Using SCOM get-scomalert criteria

The scom alerts for a particular computer can be retrieved by the following commands.

Get-SCOMAlert -ResolutionState 0 | ?{$_.PrincipalName -match 'SQL' -OR $_.PrincipalName -match 'WEB'}

Get-SCOMAlert -Criteria {ResolutionState = 0 and PrincipalName like '%SQL%'  or PrincipalName like '%WEB%'}}

There is significant difference in the time taken for the two commands to be processed.

PS C:\Windows\system32> Measure-Command{Get-SCOMAlert -ResolutionState 0 | ?{$_.PrincipalName -match 'SQL' -OR $_.PrincipalName -match 'WEB'}}
Days : 0
Hours : 0
Minutes : 0
Seconds : 0
Milliseconds : 604
Ticks : 6047616
TotalDays : 6.99955555555556E-06
TotalHours : 0.000167989333333333
TotalMinutes : 0.01007936
TotalSeconds : 0.6047616
TotalMilliseconds : 604.7616

PS C:\Windows\system32> Measure-Command{Get-SCOMAlert -Criteria {ResolutionState = 0 and PrincipalName like '%SQL%'  or PrincipalName like '%WEB%'}}
Days : 0
Hours : 0
Minutes : 0
Seconds : 0
Milliseconds : 156
Ticks : 1564777
TotalDays : 1.81108449074074E-06
TotalHours : 4.34660277777778E-05
TotalMinutes : 0.00260796166666667
TotalSeconds : 0.1564777
TotalMilliseconds : 156.4777

The winner is clearly the criteria field. The accepted ones are .

Id
Name
Description
MonitoringObjectId
MonitoringClassId
MonitoringObjectName
MonitoringObjectDisplayName
MonitoringObjectPath
MonitoringObjectFullName
IsMonitorAlert
ProblemId
MonitoringRuleId
ResolutionState
Priority
Severity
Category
Owner
ResolvedBy
TimeRaised
TimeAdded
LastModified
LastModifiedBy
TimeResolved
TimeResolutionStateLastModified
CustomField1
CustomField2
CustomField3
CustomField4
CustomField5
CustomField6
CustomField7
CustomField8
CustomField9
CustomField10
TicketId
Context
ConnectorId
LastModifiedByNonConnector
MonitoringObjectInMaintenanceMode
MonitoringObjectHealthState
ConnectorStatus
NetbiosComputerName
NetbiosDomainName
PrincipalName
AlertParams
SiteName
MaintenanceModeLastModified
StateLastModified

Some more examples using criteria.

Get-ScomAlert -criteria {"Name LIKE 'Failed to connect to computer%' and ResolutionState = 0"}

Get-ScomAlert -criteria {"TimeRaised > '01/03/2017 23:59:00' and ResolutionState != 0"}

$date = $(Get-Date).AddMinutes(-30).ToUniversalTime()
$Alerts = Get-ScomAlert -criteria "ResolutionState = 0 and TimeRaised > '$date'"

Get all new and critical alerts
 $Alerts = Get-SCOMAlert -Criteria {"ResolutionState=0 and Severity=2"};$Alerts

Get all new and warning alerts
 $Alerts = Get-SCOMAlert -Criteria {"ResolutionState=0 and Severity=1"};$Alerts

Get all new and informational alerts
 $Alerts = Get-SCOMAlert -Criteria {"ResolutionState=0 and Severity=0"};$Alerts



Important note: The criteria parameters are case sensitive  so make sure you are using the right one.









 

Increase number of objects seen in SCSM SharePoint portal query result prompt

Connect to your SharePoint portal server and open inetmgr.

Navigate to Sites - SCSMWebContentServer - ServiceHost

Double click Application Settings. From Actions select add and add the following value.

Name: MaximuminstanceCount

Value: 5000

When was your server rebooted last

Use this command in windows cmd to get the last time your server booted up or was rebooted.
C:\>systeminfo | findstr /i boot
System Boot Time: 10/5/2016, 1:13:08 PM
Boot Device: \Device\HarddiskVolume2
As to who rebooted it ;). You can search the system event log for events with id 1074.

Put Scom Agents and Cluster Servers in Maintenance mode and reboot

Here is a script to put your scom agents including clusters in maintenance mode and rebooting them at a specified time. First you will have to create a task and a management pack in SCOM for rebooting the servers. Link on how to create the management pack is here. https://technet.microsoft.com/en-us/library/hh563486%28v=sc.12%29.aspx?f=255&MSPPError=-2147217396.
Works on System Center Operations Manager 2012 R2.

