Get-Overrides created on Specific Day .

hi,

yesterday one of our  SCOM admin created few overrides in SCOM and today he is on leave and the also not picking up the phone and I need to know which overrides he created.

Then i think that lets try to write a little basic PowerShell script which show the list of overrides created between specific number of days.

you can download the script from here : http://dl.dropbox.com/u/17858935/Get_SCOM_Overrides_by_Day_Created.zip

Make sure you run this script in “Operations manager Shell”

   1: ### I set $olddate to 2 Days ago date

   2:  

   3: $olddate = (Get-Date).AddDays(-2)

   4:  

   5: ## Select every Management pack and Piped it to "Get-Override)

   6:  

   7: $Mp = Get-Managementpack | Get-Override 

   8:  

   9: ### Now it will show only overrides which are created after $oldDate

  10:  

  11: $Mp| Where-Object { $_.TimeAdded -gt $olddate} | select ManagementGroupId,Name,TimeAdded | fl *

  12:  

  13: ######## E N D of S C R I P T #############

in $olddate i minus 2 days so if today is 18 November then $olddate should have 16 November stored in variable

in variable $Mp in am storing all Management packs and piped them to Get-Overrides

lets run $Mp lets see what we will get.

It shows the list of all Overrides in all management packs. Now we need to sort them.

$Mp| Where-Object { $_.TimeAdded -gt $olddate} | select ManagementGroupId,Name,TimeAdded | fl *

in above command , we piping $MP to where-Object cmdlet and choosing TimeAdded property in Overrides and comparing them with our variable $OldDate , so if the TimeAdded is property is greater then 16 November then it show all the Overrides created between 17,18 November.

seems working … :)

Download Link: http://dl.dropbox.com/u/17858935/Get_SCOM_Overrides_by_Day_Created.zip

Hope someone like it :)

Thanks

Aman Dhally

SCOM: Use Operations Manager Shell to close multiple Alerts generated by Same Rule

Hi,

When today i login in to my SCOM console I saw approx 134 Active Alerts about Microsoft SQL Job failure. I was about to close these alert but then one thing strike in my mind that lets try to close these alerts using “Operations Manager Shell”. These Alerts are generating from same source and the name of the alert is same to it would not be to hard. So let try.

Our First Step is to find out the Command which can show us Alert in SCOM Shell.

Open “Operations manager shell” and type  Get-Command *alert* , this will search for all SCOM cmdlets which have the word alert (we use wildcard *), and as you know PowerShell cmdlets works on Verb-Noun format  so if we use Get-Alert cmdlets it will shows all alerts.

Let Try Get-Alert

Type get-alert in the shell and hit Enter and it shown you all alerts.

Next task is to choose which Alert to Close .. if you look at active Alert in SCOM CONSOLE name of My Alert is “"A SQL job failed to complete successfully"

 

Now our next step is to find the properties and methods supported by Get-Alert command. To know these we need to use another command Get-Member

Yes.. it has name property…Gr8

Now we need to see all alerts whose name match “"A SQL job failed to complete successfully", for filter the output from Get-alert command we pipe (|) the output of Get-Alert command to Where-Object cmdlet.

Get-alert | Where-Object { $_.Name -match "A SQL job failed to complete successfully"}

 

This will show all alerts whose name matches with "A SQL job failed to complete successfully"

So now our next step is to find a cmdlet which can close these alerts. lets find out..  run the same command

Get-Command *alert*

So this time we have find Resolve-Alert cmdlet. now we need to join and our cmdlets command using piping . so this should be like this.

get-alert | where-object { $_.Name -match "A SQL job failed to complete successfully"} | Resolve-alert

in Get Alert we are searching for an Alerts | then we are filter then using Name with match to “Sql job Failure | and then we are resolving them.  now type the above command and hit enter. It will take sometime to do this.

When you command run successfully, open SCOM Console and search for same SQL JOB error and you will found nothing :)

 

I hope that it helps someone…

Thanks

Aman Dhally