I 've today a need to close all alert that has been raised by a specific Management Pack. The way I decided to work is to list all alerts, detect from what monitor or rule the alert is comming from and then, check the monitor / rule property to know if it's related to the MP I want to close all alerts.
For using the script, just replace the
MY.MP.TEST by you MP name.
- # Set variable with the MP name you want to close all alerts
- $MPtoCheck = 'MY.MP.TEST'
- # Check Open alerts
- $OpenAlerts = get-SCOMalert
- # Create an empty list of AlertID
- $ListAlertIDtoClose = ""
- #Check what MP has raised the alert
- foreach ($alert in $OpenAlerts)
- {
- $AlertMP = ""
- $AlertID = $alert.ID
- write-host $AlertID
- If ($alert.IsMonitorAlert -eq "True")
- {
- $AlertMP = (get-SCOMmonitor -ID $Alert.MonitoringRuleID).GetManagementPack().name
- }
- else
- {
- $AlertMP = (get-SCOMrule -ID $Alert.MonitoringRuleID).GetManagementPack().name
- }
-
- If ($AlertMP -match $MPtoCheck) {
- write-host "AlertId: " $AlertID "is from " $AlertMP " and must be closed." -foregroundcolor "red"
- if ($ListAlertIDtoClose -eq "")
- { $ListAlertIDtoClose = $AlertID.guid }
- else
- { $ListAlertIDtoClose = $ListAlertIDtoClose + "," + $AlertID.guid}
- }
- }
- # Show the list of alert ID that must be closed
- $ListAlertIDtoClose
- # Create a table
- $ListAlertIDtoCloseTable = $ListAlertIDtoClose.split(",")
- # Close all alert from the table
- foreach ($AlertID in $ListAlertIDtoCloseTable)
- {
- get-SCOMAlert | where {$_.ID -like $AlertID} | Resolve-SCOMAlert -Comment "All alerts are closed by powershell script." | out-null
- }
Note :
For testing purpose, I've just removed the "| Resolve-SCOMAlert -Comment "All alerts are closed by powershell script." | out-null " in line 37. For each Alert ID in the table, it will only show the alerts and not close them.
So in the screenshot, you can see lines in red - they are corresponding to alerts ID that are raised by
MY.MP.TEST
Then in the middle, you can see a list of ID coma separated, this is the line 31 that is executed.
The table at the end, is listed all the alert from the list. since I removed the "| Resolve-SCOMAlert -Comment "All alerts are closed by powershell script." | out-null " in line 37, alerts are not closed.
Be carefull when closing alerts - this should be used in a test environnement first !
This posting is provided "AS IS" with no warranties.
