SCOM Alert History Grooming

By Rikard Ronnkvist, 2008-01-12 12:12 OpsMgr

Myself and Pontus Blomqvist found a small but annoying bug…

If you have an alert in SCOM that still isn’t resolved but an entry in the history is older than your grooming-settings the history-data will be groomed.

Why? If you look in to the stored procedure named p_AlertGrooming you can se that it works like this:
- Get setting for Grooming (Deleting)
- Loop thru all alerts that have resolution state = 255 (closed)
—- Groom the history-data for the alert
—- Groom the alert
- Groom all alert-history that are older than the grooming-setting (No matter what resolution state)

So the last step is not needed since the history is groomed when the resolution state is set to 255.

Workaround:
Find the delete-rows in the stored procedure named p_AlertGrooming and comment them out…

Change this 2 rows from:

DELETE dbo.AlertHistory
WHERE TimeAdded < @GroomingThresholdUTC
 

to:

– Change by Rikard Ronnkvist to keep history data from being groomed
– DELETE dbo.AlertHistory
– WHERE TimeAdded < @GroomingThresholdUTC