SCOM 2016, generate reboot/shutdown alert but for a specific group of servers

Question

Hello guys,

I'm looking a way to generate an alert for the event ID 1074, 6008 for a specific group of Windows servers.

I was able to generate alert for the class of Windows computer with these event IDs but it's working for any Windows server.

Does it exist another way to generate this alert for a specific group of windows servers?

Thank you very much

Answer 1

Create a custom group containing group of servers which you want to monitor reboot/shutdown event and then create event alert for event ID 1074, 6008 and target the custom created group.

Roger

Answer 2

Hi,

As Roger mentioned, a monitor or rule is applied to a specific class. To change the value for a parameter of a rule or monitor, you create an override for a group.

When you select this option for your override, the override settings apply only to members of the group. The rule or monitor without the override settings continues to apply to all objects in the targeted class except for those objects that are also members of the group used for the override.

https://learn.microsoft.com/en-us/system-center/scom/manage-mp-overview-override-targets?view=sc-om-2019#overrides