Share via

Multiple SCOM Alerts for the same unique Windows Event

Graham Parker 1 Reputation point
2022-03-30T01:50:53.31+00:00

Hello, was there an answer as to why Multiple SCOM Alerts for the same unique Windows Event? I am seeing this with SCOM 2019.

Thanks.

Graham.

System Center Operations Manager
System Center Operations Manager

A family of System Center products that provide infrastructure monitoring, help ensure the predictable performance and availability of vital applications, and offer comprehensive monitoring for datacenters and cloud, both private and public.

0 comments

6 answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Graham 176 Reputation points
    2022-08-03T13:47:18.923+00:00

    Could you confirm number of events, number of alerts and number of emails. Graham Parker in the original post mentioned 1 event to 3 SCOM alerts in the SCOM console but no details about number of emails.

    You seem to have a different issue 1 event to 1 SCOM alert in the SCOM console to 3 emails. Do you include the workflowid and subscription id in the email to confirm that they are all from the same workflow \ subscription?

    Does this only impact rules? Or rules and monitors? If monitors then I'd suspect a misconfigured monitor that is triggering health state changes so that it looks like you have only one alert but if you look at health explorer you'll see the monitor doing a quick flip \ flop similar to what Kevin explains here - https://kevinholman.com/2009/11/24/writing-monitors-to-target-logical-or-physical-disks/ (I appreciate you are not doing disk monitoring but the concept is the same).

    Perhaps create a closed alert view on that specific type of alert and confirm that an alert isn't closing straight away. Do you have any automation tool that manipulates the alerts that might be impacting this?

    You have also mentioned forwarded events. So to confirm; you have configured Windows Event Log Forwarding so events are being forwarded from the event log on one server (which I'm guessing does not have a SCOM agent installed) to the event log on another which does have a SCOM agent installed. This isn't something I've done in the past but I might be able to test in my lab. Which log is this ? Security? Is it from Domain Controllers? Password reset events?

    Was this answer helpful?

  2. SChalakov 10,781 Reputation points MVP Volunteer Moderator
    2022-08-03T08:35:29.28+00:00

    Hi Graham,

    I think I get it now. I don't think that the same event is picked up by different rules, otherwise you will see this in the console. Each alert in the console shows the workflow that generated the alert (a rule or a monitor), so you would have noticed this.
    In my opinion, you need to look for clues either on the agent directly (Health Changes, Maintenance Mode related issues, Events in the Opsmgr event log, etc.) or on its corresponding management server.
    Does this happen in a intermittent way or it can be reproduced? Is the same rule the cause? anyy Mainatenance Mode schedules involved?

    ----------

    (If the reply was helpful please don't forget to upvote and/or accept as answer, thank you)

    Regards
    Stoyan Chalakov

    Was this answer helpful?

  3. Jan Slansky 6 Reputation points
    2022-08-03T07:48:21.157+00:00

    Same here. 3 alerts for one unique Event.

    Was this answer helpful?

  4. Graham Parker 1 Reputation point
    2022-03-30T22:24:30.45+00:00

    Hi Stoyan,

    I don't think it is to do with Alert Suppression as I have this configured.

    I have is the same issues as in the original post, and that is when only one event is created in the Windows Log file, 3 alerts are generated in the SCOM Console for the one logged event.

    When the same event (only one) is logged in the Windows log file again, 3 more alerts are generated in the SCOM Console and they Dup so Alert Suppression is working. So now I have 3 alerts Dup'd.

    When the same event (only one) is logged in the Windows log file again, 3 more alerts are generated in the SCOM Console and they Dup again.

    So now 3 events in the Windows Event Log, and 9 alerts generated which all dup up, that is, 3 alerts each Dup'd 3 times each.

    Any ideas?

    Regards,
    Graham.

    Was this answer helpful?

    0 comments
  5. SChalakov 10,781 Reputation points MVP Volunteer Moderator
    2022-03-30T12:50:05.587+00:00

    Hi Graham,

    if you are using a custom Rule and you haven't configured Alert Supression, then this is expected. The rule will simply generate one Alert for each logged Event.
    i would like to point to a similar thread here, answered by one of the Experts - CyrAz:

    SCOM 2019 - Alert Suppresion for same alerts on same agent
    scom-2019-alert-suppresion-for-same-alerts-on-same.html

    I hope I could help you out with this.

    ----------

    (If the reply was helpful please don't forget to upvote and/or accept as answer, thank you)

    Regards
    Stoyan Chalakov

    Was this answer helpful?

    0 comments

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.