SCOM Connector 4.9.0 - File and Database Instance Alert Names Displaying Incorrectly (Showing "Unknown")

Products

• CA Service Operations Insight (SOI)

Issue/Introduction

After migrating to SCOM 2025, alerts related to database instances and files are displaying incorrectly in the Service Operations Insight (SOI) Alert Console.

Instead of showing server names, the alerts display raw object paths (e.g., file://Default Web Site...) or populate with "Unknown" in the CI label (e.g., Unknown:.MSSQLSERVER).

Upon further inspection of the CI details, both the ProductName and DBServerType properties are listed as Unknown.

Environment

 

• Service Operations Insight (SOI) 4.3

• SCOM Connector 4.9.0

 

Cause

The raw data received from the SCOM server reports the MonitoringClassName as Microsoft.SQLServer.Windows.DBEngine.
In the default connector policy, there is no corresponding map entry for this specific class name, causing it to fall back to the default "Unknown" mapping for DBServerType and ProductName.

Resolution

To resolve this issue, you must manually adjust the scom_policy.xml file to properly map the incoming MonitoringClassName to the correct DBServerType.

1. Stop the SCOM Connector service.

2. Navigate to the SCOM Connector policy directory and create a backup of the existing scom_policy.xml file.

3. Open scom_policy.xml in a text editor.

4. Locate the section for <EventClass extends="RunningSoftware" name="DatabaseInstance">.

5. Under the <Normalize> block, adjust the DBServerType mapping to include Microsoft\.SQLServer\.Windows\.DBEngine mapping to MSSQLServer.

6. Additionally, ensure the <Format> block is mapping ProductName to DBServerType, and DBInstanceName to DisplayName as shown below.

Replace or update the existing DatabaseInstance block with the following configuration:

XML

 

<EventClass name="DatabaseInstance" extends="RunningSoftware">
    <Parse>
        <Field input="Path" pattern="([^.]*)\..*\..*$" output="ShortName" />
    </Parse>
    
    <Normalize>
        <Field output="DBServerType" type="map" input="MonitoringClassName">
            <!-- <mapentry mapin="Microsoft\.SQLServer\.DBEngine" mapout="MSSQLServer" /> -->
            <mapentry mapin="Microsoft\.SQLServer\.Windows\.DBEngine" mapout="MSSQLServer" />
            <mapentry mapin=".*" mapout="Unknown" />    
        </Field>
    </Normalize>
    <Format>
        <!-- assign ClassName -->
        <Field output="ClassName" format="DatabaseInstance" input="" />
          <!-- <Field conditional="LocalDeviceID" output="DeviceSysName" format="{0}" input="LocalDeviceID"/> -->
          <Field output='ProductName' format='{0}' input='DBServerType'/>
        <!-- Non-Correlatable properties -->
        <Field output='DBInstanceName' format='{0}' input='DisplayName' />
      
      </Format>
    <Format2>
        <Field output="InstanceName" format="{0}" input="Id" />
        <Field conditional="ShortName" output="Label" format="{0}" input="ShortName" />
    </Format2>
    
</EventClass> 

7. Save the scom_policy.xml file.

8. Start the SCOM Connector service. New alerts should now correctly parse the DB Server Type and display the proper names.