Create the input files and output files on the locations that you prefer. I have created them in C:\Reboots folder. Add your server names in the input file. Then the script given below can be put in a scheduled task and run at specified times or on demand. You can also run the script manually. Make sure that you modify the maintenance window.

I have not yet added any code to verify and alert if the rebooted servers are not back up.

Will probably do so at a later time. Till then feel free to use this one and modify any way that you like.

#################Script Start ####################################

$RootMS = "RMSName"
$Minutes =  90
$Comment = "Unknown"
#Setting up SCOM connection

Import-Module OperationsManager
$null = New-ScomManagementGroupConnection -ComputerName $RootMS
Add-PSSnapin "Microsoft.EnterpriseManagement.OperationsManager.Client" -ErrorAction SilentlyContinue

$eventLog = New-Object System.Diagnostics.EventLog("Operations Manager")
$eventLog.Source = "Maintenance Mode"

$Servers = GC "C:\Reboots\input.txt"
Function Out($output)
{
Out-File -Filepath "C:\Reboots\output.txt" -InputObject $output -Append
}

Out "###############  Starting Script at $(Get-Date)  ##########################"
foreach($Server in $Servers)
{

$output = "Starting for $Server on $(Get-date)"
Out $output

###Putting the agent and cluster in maintenance mode###########
$agent = Get-ScomAgent | Where-Object { $_.DisplayName –eq $Server -or $_.ComputerName -eq $Server -or $_.PrincipalName -eq $Server }
if(!$agent) { Write-Host "ERROR: $Server is not a monitored system in SCOM." -ForeGroundColor Red; Set-Location $originalPath; return }
$Server = $agent.PrincipalName
$startTime = (Get-Date).ToUniversalTime()
$endTime = $startTime.AddMinutes($Minutes)
if(($clusters = $agent.GetRemotelyManagedComputers())) {
$clusterNodeClass = Get-SCOMClass -Name Microsoft.Windows.Cluster.Node
foreach($cluster in $clusters) {
#$clusterObj = Get-SCOMClass -Name Microsoft.Windows.Cluster | Get-ScomMonitoringObject -Criteria "Name='$($cluster.ComputerName)'"
$clusterobj = Get-SCOMClass -Name Microsoft.Windows.Cluster | Get-SCOMClassInstance | ?{$_.displayname -eq $cluster.ComputerName}
if($clusterObj) {
$clusterObj.ScheduleMaintenanceMode($startTime,$endTime,"PlannedOther",$Comment,"Recursive")
$nodes = $clusterObj.GetRelatedMonitoringObjects($clusterNodeClass)
if($nodes) {
foreach($node in $nodes) {
Out "Putting $node into maintenance mode."
$eventLog.MachineName = $node.Name
$eventLog.WriteEntry("The server entered into maintenance mode $(if($Server -notcontains $node.Name){"on behalf of $Server"}).`r`n`r`nDuration:`t$Minutes minutes`r`nReason:`t$Comment","Information",42)
}
}
}
Out "Putting $($cluster.Computer) into maintenance mode."
New-MaintenanceWindow -StartTime $startTime -EndTime $endTime -MonitoringObject $cluster.Computer -Reason PlannedOther -Comment $Comment
}
}
else {
Out "Putting $Server into maintenance mode."
$eventLog.WriteEntry("The server entered into maintenance mode.`r`n`r`nDuration:`t$Minutes minutes`r`nReason:`t$Comment","Information",42)
New-MaintenanceWindow -StartTime $startTime -EndTime $endTime -MonitoringObject $agent.HostComputer -Reason PlannedOther -Comment $Comment
}
#####Sending commands to the server###########

$Task = Get-SCOMTask -DisplayName "Reboot Computer"
$Overrides = @{Arguments = '"$Target/Property[Type="MicrosoftWindowsLibrary7585010!Microsoft.Windows.Computer"]/PrincipalName$" "true"'}
$Instance = Get-SCOMClassInstance | ?{$_.Name -eq $agent.name}
Out "Starting task to reboot $($Instance.Displayname) at $(Get-Date)"
Start-SCOMTask -Task $Task -Override $Overrides -Instance $Instance

}

Out "###############  Script Complete at $(Get-Date) #########################"

#################Script End ####################################


I don't take credit for all the scripts that I written. Whenever I can credit the original creators, I do.  If I don't at times please do inform me so that I can include them in the page.