question

JesperRuneLarsen-0387 avatar image
0 Votes"
JesperRuneLarsen-0387 asked CyrAz commented

SCOM VSAE AlertMessage sometimes misses inline values

Hi good people,

I have a really strange problem. I am writing a SCOM management pack (using VSAE). The purpose of the MP is to collect current health state of all devices in my customers SolarWinds NPM installation. To solve the problem i use the SolarWinds SDK REST API. I built a query that provides me with a full list of all devices and their current status. To make sure I get cookdown I get all devices status in one go. It's a fairly big query, around 1000 devices and the query takes around 100 seconds to run, but it works fine. Sort of.

My problem is that sometimes the injected values in the AlertMessage are not populated. For example, in one query I get 10 new warning alerts. 3 of these are not showing the values. So, the source data that I get from the SolarWinds REST API is the same dataset. I manually ran the query and verified that all data is there.
One alertmessage provides the correct information for {0} etc. but the next only shows the {0} string and does not insert the correct value.

The monitor is the one called "SolarWinds Node Health". The string in question is RP.SolarWinds.Node.NodeHealth.Monitor.AlertMessage.

Any help would be greatly appreciated.

Thank you.

br
Jesper


[196164-rpsolarwindsnodenodehealthmonitordatasourceps1.txt][1]
[1]: /answers/storage/attachments/196164-rpsolarwindsnodenodehealthmonitordatasourceps1.txt

msc-operations-manager
· 1
5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

CyrAz avatar image
0 Votes"
CyrAz answered

I haven't had a look at your MP yet, but are you entirely certain that you always get a value from the API? Could it be that it's missing sometimes?

5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

JesperRuneLarsen-0387 avatar image
0 Votes"
JesperRuneLarsen-0387 answered

Thank you for your reply. As I wrote in my post, I checked and verified that I get all the data.

5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

CyrAz avatar image
0 Votes"
CyrAz answered CyrAz commented

Do you see any "Failed to replace parameter while creating the alert for monitor state change" errors in the Operation Manager event log where the script is running, or the corresponding "Critical Alert Parameter Replacement Failure" alert in scom alerts?

· 10
5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

CyrAz avatar image CyrAz JesperRuneLarsen-0387 ·

You could run a workflow trace, it may show you what's happening : https://monitoringguys.com/2020/12/15/tracing-scom-workflows-with-powershell/

0 Votes 0 ·

Thank you for the suggestion. I didn't know about this, so I learned something new. Tracing used to be painful, but this makes it a lot easier.

I set it up. Traced a run and read through the logs. There's nothing there indicating any problems. There's nothing in the logs providing me with any substance on the various values mapped to the alertdescription fields, at least I cold validate that my evaluation logic works as expected.

The logic is the same for all instances, so I expect the same output when evaluating the instances. I have an example in my data of 2 almost identical instances that have the same output, but one shows the alert correctly and the other shows the {x} tokens.

I would love to share a trace with you, but I am bound by NDA.

0 Votes 0 ·
Show more comments