SCOM 2012: Format of email subscription subject line.

Forum: Operations Manager4
Viewing 10 posts - 1 through 10 (of 10 total)
  • #97243

    I have the following subscription come thru, with the subject line as:

    [Closed] [ [AD Assignment Resource Pool]] [2] Alert: Web Application Unavailable: {2}

    The monitor which caused this subscription is:

    * Authoring\Web Application Availability Monitoring:

    Title: Web Application Availability []
    What to monitor: “”/””
    Where to monitor from: AD Assignment Resource Pool

    * Authoring\Groups:

    Name: Web Application Availability Monitor Group []
    Explicit Members: Web Application Availability []

    The format of the subscriptions is:

    [$Data[Default=’Not Present’]/Context/DataItem/ResolutionStateName$] [$Data[Default=’Not Present’]/Context/DataItem/ManagedEntityDisplayName$] [$Data[Default=’Not Present’]/Context/DataItem/Severity$] Alert: $Data[Default=’Not Present’]/Context/DataItem/AlertName$

    Which equates to:

    * [$Data[Default=’Not Present’]/Context/DataItem/ResolutionStateName$] = [Closed]
    * [$Data[Default=’Not Present’]/Context/DataItem/ManagedEntityDisplayName$] = [ [AD Assignment Resource Pool]]
    * [$Data[Default=’Not Present’]/Context/DataItem/Severity$] = [2]
    Alert: $Data[Default=’Not Present’]/Context/DataItem/AlertName$ = Web Application Unavailable: {2}

    My question is:

    Q1. Why does the AlertName not show the full name but instead shows the text “Web Application Unavailable:” then the text “{2}”.

    Q2. What does the text “{2}” represent?




    what does the alert look like in the console? what is it you expect the “full name” of the Alert to be instead of “web application unavailable”?

    i would guess the 2 is some parameter that the alert was unable to translate from the data pulled from the monitor. i would expect all of your issues exist in the alert itself, and maybe even the monitor, rather than just in the subscription.




    I think in the channel you have created, you have selected to show the Alert Severity (or priority). If it is severity, 2 generally represents Critical and it is a priority 2 represents a high. Try removing the Alert Severity or Priority from the channel and you should not see the {2} in the email subject line.

    I have been working on how I can parse {2} to actually show critical (as Alert Severity) in the email subject line, but I am not sure if there is any way to do that.

    Let me know if it helps.





    the [2] is the priority. he’s asking about the {2} at the end which is being produced as a part of Alert: $Data[Default=’Not Present’]/Context/DataItem/AlertName$

    [Closed] [ [AD Assignment Resource Pool]] [2] Alert: Web Application Unavailable: {2}



    I agree with curtmcgirt “i would guess the 2 is some parameter that the alert was unable to translate from the data pulled from the monitor.”

    I have seen this behavior occur with other rules/monitors. In the alert messaage or description there will be a variable and SCOM is unable to get/find/resolve the variable when it generates an alert. I also saw a case where the variable used “existed” and had data (confirmed by checking the properties of the instance/object being referenced) but when I dug into it more I found that the case of the text used in the property and used in the alert variable were different (so SCOM could not find/resolve it).

    I believe if a variable cannot be resolved when an alert is generated that there is a rule in the out of box “System Center Core Monitoring” monitoring pack that generate an alert. The rule is called “Parameter Replacement Failure During Alert Creation” and the alert is called “Alert Parameter Replacement Failure”). This alert might contain more information about what (specifically) happened in your particular alert.

    Update: Sorry, I referenced alerts above and you’re referring to subscriptions. 
    I believe there are alerts when subscriptions have isues like this as well, and all the above logic applies to subscriptions


    Is there a way to “see” the data being sent by the alert/monitor to the subscription? That is, how do I find out what the “{2}” is actually?


    Mohammad Ameen

    In SCOM 2012 Alert Description for Notification mail not show properly , I place here body content check it how its not working …

    Alert: $Data[Default=’Not Present’]/Context/DataItem/AlertName$
    Source: $Data[Default=’Not Present’]/Context/DataItem/ManagedEntityDisplayName$
    Path: $Data[Default=’Not Present’]/Context/DataItem/ManagedEntityPath$
    Last modified by: $Data[Default=’Not Present’]/Context/DataItem/LastModifiedBy$
    Last modified time: $Data[Default=’Not Present’]/Context/DataItem/LastModifiedLocal$
    Alert description: $Data[Default=’Not Present’]/Context/DataItem/AlertDescription$
    Description: $Data[Default=’Not Present’]/Context/DataItem/AlertDescription$

    Alert view link: “$Target/Property[Type=”Notification!Microsoft.SystemCenter.AlertNotificationSubscriptionServer”]/WebConsoleUrl$?DisplayMode=Pivot&AlertID=$UrlEncodeData/Context/DataItem/AlertId$”
    Notification subscription ID generating this message: $MPElement$

    Thanks in Advance




    Can anyone please let me know if there is a way to include the severity of the alert in the subject line? It should display as critical ,warning or information in the subject line of the alert email.


    Sam, I use the following Subject line which includes the Severity of the alert:

    [$Data[Default=’Not Present’]/Context/DataItem/ResolutionStateName$] [$Data/Context/DataItem/ManagedEntityPath$] [$Data/Context/DataItem/ManagedEntityDisplayName$] Sev=[$Data[Default=’Not Present’]/Context/DataItem/Severity$] Alert: $Data[Default=’Not Present’]/Context/DataItem/AlertName$


    [New] [MyServer.MyDomain.COM] [Microsoft(R) Windows(R) Server 2003, Standard Edition] Sev=[2] Alert: Total CPU Utilization Percentage is too high



    So, I am seeing the same thing that Julian initially posted.
    From what I have been able to dig through. It looks to be like a problem with the template.
    A powershell lookup of the alert does show the correct information. However, looking at the Web Application Monitor Properties the Alerting Properties Alert Name shows the “Web Application Unavailable: {2}”
    I am looking for a way to modify that to be $Data[Default=’Not Present’]/Context/DataItem/AlertName$

    Any thoughts on this?

Viewing 10 posts - 1 through 10 (of 10 total)

You must be logged in to reply to this topic.