Jonathan's Manage and Automate

VMM SCO SMA WAP - Solutions and Guidance

Orchestrator Event Monitor fires multiple times for new events

Orchestrator Event Monitor fires multiple times for new events

  • Comments 2
  • Likes

image

What is Microsoft Orchestrator?! This blog now covers SC VMM as well as Orchestrator System Center components. To learn more about Orchestrator follow this link. Now on to troubleshooting…

The Runbook shown below is set up to monitor and send an alert for any new Application log events that have an Event ID of 808. This is a simple Runbook and is an ideal use of Orchestrator. There is a problem in that each time a new event such as the 808 event is logged to the event log, the Orchestrator Event Monitor executes a few times. It should fire only once per new event.

So how do we get around this? Simple. We use the Link following the Event Monitor activity as an additional filter. This of course is not an ideal setup, but it does get around an issue currently in Orchestrator 2012 SP1.

Here is the Runbook

image

 

Here are the details of the Event Monitor activity:

image

 

Here is the command we use to kick off the monitor.

image

 

Here we see that the event caused multiple firings of the Event Monitor.

image

 

 

Here, in the details of the link we set an Include filter for the same event. This will prevent the Event Monitor from firing more than once per new event log event.

image

With the additional Link setting in place we now have an Event Monitor that performs as we would expect. This issue should be corrected in a future release. No ETA at this time.

 

 

 

 

 

  jonjor

Comments
Your comment has been posted.   Close
Thank you, your comment requires moderation so it may take a while to appear.   Close
Leave a Comment