Some Microsoft SCOM alerts monitoring Windows Service restarts are not displaying in SOI console

Products

• CA Service Operations Insight (SOI)

Issue/Introduction

Some MS SCOM alerts are not showing up in our SOI console. It seems to be very specific alerts, related to Windows Service monitors set up in SCOM. In SCOM we first generate an initial SCOM alert, indicating the service is down. In addition to an alert we trigger, via SCOM, and automated policy that attempts to restart the service. If the service isn't restarted within 15 minutes the alert is escalated. What we're seeing is that the initial alert triggers in SCOM, the service is successfully restarted, then the alert is cleared in SCOM. I can see the alert in the SOI>SCOM connector debug logs, both in the RAW and PUB. However, the alert never shows up in SOI.. And I've checked active SOI alerts and historic alerts. No sign of it. I do, however, see it if I go into the SOI Policy editor. I need to determine why the alert never shows up as an view-able alert in SOI. One more thing: SCOM has the abilty to "re-open" a cleared alert. So you can take a cleared alert and basically make it an active alert. When we do this the alert shows up in SOI.

Environment

Release:
Component: SOIMGR

Cause

In the SOI UI connector configuration page there is an 'alertPollInterval' for the SCOM connector. It is 30 seconds by default and should not be lowered. This interval is how often the connector polls SCOM for alerts. In Windows, the service that stopped had restarted quickly (within the 30 second poll interval) due to the auto-restart they set up. This causes the connector sends SOI the open alert then the closed alert . As a result no alert will show on the console.

Resolution

To avoid this scenario you can set a 60 second delay in SCOM before restarting the service.