A key integration point of Service Manager (SM) with its sister product, Operations Manager (OM) is that of the Alert Connector. In a nutshell, when this connector is created, a connector is created in both SM and OM. The newly created OM internal connector funnels alerts to SM via its corresponding SM connector. For more information on this connector see Marc Umeno's introductory post about the alert connector. Over the past few weeks I've been getting requests to throw together a basic FAQ concerning this connector
I created the connector and I am not seeing OM Incidents in SM. What is going on?
Unfortunately just creating the connector pointing to the OM box is not enough. You need to manually forward alerts to SM (not optimal), or create a subscription for the connector in OM to automatically forward the alerts to SM.
Is it possible for me to forward the same alert to two different OM connectors by having overlapping subscriptions?
If such a subscription is created, it will not be deterministic which connector will get the alert. We recommend that your OM internal connector created by SM have a unique subscription.
I created my alert connector but I do not see it updating the status columns in the UI. What is going on?
You probably saw something like this upon initial connector creation:
Unlike the other connectors, the status columns of the SCSM OM Alert connector are only updated when:
· When sync fails.
· Whenever an alert flows from OM to SM.
Other than those two cases, the time shown is the time the connector last received an alert or sent an incident change.
What events in the event log deem that the connector was created successfully?
On the SM server, open the event viewer and navigate to Applications and Service Logs > Operations Manager. Upon initially creating the connector (without forwarding alerts), you will see 4 events:
Service Manager Console
A message denoting that the connector was created on the SM side.
Operations Manager Connector
A message stating that an internal OM connector was created and that its subscription should be initialized.
Begin connector sync
End connector sync
Note, due to the fact that the Alert connector sync's at such a high frequency (at a minimum of 30 seconds), the events denoting start/end sync are only listed once, and not for each time the connector syncs.
Is there any way I can get a more verbose sync start/stop logging, so I can see actually when syncing happens?
Yes! Do the following steps:
1. Open up regedit and navigate to HKLM\SOFTWARE\Microsoft\System Center\2010\Service Manager
2. Under the Service Manager node create a subkey called "OperationsManagerConnector"
3. Under the OperationsManagerConnector connector node create a new string value called "FirstRun" with a value called "FirstRun".
4. Open your event viewer and notice that you will see events logged to the event log every time the Alert connector syncs.
Do note, this can get very chatty and fill up the event log, so remember to delete this registry key when this information is no longer needed.
Can I create more than one alert connector to the same SCOM management group?
Yes, one can, but it would be highly questionable why one would need to.
Can I create alert connectors from SCSM to more than one SCOM management group?
Most definitely yes!
I deleted my alert connector, but the internal connector still appears in OM. How do I get rid of the connector in OM?
The general behavior of deleting a connector in SM, is that its corresponding connector in OM should be deleted. In the rare case that this should not happen, the following blog post can shed light on how to do this:
Multiple SCSM - SCOM connectors
We have used multiple connectors to be able to filter P1 and P3 calls. E.g. One connector only allows Availability Critical alerts to be sent through. These match up to P1 Templates in SCSM.
While all the rest of the critical alerts are sent through a differnet connector that match up to P3 templates.
Thats how we are doing it now.. Does anyone have any comments on this ? Any other better way to do it besides overrides to set the severity and priority of each monitor ?
We are using the SCOM connector to create incidents within Service Manager and I always see that the incidents that it creates, it places the Operations Manager Server in the Affected Items field. When reports are run against the affected item we see all events for the SCOM server rather than the 'Source' that the original alert was generated for in SCOM.
Is it possible to push the 'Source' object from the SCOM alert into the 'Affected Items' field on a template in Service Manager when the connector is used to automatically create Incidents?