How To Create rules into SCOM from Script or PowerShell or anything else...

Luís Armando Rodrigues 1 Reputation point
2021-07-01T10:27:27.643+00:00

Hi...
I need to create a batch of rules into SCOM, like 100 rules into SCOM.
The rules are event ID-based, so there's an event been written for alerting and clearing....

But I can't seem to find anything on this subject...

It seems like there's no way to create multiple alert rules into SCOM at once based on EVENTID...

Can please someone Help or shed some light...

Thanks in advance.

Operations Manager
Operations Manager
A family of System Center products that provide infrastructure monitoring, help ensure the predictable performance and availability of vital applications, and offer comprehensive monitoring for datacenters and cloud, both private and public.
1,417 questions
0 comments

3 answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. CyrAz 5,181 Reputation points
    2021-07-01T14:36:35.32+00:00
    0 comments
  2. AlexZhu-MSFT 5,551 Reputation points Microsoft Vendor
    2021-07-02T07:28:29.973+00:00

    Hi,

    If our purpose is to generate an alert for any of the 100+ Event ID, perhaps we may consider to create only a single monitor/rule based on the script. In the script, we can detect any of the occurrence of the Event IDs specified, return the variables we want to collect (via propertybag), as well as the Event ID if necessary.

    In the script, we may perform any operations required. Here's a sample to calculate the file count, just for your reference.

    111284-scom-ps-script-based-monitor-03.png

    Alex
    If the response is helpful, please click "Accept Answer" and upvote it.

  3. Dwayne 1 Reputation point
    2024-04-23T04:24:01.09+00:00

    two possible reason why they might want an even easier solution.
    For instance at a guess the carbonite management pack has 242 rules for events that don't work. sure I could create these all by hand or code blocks etc, but programmatically would be much easier. Maybe the original poster is trying something similar. this is where creating a rule via powershell would be good (and you can at worst do this by creating the xml in a management pack

    If not replacing existing bad rules what you can do is if the alert is parametrized you can use dynamic rule naming based on these to have one rule give alerts with different meaningful names and alert details based on the event itself.
    This runs into the X hundred limit before being suppressed but that can be raised or if it doesn't alert like a Christmas tree just work a treat. https://kevinholman.com/2015/02/20/can-alert-names-contain-dynamic-data/