SCOM alert subscription Or logic changes to AND logic

Question

I'm trying to set up SCOM alert subscriptions for a number of related Dell monitors, I want to trigger notifications on any new critical alerts from any one of 8 different monitors. But every time I build the subscription and save it, my "or" logic is changed to "and" logic.

The basic structure is

AND Group (
AND Group (
severity = critical
resolution state = new
)
Or Group (
monitor = mon1
monitor = mon2
etc
)
)

But every time I save the subscription, the logic changes and my OR group is replaced with an AND group. Below is the exact formula that changes.

When I'm still in the wizard (before I save) the formula is:

( ( ( Severity Equals Critical ) AND ( Resolution state Equals New (0) ) ) AND ( ( Monitors Equals Dell OM Performance : Ambient Temperature Average Threshold AlertMonitor ) OR False ) AND ( Monitors Equals Dell Server Availability Rollup (from Dell Server Memory) ) AND ( Monitors Equals Dell Server Availability Rollup (from Dell Server Power Supplies) ) AND ( Monitors Equals Dell Server Availability Rollup (from Dell Server Processors) ) AND ( Monitors Equals Dell Server Availability Rollup (from Dell Server Sensors) ) AND ( Monitors Equals Dell Server Availability Rollup (from Dell Server Storage) ) AND ( Monitors Equals Dell Server Availability Rollup (from iDRAC) ) AND ( Monitors Equals Dell Server Availability Rollup (from OpenManage Software Services) ) )

After saving the formula changes to below, notice there is a missing "(" followed by a missing "OR False )"

( ( ( Severity Equals Critical ) AND ( Resolution state Equals New (0) ) ) AND ( Monitors Equals Dell OM Performance : Ambient Temperature Average Threshold AlertMonitor ) AND ( Monitors Equals Dell Server Availability Rollup (from Dell Server Memory) ) AND ( Monitors Equals Dell Server Availability Rollup (from Dell Server Power Supplies) ) AND ( Monitors Equals Dell Server Availability Rollup (from Dell Server Processors) ) AND ( Monitors Equals Dell Server Availability Rollup (from Dell Server Sensors) ) AND ( Monitors Equals Dell Server Availability Rollup (from Dell Server Storage) ) AND ( Monitors Equals Dell Server Availability Rollup (from iDRAC) ) AND ( Monitors Equals Dell Server Availability Rollup (from OpenManage Software Services) ) )

here are screen shots of the issue for clarification:

Before save:

After save:

Answer 1

Hi,

Just done a quick lab test with SCOM 2019: if same condition is used, for example, monitors, we can select multiple monitors in the search box and add them (and the actual logic is OR).

When we set multiple values for the same conditions during design phase as the first picture shown above, to simplify the statement, the UI will combine them with ;(semikolon) as shown below.

( ( Monitors Equals neptune01;[Deprecated] Logical Disk Free Space ) AND ( Resolution state Equals New (0) ) AND ( Severity Equals Critical ) )

To verify this, I added two different conditions (not monitors) and the OR group exists after it was saved, as expected.

( ( Monitors Equals neptune01;[Deprecated] Logical Disk Free Space ) AND ( ( Rules Equals % Disk Time (Solaris 10) ) OR ( Instance name Equals /LM/W3SVC/1185638420/ROOT/Orchestrator2012 ) ) AND ( Resolution state Equals New (0) ) AND ( Severity Equals Critical ) )

Alex
If the response is helpful, please click "Accept Answer" and upvote it.