Configure Automatic Alert Resolution in SCOM

In this post, I will demonstrate how to configure automatic alert resolution in SCOM. Automatic alert resolution allows you to configure all active alerts with a “New” resolution state to automatically change to “Closed” after a specified number of days.

Last week, I installed a new instance of SCOM for a customer and all the configurations were done as per the requirements. A new business requirement involved auto closure of alerts within the Operations Manager management group. While this configuration isn’t complex, this should only be carried out when absolutely necessary.

In SCOM, most of the alerts that are generated by monitors are automatically resolved when the health state is changed to healthy. In case a monitor isn’t configured to resolve its alert automatically, you can configure an override on the parameter Auto-Resolve Alert for the monitor.

Configure Automatic Alert Resolution in SCOM

Launch the Operations Manager console. Now select the Administration workspace and click on Settings. Right-click Alerts and select Properties. On the Management Group Settings tab, select the Automatic Alert Resolution tab.

Here you’ll find two options to configure:

1. Close all Alerts from Rules, when the Alert has not been modified for: If an alert is generated from Rules, close the alert if it’s not closed automatically for 30 Days (Default value)
2. Close all Alerts from Monitors (only when the Monitor State is healthy), when the Alert has not been modified for: If an alert is generated from Monitors, close the alert if it’s not changed for 7 Days (Default value)

In the below example, I have set the auto-closure period for alerts generated by Rules to 15 days and for alerts generated by monitors to 3 days. In your case, you can set these values based on your business requirements. Once you have made your desired changes, select OK to apply the new settings.

Auto Close SCOM Alerts using PowerShell

The below Powershell Script is from Microsoft that automatically closes old Operations Manager alerts. The script identifies active alerts and tracks their creation time (alert age). If the alert age exceeds the defined threshold in days ($alertsTobeClosedBefore), the script automatically closes the alert.

$alertsTobeClosedBefore = 5
$currentDate = Get-Date
Get-SCOMAlert | Where-Object {(($_.ResolutionState -ne 255) -and (($currentDate - $_.TimeRaised).TotalDays -ge $alertsTobeClosedBefore))} |Resolve-SCOMAlert

$alertsTobeClosedBefore = 5
$currentDate = Get-Date
Get-SCOMAlert | Where-Object {(($_.ResolutionState -ne 255) -and (($currentDate - $_.TimeRaised).TotalDays -ge $alertsTobeClosedBefore))} |Resolve-SCOMAlert

Troubleshooting

A commonly reported issue with alerts is that the monitor-based alerts do not automatically close in SCOM. To resolve this, go to the properties of the monitor, click Alerting tab to see if the option “Automatically resolve the alert when the monitor returns to a healthy state” is selected. If this doesn’t help, then try manually resetting the health of the monitor.