerts is resolved by the system a first time at 2:33 on the 11th, then it gets changed to SNOW ticket, then it's resolved again by the system at 2:33 on the 12th.
That doesn't really explain why the resolution status is "0" but it still looks wrong somehow.
HI @Ravi Bhushan ,
In addition to what Leon suggested I would recommend checking the state with PowerShell:
Get-SCOMAlert -ResolutionState 0
or
Get-SCOMAlert -ResolutionState 255
Where do you see the closed alerts, under which Resolution State?
Regards,
Stoyan
For most it is showing as 255. We have setup a script where if any alert has a resolution code as 255 it should automatically gets closed in Servicenow. We have validated the script on other projects. But certain alerts even after getting closed is not showing resolution code as 255. Showing the same 0.
Can you provide a few examples of the alerts that are not changing resolution state?
Also provide the script that you are using to change the resolution state.
Hey,
agree with Leon, an example would be great!
Regards,
Stoyan
IntegrationId ded81421-9400-49aa-92cf-07440d22a0ed | Status = NEW | Id = ded81421-9400-49aa-92cf-07440d22a0ed | ManagementGroupId = xxxxxxxxxxxxxxxxxxxxxxxxxxx | ManagementGroupName = N/A | ManagementGroup = xxxxx | ClientHost = xxxxxx | MonitoringObjectId = fa3c11c9-0ca4-349a-d9a8-481cc546b3b1 | MonitoringClassId = 6bad884b-8b0e-a406-5424-32e962dea214 | IsMonitorAlert = True | ProblemId = aa576e09-5bc5-4928-cd80-54e280f6c83d | MonitoringRuleId = aa576e09-5bc5-4928-cd80-54e280f6c83d | MonitoringObjectDisplayName = HPR | MonitoringObjectName = HPR | MonitoringObjectPath = HPR | MonitoringObjectFullName = Microsoft.SystemCenter2012.ConfigurationManager.PrimarySite:HPR | ResolutionState = 0 | Priority = Normal | Severity = Error | Category = Custom | Owner = N/A | ResolvedBy = N/A | TimeRaised = 2020/11/11 02:32:12.320 | TimeAdded = 2020/11/11 02:32:12.173 | LastModified = 2020/11/12 02:32:27.053 | LastModifiedBy = System | TimeResolved = N/A | TimeResolutionStateLastModified = 2020/11/11 02:40:02.483 | CustomField1 = N/A | CustomField2 = N/A | CustomField3 = N/A | CustomField4 = N/A | CustomField5 = N/A | CustomField6 = N/A | CustomField7 = N/A | CustomField8 = N/A | CustomField9 = N/A | CustomField10 = N/A | TicketId = INC0323592 | ConnectorId = 14020a64-5b20-4240-84dc-f9e45957d8c1 | LastModifiedByNonConnector = 2020/11/12 02:32:27.053 | MonitoringObjectInMaintenanceMode = False | MonitoringObjectHealthState = Error | ConnectorStatus = Pending | RepeatCount = 1 | NetbiosComputerName = HPR | NetbiosDomainName = N/A | PrincipalName = N/A | SiteName = N/A | MaintenanceModeLastModified = 1900/01/01 00:00:00.000 | StateLastModified = 2020/10/28 18:16:46.227 | Parameters = System.Collections.ObjectModel.ReadOnlyCollection.1[System.String] | Name = Content distribution alert | Description = The content distribution of site HPR-Horizon does not work. | HasKnowledge = false
Related to Script, I am sorry to say but we can't provide as it set by the client.
I'm afraid it will be difficult to troubleshoot without having a look at the script itself.
Hi,
Although i cannot provide the script but basic concept to this script is whenever it receives id=255, then it triggers event to Service now to close the alert there. The issue is it is not receiving the id =255, instead it is getting id = 0(Which is for new alert).
Alert is generated by a Monitor (IsMonitorAlert = true).
Are you running SCOM 2019? If yes, alerts coming from a monitor can't be closed anymore as long as their source object is not healthy.
It is SCOM2012 R2