Tagged: Workaround

SCOM Alert History Grooming

Myself and Pontus Blomqvist found a small but annoying bug…

If you have an alert in SCOM that still isn’t resolved but an entry in the history is older than your grooming-settings the history-data will be groomed.

Why? If you look in to the stored procedure named p_AlertGrooming you can se that it works like this:
– Get setting for Grooming (Deleting)
– Loop thru all alerts that have resolution state = 255 (closed)
—- Groom the history-data for the alert
—- Groom the alert
– Groom all alert-history that are older than the grooming-setting (No matter what resolution state)

So the last step is not needed since the history is groomed when the resolution state is set to 255.

Workaround:
Find the delete-rows in the stored procedure named p_AlertGrooming and comment them out…

Change this 2 rows from:

DELETE dbo.AlertHistory
WHERE TimeAdded < @GroomingThresholdUTC

to:

-- Change by Rikard Ronnkvist to keep history data from being groomed
-- DELETE dbo.AlertHistory
-- WHERE TimeAdded < @GroomingThresholdUTC