Orchestrator – Another Useful Runbook for SCOM 2012 SP 1

There are certain situations respectively alerts where you can not decide to override or not to override. You would like to see the alert for a certain time but then it should disappear after a short time. I think you know what I mean. I am talking about the informational alerts. Those alerts are somehow useful but also harassing me in a certain way therefore I decided to make a small runbook which will clean up informational alerts older than a day.

Let’s rock the blog…

The runbook itself is not very impressive yet more effective.

First activity runs once a day after that it takes the current date and subtracts one day in the “Today minus 1 day” activity. The “Get alert older than a day” activity will check the date the alert got created and if the criteria matches it will close the informational alerts. It is that easy. Now let’s check the details…

First activity is scheduled to run once a day…

Next I defined a variable CurrentDateTime which uses the function Now() to get the current date and time…

This CurrentDateTime variable I am going to to use as input for the next activity and also do some reformatting of the input and output date. In addition I am going to subtract one day in the Output Adjustments. It is done by typing “-1” into the Days field…

Next we will get the alerts and use different criteria…

• Severity = Information
• ResolutionState = New
• TimeAdded
• Before
• Published data from “Format Result from “Today minus 1 day””

Now we need to set a filter if the result from the “Get alerts older than a day” activity delivers NULL result not to continue otherwise the runbook will fail…

Finally, if we get some results from the previous activity we catch the alert id and set the ResolutionState to Closed…

That’s it. It shows how Orchestrator can do the work for you and make your life a bit easier…