SCOM VSAE AlertMessage sometimes misses inline values

Question

question

JesperRuneLarsen-0387 asked Apr 25, '22 CyrAz commented May 12, '22

SCOM VSAE AlertMessage sometimes misses inline values

Hi good people,

I have a really strange problem. I am writing a SCOM management pack (using VSAE). The purpose of the MP is to collect current health state of all devices in my customers SolarWinds NPM installation. To solve the problem i use the SolarWinds SDK REST API. I built a query that provides me with a full list of all devices and their current status. To make sure I get cookdown I get all devices status in one go. It's a fairly big query, around 1000 devices and the query takes around 100 seconds to run, but it works fine. Sort of.

My problem is that sometimes the injected values in the AlertMessage are not populated. For example, in one query I get 10 new warning alerts. 3 of these are not showing the values. So, the source data that I get from the SolarWinds REST API is the same dataset. I manually ran the query and verified that all data is there.
One alertmessage provides the correct information for {0} etc. but the next only shows the {0} string and does not insert the correct value.

The monitor is the one called "SolarWinds Node Health". The string in question is RP.SolarWinds.Node.NodeHealth.Monitor.AlertMessage.

Any help would be greatly appreciated.

Thank you.

br
Jesper

[196164-rpsolarwindsnodenodehealthmonitordatasourceps1.txt][1]
[1]: /answers/storage/attachments/196164-rpsolarwindsnodenodehealthmonitordatasourceps1.txt

msc-operations-manager

rpsolarwindsnodenodehealthmonitordatasourceps1.txt (3.9 KiB)

· 1

5 |1600 characters needed characters left characters exceeded

Attachments: Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

JesperRuneLarsen-0387 · Apr 25 at 12:13 PM

here is the actual monitor

196174-solarwinds-node-healthmpx.txt

0 ·

solarwinds-node-healthmpx.txt (13.3 KiB)

Answer 1 · 2022-04-25T12:52:50.863Z

CyrAz answered Apr 25, '22

I haven't had a look at your MP yet, but are you entirely certain that you always get a value from the API? Could it be that it's missing sometimes?

5 |1600 characters needed characters left characters exceeded

Attachments: Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

Answer 2 · 2022-04-25T18:17:15.427Z

JesperRuneLarsen-0387 answered Apr 25, '22

Thank you for your reply. As I wrote in my post, I checked and verified that I get all the data.

5 |1600 characters needed characters left characters exceeded

Attachments: Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

Answer 3 · 2022-04-26T08:25:54.267Z

CyrAz answered Apr 26, '22 CyrAz commented May 12, '22

Do you see any "Failed to replace parameter while creating the alert for monitor state change" errors in the Operation Manager event log where the script is running, or the corresponding "Critical Alert Parameter Replacement Failure" alert in scom alerts?

· 10

5 |1600 characters needed characters left characters exceeded

Attachments: Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

JesperRuneLarsen-0387 · Apr 29 at 06:58 AM

No :)

0 ·

CyrAz JesperRuneLarsen-0387 · Apr 29 at 11:15 AM

You could run a workflow trace, it may show you what's happening : https://monitoringguys.com/2020/12/15/tracing-scom-workflows-with-powershell/

0 ·

JesperRuneLarsen-0387 CyrAz · May 04 at 11:48 AM

Thank you for the suggestion. I didn't know about this, so I learned something new. Tracing used to be painful, but this makes it a lot easier.

I set it up. Traced a run and read through the logs. There's nothing there indicating any problems. There's nothing in the logs providing me with any substance on the various values mapped to the alertdescription fields, at least I cold validate that my evaluation logic works as expected.

The logic is the same for all instances, so I expect the same output when evaluating the instances. I have an example in my data of 2 almost identical instances that have the same output, but one shows the alert correctly and the other shows the {x} tokens.

I would love to share a trace with you, but I am bound by NDA.

0 ·

Show more comments

question