Most Common Alerts (both rule and monitor-generated) in Powershell
Home  » Operations Manager  » Most Common Alerts (both rule and monitor-generated) in Powershell

Most Common Alerts (both rule and monitor-generated) in Powershell
Posted: Mon, Nov 02, 2009 8:27 PM :: Rank: 2
Author
Points: 42748
Level: System Center Expert

Pete wrote these Top Alerts blog posts in Powershell, and I want to ask if anyone knows how I could modify to get the data I need. Here are links to the original posts.

 

Powershell Tip: Operations Manager 2007 Top Alerts Report - Part 1

 

Powershell Tip: Operations Manager 2007 Top Alerts Report - Part 2

And here is the Powershell I want to modify. In this form, it would retrieve top alerts generated by rules (because it uses repeat count) and grouped by the computer that generated it. 

get-alert | Sort -desc RepeatCount | select-object -first 10 Name, RepeatCount, MonitoringObjectPath

The question - Is it possible to change this to return top 10 alerts from rules and monitors?

 

 

   Report Abuse
Re: Most Common Alerts (both rule and monitor-generated) in Powershell
Posted: Tue, Nov 03, 2009 9:14 AM :: Rank: 1
Author
Points: 27734
Level: System Center Expert
Hrm, in that case you need to be more specific, especially: How should the RepeatCount be treated? Monitors won't have a RepeatCount, at least as far as my thoughts on this are correct.

Second thing is, do you want it to be like "Top 10 Rule Alerts" and "Top 10 Monitor Alerts", or do you want a simple "Top 10 Alerts of Monitors and Rules"?



I could write that with some simple Powershell logic but I can't think of a simple Query for this.
   Report Abuse
RE: Most Common Alerts (both rule and monitor-generated) in Powershell
Posted: Tue, Nov 03, 2009 9:39 AM :: Rank: 0
Author
Points: 65622
Level: System Center Expert

 Tenchuu, I thought and tested for quite a while and could not find a way to pull this data back and group appropriately in the Command Shell. Easy for rules based on repeat count, difficult for monitors. 

That drove me to using T-SQL just to get past the issue. Would love it if you came up with a silver bullet for this one.

   Report Abuse
RE: Most Common Alerts (both rule and monitor-generated) in Powershell
Posted: Wed, Nov 04, 2009 3:48 PM :: Rank: 0
Author
Points: 10290
Level: System Center Expert

I dont think you can get repeat count for monitors because when monitor create an Alert you can only get Alert repeat count.

Here is how I am getting repeat count from datawarehouse.
 

SQL code;

SELECT     
      [AlertName]
      ,[Severity]   
      ,[RaisedDateTime]
      ,[SiteName]
      ,[RepeatCount]      
      ,[DBCreatedDateTime]
   
  FROM [OperationsManagerDW].[Alert].[vAlert]
Where   ( RaisedDateTime BETWEEN DATEADD(HH, DATEDIFF(HH, GETDATE(), getutcdate()), @startdate) AND DATEADD(HH, DATEDIFF(HH, GETDATE(), getutcdate()), @enddate))
Order by  Repeatcount DESC, AlertName

 

I attached the sample excel file and RDL file.

Hope this helps,

 

 

 

 

 

 

   Report Abuse
RE: Most Common Alerts (both rule and monitor-generated) in Powershell
Posted: Tue, Nov 03, 2009 3:37 PM :: Rank: 0
Author
Points: 10290
Level: System Center Expert

This may help,

 

Here is sql code for Datawarehouse;

SELECT     
      [AlertName]
      ,[Severity]   
      ,[RaisedDateTime]
      ,[SiteName]
      ,[RepeatCount]      
      ,[DBCreatedDateTime]
   
  FROM [OperationsManagerDW].[Alert].[vAlert]
Where   ( RaisedDateTime BETWEEN DATEADD(HH, DATEDIFF(HH, GETDATE(), getutcdate()), @startdate) AND DATEADD(HH, DATEDIFF(HH, GETDATE(), getutcdate()), @enddate))
Order by  Repeatcount DESC, AlertName

 

I attached sample rdl file and excel file.

Hope this helps.
 

 

 

 

   Report Abuse
RE: Most Common Alerts (both rule and monitor-generated) in Powershell
Posted: Wed, Nov 04, 2009 11:46 AM :: Rank: 56
Author
Points: 27734
Level: System Center Expert

How about doing it this way? It creates a Datatable, goes through all the Alerts and checks if an Alert of the same type is already in there. If it doesn't, it just creates the entry. If it does, it just merges the Count (Repeatcount + 1).

Check it out and tell me if this does what you want it to do, then I'll document it more detailed.

#Create Datatable

$AlertTable = New-Object System.Data.DataTable "AlertTable"

$AlertTable.Columns.Add((New-Object System.Data.DataColumn ID,([string])))

$AlertTable.Columns.Add((New-Object System.Data.DataColumn Name,([string])))

$AlertTable.Columns.Add((New-Object System.Data.DataColumn AlertCount,([int])))

$AlertTable.Columns.Add((New-Object System.Data.DataColumn IsMonitorAlert,([string])))

foreach ($Alert in (Get-Alert))

{    

    #Check if Alert exists already.

    $AlertExists = $false  

    foreach ($Row in $AlertTable.Rows)

    {

        if ($Row.ID -eq $Alert.MonitoringRuleId.ToString())

        {    

            $AlertExists = $true

            #In case it does, we just merge the Repeatcount

            $Row.AlertCount = $Row.AlertCount + ($Alert.RepeatCount + 1)    

        }

    } 

    if ($AlertExists)

    {

    }

    else

    {

        #If the Alert doesn't exist, we add it to the DataTable.

        $NewRow = $AlertTable.NewRow()

        $NewRow.ID = $Alert.MonitoringRuleId.ToString()

        $NewRow.Name = $Alert.Name

        $NewRow.AlertCount = ($Alert.RepeatCount + 1)

        $NewRow.IsMonitorAlert = $Alert.IsMonitorAlert

        $AlertTable.Rows.Add($NewRow)

    }

}

$AlertTable = ($AlertTable | sort AlertCount -Descending)

$AlertTable | format-table -AutoSize | select-object -first 10

   Report Abuse
RE: Most Common Alerts (both rule and monitor-generated) in Powershell
Posted: Wed, Nov 04, 2009 12:47 PM :: Rank: 0
Author
Points: 42748
Level: System Center Expert

 Cool, your script logic looks parallel to the SQL query.  I will try this and let you know this afternoon. Thanks!

   Report Abuse
Re: Most Common Alerts (both rule and monitor-generated) in Powershell
Posted: Thu, Nov 05, 2009 4:09 AM :: Rank: 0
Author
Points: 27734
Level: System Center Expert

This time I didn't steal it from the SQL Query :) was working on it since my Tuesday Post, but couldn't finish it because I had to finish Call of Duty 4 first :)

   Report Abuse

Home  » Operations Manager  » Most Common Alerts (both rule and monitor-generated) in Powershell
Top Contributors
Featured Members
Pete Zerger
Points: 65622
Level: System Center Expert
Tommy Gunn
Points: 42748
Level: System Center Expert
Simon Skinner
Points: 40804
Level: System Center Expert
Stefan Koell
Points: 28999
Level: System Center Expert
Andreas Zuckerhut
Points: 27734
Level: System Center Expert