Hypothetically, say you have a custom application in your environment. For said application, there is a group in your SCOM environment that contains all of the objects associated with your application. For the purposes of this blog post, I am going to grab a bunch of random monitored objects, throw them into a group, break them so they alert, and then get the alerts through PS.
- Default Web Site – Hosts the SCOM Web Console. Going to stop the site.
- Active Directory Topology Root – I have two DCs in my lab…I am going to turn one off
- MyAppBasedOnAbClass – Custom class for a different blog post. Has a manual reset monitor (evil) based on an event
- ORC12 – Orchestrator 2012 SP1 database. Will break this group by stopping the SQL Service
- FabScorch1 – stopping the oRunbook service on the box which triggers the Orchestrator MP to raise an alert which rolls health to the computer object
Here is the group named ‘BLOG –My Application’ and its unhealthy members:
Here’s an alert view defined for the members of the ‘BLOG – My Application’ group:
Viewing the alerts:
Through PowerShell:
$Group = Get-SCOMGroup -displayname ‘BLOG – My Application’
$ClassInstances = $Group.GetRelatedMonitoringObjects(‘Recursive’)
$Alerts = Get-SCOMAlert -instance $ClassInstances -ResolutionState (0..254)
$Alerts | ft Name
And that’s a way to programmatically get a hold of alerts through PowerShell for members of a group.