Powershell Tip: Operations Manager 2007 Top Alerts Report - Part 2
We’d talked a few weeks ago about creating a Top Alerts Report in Powershell to improve upon the Top Alerts Report. So here are variations on that provides an additional elements versus the Top Alerts report (in the Microsoft ODR Report Library) by displaying based on the repeat count and the object for which the alert was logged. When I run the Top Alerts Report, the repeat count seems to be missing in the report logic.After a bit of working with this, I think these meet the need. These should make it easy to determine which computers are logging the most errors and which rules or monitors are the most problematic.
Note: All script samples contain | export-csv c:\alerts.csv to export the results to a spreadsheet for easy reading. Just remove this if you want to echo results to the screen.
# Most Common Among All Alerts (any resolution state)
get-alert | Sort -desc RepeatCount | select-object -first 10 Name, RepeatCount, MonitoringObjectPath | export-csv c:\alerts.csv
# Most Common Among All Active Alerts
get-alert | where-object {$_.ResolutionState -ne 255 } | Sort -desc RepeatCount | select-object -first 10 Name, RepeatCount, MonitoringObjectPath | export-csv c:\alerts.csv
In this last example, which provides filtering option based on TimeRaised, I had to resort to a two-liner.
# Most Common Among All Active Alerts Raised in Last 7 days
$targetdate = (get-date).AddDays(-7)
get-alert | where-object {($_.ResolutionState -ne 255) -and ($_.TimeRaised -gt $targetdate)} | Sort -desc RepeatCount | select-object -first 10 Name, RepeatCount, MonitoringObjectPath | export-csv c:\alerts.csv
Did you find these helpful, or perhaps lacking in some way? I would appreciate your feedback as a comment on this post or via the Contact page.
September 3rd, 2008 at 2:29 pm
Hi Pete
Excellent scripts again but I think there is a limitation to be aware of by using repeatcount. Works great for rules but sadly monitors tend to have much lower repeatcounts so generally won’t show up in the list. Some also have a monitoring object path of null (domain degraded alerts) so don’t show up at all.
I tend to use this for rules:
get-alert | Sort -desc RepeatCount | where-object{$_.IsMonitorAlert –like “FALSE”} | select-object -first 20 Name, RepeatCount, MonitoringObjectPath | export-csv c:\mostcommonallrulealerts.csv
Don’t really know a good way for monitors .. perhaps those that took longest to auto resolve (resolvedtime - createdtime) .. I need to look into it some more.
Keep up the great work
GD