[SCOM 2012][Powershell] Closing all alerts from a specific Management Pack ( #SCOM2012 #Powershell )

I 've today a need to close all alert that has been raised by a  specific Management Pack. The way I decided to work is to list all alerts, detect from what monitor or rule the alert is comming from and then, check the monitor / rule property to know if it's related to the MP I want to close all alerts.


 For using the script, just replace the MY.MP.TEST by you MP name.

1. # Set variable with the MP name you want to close all alerts
2. $MPtoCheck = 'MY.MP.TEST'
3. # Check Open alerts
4.  $OpenAlerts = get-SCOMalert
5. # Create an empty list of AlertID
6.  $ListAlertIDtoClose = ""
7. #Check what MP has raised the alert
8.  foreach ($alert in $OpenAlerts)
9.       {
10.       $AlertMP = ""
11.       $AlertID = $alert.ID
12.       write-host $AlertID
13.       If ($alert.IsMonitorAlert -eq "True")
14.          {
15.          $AlertMP = (get-SCOMmonitor -ID $Alert.MonitoringRuleID).GetManagementPack().name
16.          }
17.      else
18.         {
19.         $AlertMP = (get-SCOMrule -ID $Alert.MonitoringRuleID).GetManagementPack().name
20.         }
21.     
22.      If ($AlertMP -match $MPtoCheck) {
23.         write-host "AlertId: " $AlertID "is from " $AlertMP " and must be closed." -foregroundcolor "red"
24.         if ($ListAlertIDtoClose -eq "")
25.            { $ListAlertIDtoClose = $AlertID.guid }
26.         else
27.            { $ListAlertIDtoClose = $ListAlertIDtoClose + "," + $AlertID.guid}
28.       } 
29.   }
30. # Show the list of alert ID that must be closed
31.  $ListAlertIDtoClose
32. # Create a table
33.  $ListAlertIDtoCloseTable = $ListAlertIDtoClose.split(",")
34. # Close all alert from the table
35.  foreach ($AlertID in $ListAlertIDtoCloseTable)
36.     {
37.      get-SCOMAlert | where {$_.ID -like $AlertID} | Resolve-SCOMAlert -Comment "All alerts are closed by powershell script."  | out-null
38.     }

Note :

For testing purpose, I've just removed the "| Resolve-SCOMAlert -Comment "All alerts are closed by powershell script."  | out-null " in line 37. For each Alert ID in the table, it will only show the alerts and not close them.

So in the screenshot, you can see lines in red - they are corresponding to alerts ID that are raised by MY.MP.TEST
Then in the middle, you can see a list of ID coma separated, this is the line 31 that is executed.

The table at the end, is listed all the alert from the list. since I removed the  "| Resolve-SCOMAlert -Comment "All alerts are closed by powershell script."  | out-null " in line 37, alerts are not closed.

Be carefull when closing alerts - this should be used in a test environnement first !

This posting is provided "AS IS" with no warranties.

[OpsMgr 2007R2][OpsMgr 2012] Auto-closing alerts via a subscription in OpsMgr

By Cameron Fuller on 5/14/2012 12:16:02 PM 
Problem: We have legacy Alert Generating Event Collection rules that legitimately create alerts so that a particular group gets notified of changes to security accounts and groups in Active Directory.  In hind sight they should have been TIMER RESET event Monitors, but there are so many of these rules that it would be a significant undertaking to convert them all (read that as re-create as Timer reset Monitors).  We want to close all the alerts generated from these rules as soon as they fire an email to the team since no one will ever directly address the alert.

Solution:  PowerShell to the rescue! Using a command channel to call PowerShell with the alerted, we can close the alert when the subscription fires.  Since all of these rules are isolated and alerted by a single subscription it makes the job that much easier.

Read more on http://www.systemcentercentral.com/BlogDetails/tabid/143/IndexID/93407/Default.aspx

This posting is provided "AS IS" with no warranties.