Command channels not feeding alert info into custom EventLog

Environment= SCOM 2016  Management Servers=Windows Server 2016

Had an issue recently where I had created custom scom command channels to write custom alert information into a custom event log that I had created and it was not working.

Full path of command file:

C:\windows\system32\cmd.exe

Command Line Parameters:

/c c:\windows\system32\eventcreate.exe /L “MyCompany SCOM Notifications” /T ERROR /ID 888 /D “ALERT_SOURCE: $Data[Default=’Not Present’]/Context/DataItem/ManagedEntityPath$\$Data[Default=’Not Present’]/Context/DataItem/ManagedEntityDisplayName$, ALERT_NAME: $Data[Default=’Not Present’]/Context/DataItem/AlertName$, ALERT_DESCRIPTION: $Data[Default=’Not Present’]/Context/DataItem/AlertDescription$, ALERT_SEVERITY: $Data[Default=’Not Present’]/Context/DataItem/Severity$, ALERT_PRIORITY: $Data[Default=’Not Present’]/Context/DataItem/Priority$, ALERT_CATEGORY: $Data[Default=’Not Present/’]/Context/DataItem/Category$, ALERT_RESOLUTION_STATE: $Data[Default=’Not Present’]/Context/DataItem/ResolutionStateName$, ALERT_OWNER: $Data[Default=’Not Present’]/Context/DataItem/AlertOwner$, ALERT_RESOLVED_BY: $Data[Default=’Not Present’]/Context/DataItem/ResolvedBy$, ALERT_RAISED_TIME: $Data[Default=’Not Present’]/Context/DataItem/TimeRaisedLocal$, ALERT_RESOLUTION_TIME: $Data[Default=’Not Present’]/Context/DataItem/ResolutionStateLastModifiedLocal$, ALERT_LAST_MODIFIED_TIME: $Data[Default=’Not Present’]/Context/DataItem/LastModifiedLocal$, ALERT_LAST_MODIFIED_BY: $Data[Default=’Not Present’]/Context/DataItem/LastModifiedBy$, ALERT_WEB_CONSOLE_LINK: http://myscomwebconsole.mydomain.com/OperationsManager?DisplayMode=Pivot&AlertID=$Data/Context/DataItem/AlertId$”

Startup folder for the command line:

c:\windows\system32

After much head scratching I realised that the custom event log was only configured on 1 management server but both my management servers were members of the Notifications Resource Pool.

Fix

Changed Notifications Resource Pool to manual membership and removed the management server that didn’t have the custom event log on it

 

Advertisements
This entry was posted in SCOM 2016 and tagged , , , , , , , , , , . Bookmark the permalink.

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Google+ photo

You are commenting using your Google+ account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s