My favorite characteristic of Command Shell is the availability of the huge array of rich formatting, filtering and sorting options. Oh, and the fact that I can do almost anything in one line. Put these two things together, and we can do some pretty amazing stuff. Watch as we take a MOM 2005 function with it’s own Solution Accelerator (the Alert Tuning SA), complete MOM Reports - and deliver a functional substitute in a single line of Powershell code.

Let’s have a look at the solution and deconstruct what we’re doing. In addition to the obvious get-alert cmdlet, we’re using 4 additional cmdlets together here, each of which has a purpose in filtering, sorting and formatting the output.

I give you, the Operations Manager 2007 Top Alerts Report. Run the following line of code in the Command Shell window:

get-alert | Group-Object Name |Sort -desc Count | select-Object -first 5 Count, Name |Format-Table -auto

And you get output that looks like this:

Here is the role of each cmdlet in the one-liner. If you don’t believe me, remove the cmdlet at the far right, re-run the one-liner  and see the difference in output with each subsequent run.

• Get-alert - Returns all alerts

• Group-object - Returns the list with a count of the number of times the alert by a particular name occurs

• Sort - To sort the list of alerts in descending order by count.

• Select-Object - Allows us to remove the group column that obscures the display of the full alert name AND allows us to use the -first parameter to return only the top X alerts (top 5 in our example).

• Format-table - with the -auto flag to left justify and remove the unnecessary space.

 One line of code got us halfway there, but we’re really not done yet. In the next installment, we’ll dig into this output with some more Powershell to further filter our results based on date and time the alerts were raised and drill down to the problem computer(s).