1

I'm creating a rule to look for a missing event in a windows log using SCOM and I need to override the rule for different groups of servers to set different timings.

For example server A needs to have an alert raised if the event is missing for 30mins but on server B, we only produce the alert for 60mins without the event.

Is there any way to allow overriding this property of the missing event detection unit monitor?

mjaggard
  • 123
  • 5

1 Answers1

0

The Missing Event Schedule, and the, Auto Reset Timer, properties are not values that can be overridden on a unit monitor. A brief overview of the overridable properties can be found at How to Create an Override for a Monitor.

We always follow the pattern of "target a class, but override for a group". I think this generally means in this situation we would create the following assets:

  1. classA and classB
  2. Missing Event Unit Monitor for ClassA (30)
  3. Missing Event Unit Monitor for ClassB (60)

Something like that.

Its not as clean, or as reusable, as we might like, so I'm hoping someone will post a more 'reusable' / DRY'er way to achieve this.

I wonder if an alternative might be to have a custom script monitor reading the event log at some interval, which is configured outside of SCOM (e.g. registry, config service, etc)? Just thinking out loud..

Zach Bonham
  • 210
  • 1
  • 3
  • 10
  • Thanks for your comments. I'm marking this as an answer for now - even though the answer is basically "no". – mjaggard Mar 08 '12 at 14:19