[download id=”106″]
I know that SCOM can restart the service automatically, it can even run scripts to check if it was OK.
but in some cases, especially when the service need a complex check before the service is marked OK, you might want to use Orchestrator
Luckily the Monitor Alert is easy to use and it has all data from the alert, that we can utilize to restart the correct service.
I have created a runbook for this specific task.
The runbook is setup the following way:
1. Monitor Alert: This activity is setup to monitor one or more Monitoring Rules/monitors, and by using the Rule ID instead of the name, we have complete control of which alerts triggers the runbook. (use powershell to find the ruleID for the alert you need). You can use any of the fields, but I generally recommend to use IDs instead of Text strings.
2. Start Maintenance Mode: Use the MonitoringObjectFullName from the Monitor Alert activity. Set the Reason to UnplannedOther or any other reason you would like. Set the comment to insert the runbook name (or even runbook ID too)
Now comes the exiting part
3. Query XML: By using the Query XML activity, we can read the context XML from the alert. This context always includes a lot of information about the alert. In this case we can get the DisplayName of the Service by using an XPath query (look here for more help on the subject: http://technet.microsoft.com/en-us/library/hh206079.aspx ).
4. Start/Stop Service: Use the NetbiosComputerName from the alert activity to find the computername. also add error handling if service cannot start, I use Update Alert to update the alert adding a comment in a customfield describing the error.
5. Optional: Link between Start/Stop Server and Get Service Status. This link is setup to delay 120 seconds, this way we can check if the service did really start and run
6. Get Service Status: Use the published data from start/stop service to get the computer and service name. also add error handling if the service is not running
7. Optional: Add Looping if service is not running yet, since some service can be slow at starting. but remember to limit the number of loops so that you will not get an infinite.
8. Stop Maintenance Mode: use the FullName from Start maintenance mode to get the monitor value
9. Update Alert: Update CustomField inserting “Service started by Orchestrator”
Runbook is complete!
You can download the runbook in the begging of this article
Hi,
I am trying to use the MonitorAlert option in a runbook that creates tickets in CA servicedesk.
1st of all, it works… If I launch the runbook, create an alert for which I created a subscription etc.
the runobook does pick it up and creates a ticket.
However…. when my runbook is active for a longer period, I start seeing warnings.
last friday I left all runbooks active (new alert, update and close) and all was working fine.
on sunday (after about 65 hrs) I started receiving warnings in the history of the runbooks. (I have full logging enabled) and the warning in the history is blank.
But it does not pickup new or updated alerts anymore… (also if you stop the runbook, it does not show an error in the history – if you stop it while it was operating OK, it gives an error)
one more remark, I am not filtering for a specific monitorID.
I am looking for any alert in Resolution state xxx and ticketID notcontains xxxx
we have quite a bit of subscriptions that will lead to a ticket creation, so looking for one monitor would make it unworkable for us…
so now my question, are there limitations to the MonitorAlert I am just puzzled why it is failing….
off course I can also use a Monitor date/time and getAlert, but I thought the MonitorAlert was quite handy…
and if I look at your article, it would probably give the same issues if I would try to implement that
regards,
Andre
Hello Andre
I have heard people mentionen similar problems.
But in my customers i have not experienced it my self.
There is not limitations mentioned in the documentation, so try to search and comment feedback on conenct.microsoft.com or create a new bug report at the same place 🙂
Hi,
By any chance could you provide the PowerShell script you used to get the RuleID ?
I seem to be hitting a wall concerning this.
I appreciate you sharing your knowledge. Thanks!!!!
Hello Mike! 🙂
it is very simple actually 🙂
to list all alerts including all fields use this command:
Get-SCOMAlert | format-list *
use
Get-Help get-SCOMAlert
to get info about how to filter 🙂 (or use powershell standard filtering)
Hi Jakob,
I’m following your example but keep getting “Failed to get Monitor. The exception was “An object of class MonitoringObject with ID 00000000-0000-0000-0000-000000000000 was not found.” during the “Start Maintenance Mode” step.
The monitor alert step does return the MonitoringObjectFullName as Microsoft.SQLServer.2008.ReportingServices:COMPUTERNAME.DOMAIN.COM;MSSQLSERVER
Any ideas how to troubleshoot this?
If you test it in the Runbook tester, and breaks the execution on the “Start Maintenance mode” step, it shows this value?
otherwise i am not sure, since i have not experienced any errors as long as my subscription to puclish data was correct.
[…] SCO 2012 – SCOM 2012: Best Practice – Monitor alert …SCO 2012 – SCOM 2012: Best Practice … If you test it in the Runbook tester, and breaks the execution on the “Start Maintenance mode” step, it shows this value?Kan du besøge hjemmesiden […]
Hey Jakob,
good solution but it seems that if the service name has more than one simple word (e.g. Displayname of Service is ‘Luratech Rendition Server’) the activity “StartService” always returns “invalid service” ?! Any idea !?