Understanding SCOM 2012 Alerts and Monitors and how to reactivate a closed Monitor

If you would like to know a bit more about the differences between a SCOM “Rule” and a “Monitor” and why Alerts can be closed and Monitors should not, then read this great article from Cameron Fuller. It describes nicely how to react on Alerts and Monitors in SCOM / OpsMgr 2012 R2 

An alert can typically be closed if the state has not changed for a longer period of time, otherwise there would be a repeat count on the alert if it were still an issue.

Monitors will typically close by them self, if not you would have to reset the health state to close it automaticly.

If you by accident close a Monitor, it will not reappear before the health state changes. Therefore, if you are running out of disk space, the monitor will only reappear when the issue have been resolved and then reappears.

This script can reset the closed monitors, which has been copied from this great article, with a small fix since the script was missing a terminator.

$Alertname=@();
$State=@();
$Displayname=@();
# Import Operations Manager Module and create Connection
Import-Module OperationsManager;
New-SCOMManagementGroupConnection EURSCOMACS01;
$alerts=get-scomalert -Criteria “Severity!=0 AND IsMonitorAlert=1 AND ResolutionState=255” | where {$_.LastModified -ge ((get-date).AddMinutes(-5)).ToUniversalTime()}
if ($alerts -is [object])
{
foreach ($alert in $alerts)
{
$monitoringobject = Get-SCOMClassinstance -id $alert.MonitoringObjectId
# Reset Monitor
If (($monitoringobject.HealthState -eq “Error”) -or ($monitoringobject.HealthState -eq “Warning”))
{
$monitoringobject.ResetMonitoringState()
$State+=$monitoringobject.HealthState
$Displayname+=$monitoringobject.displayname
$Alertname+=$alert.Name
}
}
}

I have verified that it works, but use at your own risk.

/Mads