Report on SCOM Alert Notification Subscriptions

Trouble tracking down alert notifications? A good word of advice is to be sure to include the notification subscription ID in your alert channel, such as follows…

Sponsors, article continues below...

Alert: Logon Failures – Multiple failures by same User on single Machine
Severity: 2
Source: ADS04.Domain.pvt
Path: ADS04.Domain.pvt
Last modified by: System
Last modified time: 9/22/2011 11:47:49 AM

Alert description: Multiple Logon Failures by user DOMAIN\user01 with logon type 0xffffffffc0000225. See Alert Context for more details.

Alert view link: “http://RMS01:51908/default.aspx?DisplayMode=Pivot&AlertID=%7bdbe48f98-2051-4d83-aecb-664a07c0eb46%7d”
Notification subscription ID generating this message: {BB47B5DE-176C-524C-FC13-2C8576C7000E}


Now that you have the subscription ID, you can use PowerShell to obtain the name of the alert via the subscription ID. This script will also show you who is subscribed to each notification subscription. NOTE: Be sure you load the SCOM PowerShell modules first!:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
######################################################################
## Usage: SCOMSubscriptions.ps1  #####################################
## Author: Stephen Leuthold (http://blogmynog.com) ###################
## Created: 9/22/2010 ################################################
## Modified: 12/5/2010 ###############################################
## Purpose: Obtain list of alert notifications and subscribers #######
######################################################################
 
$subs = get-notificationsubscription | Select-object Id,DisplayName,ToRecipients 
$out = ""
[system.array]$report = $null
foreach($sub in $subs) {
                $recipients = $sub.ToRecipients | %{$_.Name}
                foreach ($recipient in $recipients) {
                                $out = New-Object PSObject
                                $out | Add-Member -membertype noteproperty -Name Id -Value $($sub.Id)
                                $out | Add-Member -membertype noteproperty -Name Name -Value $($sub.DisplayName)
                                $out | Add-Member -membertype noteproperty -Name Recipient -Value $($recipient)
                                $report = $report + $out               }
 
} 
$report | export-csv c:\temp\SCOM_AlertSubscriptions.csv
This entry was posted in Microsoft, SCOM.

Leave a Reply

Your email address will not be published. Required fields are marked *

*