[OpsMgr 2012] How to find a specific rule/monitor/discovery in the console - SQL queries / Powershell command ( #SQL #Powershell #OpsMgr #OpsMgr2012 )

Sometimes in the Operations Manager Event log, we have some event/alert  for script error or WMI query error and all the time, the description give your the exact name of the rule/monitor/discovery that cause the issue. In SCOM console, you cannot find the rule/monitor/discovery by their exact name, only by the display name.

For example, here is an event 5500 we have on one server due to an invalid configuration for a monitor: Microsoft.SystemCenter.Agent.HealthService.PrivateBytesThreshold

Log Name:      Operations Manager

Source:        HealthService

Date:          11/28/2013 3:10:43 PM

Event ID:      5500

Task Category: Health Service

Level:         Information

Keywords:      Classic

User:          N/A

Computer:      MyServer.MyDom.Dom

Description:

Frequent state change requests caused the incoming state change request to be dropped due to it being older than the currently recorded state change for this monitor. This could also be due to an invalid configuration for this monitor. 

Affected monitor: Microsoft.SystemCenter.Agent.HealthService.PrivateBytesThreshold

Instance: MyServer.MyDom.Dom

Instance ID: 293C0099-290F-C53C-340E-A5E710CA5B9F

Management Group: MyMgtGroup

Request generated time: 2013-11-28T15:10:43.1658766+01:00

Requested state: Success

Recorded time: 2013-11-28T15:20:35.7827611+01:00

Recorded state Success

To start investigation, you need to retrieve the display name of the rule/monitor/discovery. You can also execute SQL queries on views in the OpsMgrDB or PowerShell commands connected to your management group :

Rules:

SQL:

select DisplayName from ruleview where name = 'Rule.Name'

Command Shell:

(Get-SCOMRule | Where {$_.name -match 'Rule.Name'}).DisplayName

Monitors:

SQL:

select DisplayName from monitorview where Name = 'Monitor.Name'

Command Shell:

(Get-SCOMMonitor| Where {$_.name -match 'Monitor.Name'}).DisplayName

Discoveries:

SQL:

select DisplayName from DiscoveryView where name = 'Discovery.Name'

Command Shell:

(Get-SCOMDiscovery| Where {$_.name -match 'Discovery.Name'}).DisplayName

In our case, powershell command or SQL query give a display name (replace Monitor.Name by Microsoft.SystemCenter.Agent.HealthService.PrivateBytesThreshold in the line) : Health Service Private Bytes Threshold for monitor Microsoft.SystemCenter.Agent.HealthService.PrivateBytesThreshold

We can now retrieve the monitor in the SCOM console and try to investigate the issue  ! :)

This posting is provided "AS IS" with no warranties.