I have an Orchestrator runbook monitoring for SCOM 2007 alerts that does the following:
Monitor Alert > Change ResolutionState > Execute Runbook2
When a new alert is generated in ‘Monitor Alert’ Orchestrator picks it up, changes the resolution state to a custom state, and then more magic happens in Runbook2.
I need to work around the following scenario:
SCOM generates a new alert
Orchestrator picks up new alert (Monitor Alert)
SCOM closes the alert (Alert Resolved by the System)
Orchestrator changes ResolutionState
In this scenario the ResolutionState has changed from ‘New’, to ‘Closed’, to ‘MyCustomState’ in the span of a few seconds. When Runbook2 executes it checks in multiple spots to see if the alert’s ResolutionState equals ‘Closed’, which is a state that will never be automatically returned to.
Can I query the alert for something other than ResolutionState to see if the alert has been healed?