SCOM generates a false positive when a container volume volume is renamed after container redeployment or restart

Question

Hello All ,

This is an issue i posted in the older forum. Kindly advise

https://social.technet.microsoft.com/Forums/systemcenter/en-US/be1b1d34-b010-4d93-9292-738e5059b7d9/scom-generates-a-false-positive-when-a-container-volume-volume-is-renamed-after-container?forum=operationsmanagergeneral

Answer 1

Hi @py ,

this is really strange. I can tell from the screenshots that the monitors targets the "Logical Disk" class indeed.
Can you please do a simple test. On the last screenshot with the "Override Properties", what happen if you select Enable --> False and then click the "Enforced" option to enforce the override?
Does the monitor fire for this particular disk then?

Thanks and Regards,
Stoyan

Answer 2

(Continuing from the old thread on technet forum)

The proper way to do this override is not a dynamically populated group, because what you really want here is to avoid these volumes to get discovered in the first place instead of having them discovered and disabling their monitoring, as I explained in the technet thread.

You answered that you did not have the ExcludeFileSystemName nor the ExcludeFileSystemType overrides for the Discover Universal Linux Logical Disks.
That is likely because you are still running an older version of the Microsoft.Linux.Universal.Monitoring MP, as these overrides only became available with version 7.6.1064.0 (which was released with SCOM 2016 UR1, if I'm not mistaken).

Could you check which version of the MP you are running, and update it if it's too old?

Answer 3

Hi py,

I had the same challenge with Kubernetes containers, where there were many pods with the exact same type of disks.
First things first, there is only one community MP, which monitors containers and it is pretty specific, so there is great chance that you cannot use it.
This being sad, there are no other MP for SCOM (for now), which can help you monitor containers.

Now to the question: How to solve the issue with the disks and their dynamic names? This is what I did:

• Create a dynamic group in SCOM with the Linux disk, where the disk name contained "overlay" (In my case it contained "kubelet")
• Create an override on the alerted monitor and override it for the group (Enabled=False). This will stop the monitor from alerting.
• Go ahead and do the same for the Linux logical disk discovery - override it also for the same group.

This will stop the disks from being discovered and of course will stop the alerts.

Hope I could clarify this for you!

---

(If the reply was helpful please don't forget to accept as answer, thank you)
Regards,
Stoyan

Answer 4

HI PY,
actually if your group is populated with the disks, then the group configuration is fine.
Now we need to check why the rule is still alerting. Most probably the rule traget is different then the objects in the group.
Can you please do me a favour and check the following:

• In the SCOM console, go to the alert, richt click and select Overrides
• Afterwards select the "Override rule" and then you will get the options:

For all objects of class :<<Class Name>>
For a specific object of the class: <<Class name>>

I need to know what Class exactly is the GUI showing in the options? Is it "Logical Disk" or is it something else?

Thanks

---

(If the reply was helpful please don't forget to accept as answer, thank you)
Regards,
Stoyan

Answer 5

Hello @SChalakov

Thanks.

here is another latest example in another environment.

Group

Discovered object

Alert

Override

Override properties

Kindly advise