SCOM override is not effective

Question

Hi,

I have an issue with an override implemented as follows:

• In a sealed management pack "MP-A" a disabled rule "Rule-A" is created. Its target is the "Microsoft.Windows.Library!Microsoft.Windows.Server.DC.Computer" class.
• In a sealed management pack "MP-B" a class "Class-B" is defined using the hosted "Microsoft.Windows.Library!Microsoft.Windows.LocalApplication" base class.
• "Class-B" instances are discovered successfully.
• In a non-sealed management pack "MP-C" a rule property override is defined that enables the rule "MP-A!Rule-A" for the class "MP-B!Class-B".

I found that the rule "MP-A!Rule-A" is not effective on instances of "MP-B!Class-B" class.

Why the rule is not effective?

Answer 1

I would say the override is not working because MP-B!Class-B does not host Microsoft.Windows.Library!Microsoft.Windows.Server.DC.Computer, it's actually the opposite.

Answer 2

@CyrAz : What do you mean by "it's actually the opposite"?

Answer 3

Microsoft.Windows.Server.DC.Computer uses Microsoft.Windows.Server.Computer as its base class, so an instance of Microsoft.Windows.Server.DC.Computer is also an instance of Microsoft.Windows.Server.Computer (and therefore also an instance of Microsoft.Windows.Computer).
And Microsoft.Windows.Computer hosts Microsoft.Windows.LocalApplication.

Answer 4

What you could do is create a group of Windows Computers that contains an instance of Class-B, and then create the override for that group. That should work.
Here is how you create groups with containment rules : https://kevinholman.com/2020/07/09/how-to-create-a-scom-group-of-disks-that-are-related-to-an-application-using-contained-and-contains/
(except you will use Windows.Computer instead of LogicalDisk)

Answer 5

Thanks for the response.

Using SCOM groups is not an option, I try to avoid using SCOM Groups due to the load it puts on SCOM - this is why I tried to create classes and override the monitoring on them.

The workaround solution was to change the base of the classes to a corresponding base class - for example if the target of the monitor to override is the "Microsoft.Windows.Server.DC.Computer" class then the base class of "MP-B!Class-B" is also the "Microsoft.Windows.Server.DC.Computer" class.

It seems now the overrides work as expected.

Anyway I need to work on it to understand how that override option "For all objects of another class..." - that is available on SCOM GUI - actually works, what kind of classes can be used effectively.
It is a bit confusing for me now, because when I targeted a monitor directly to the class with "Microsoft.Windows.LocalApplication" as base class, the monitoring worked fine. But when I tried to use this class as an override target, it did not work. It's weird.