In SCOM 2022 there is now a change again to the options to closing an alert from an unhealthy monitor. Let me first give some background what is going on here.
In SCOM 2012/2016, when we had alerts that we wanted to close, we could simply close them. This is alright for Rules. But for Monitors the problem with just closing an alert without looking, is that the monitor might still be unhealthy!
What this means is that if lets say a Windows Service is down. You get an alert from the monitor which checks this service. You close the alert. This means that you did not solve the problem. You only closed your eyes and pretend the problem is not there! However, in SCOM the monitor is still Red. This means state dashboards, or distributed apps which rely on that windows service are still Red and thus also listed as unavailable. But there is no alert anymore for it. This simply does not work. The correct procedure was to fix the problem, which causes the monitor to turn green, which closes the alert. In most cases. There are a few monitors which do not turn back to green which need a health reset (which closes the alert as well).
Forward to SCOM 2019. What happened in SCOM 2019 was that the behavior for closing an alert coming from an Unhealthy Monitor changed! It was no longer possible to close such an alert. It just gave an error message popup saying the monitor is still unhealthy. It updated the alert with a history entry, but the alert would be there. Can only close the alert by fixing the problem or by doing a health reset. This kind of forced a behavior. However, there were organizations where this would not work well, due to processes or automation or connectors or simply a way of working behind it. They needed the option to just close an alert, even if unhealthy.
SCOM 2022
Now, we arrive at SCOM 2022. What changed now, is there is an additional global setting where you choose between the SCOM 2019 behavior or the possibility to close alerts from unhealthy monitors. Let me show you what this looks like and what it does:
In SCOM Administration pane go to Settings – Alerts. Next go to the tab Alert Closure Experience.
The first option listed is basically what SCOM 2019 does. It forces you to make the monitor turn to green (by fixing or resetting), which will close the alert.
The second option is new here. When enabled it makes it possible again for people to close an alert from an unhealthy monitor. But this time it does not simply close the alert! It does a health reset for you of that monitor – and as we know, in most cases that closes the alert for you. This also means that you do not have an empty alerts list, with half your objects in a red state. Dashboards should be mostly as green as empty as the alerts screen is. Of course, if the problem still exists, in many cases you will see a new alert coming in within minutes to hours.
Now you have a choice again!
Go back to the overview of all new features in SCOM 2022!
Enjoy your monitoring!