Customizing SCOM Alert Notifications – “Health Service Heartbeat Failure” and “Failed To Connect To Computer”

This post is in response to one of my blog followers, whom asked for assistance in customizing some common SCOM Alerts and the generate notifications.

Customizing SCOM Alert Notifications

The first scenario is when a server that is monitored by SCOM is shutdown, either on purpose or by accident. In effect, the server is offline. When the server becomes offline, by default you will received 2 Alerts in SCOM, as follows: Health Service Heartbeat Failure, and Failed To Connect To Computer. The first Alert (Health Service Heartbeat Failure), is a result of SCOM identifying a communication issue with the Agent installed on the target system. The second Alert (Failed To Connect To Computer), is triggered after the first, as SCOM attempts to PING the target system to verify if the issue is ONLY with the Agent, or if the target system in fact is not responding.

Default-Alerts-On-Server-Down Customizing SCOM Alert Notifications - "Health Service Heartbeat Failure" and "Failed To Connect To Computer"

SCOM Alerts Generated When Unable To Connect To A Server

Now, to the SCOM Administrator, or someone in IT, receiving an email notification from SCOM for either of these Alerts is sufficient to identify that an issue exists.

Default-Alerts-On-Server-Down Customizing SCOM Alert Notifications - "Health Service Heartbeat Failure" and "Failed To Connect To Computer"

SCOM Alert Notification – Default Email Format

However, what if a non-technical person also receives the same email(s)? What if a Manager wants to see an email that says “ServerName Is Down” or “ServerName Is Offline”? How do we accomplish that?

Identify The Alert(s)

The first piece of information that you need to collect is which Monitor or Rule is specifically generating the Alert you are interested in. In this example, with the 2 Alerts mentioned (Health Service Heartbeat Failure, and Failed To Connect To Computer), select the Alert in the Active Alerts view. In the Alert Details shown, you will see the Monitor or Rule that is generating the Alert.

As you can see in these examples, the “Health Service Heartbeat Failure” Alert is actually generated from the “Health Service Heartbeat Failure” Monitor; whereas the “Failed To Connect To Computer” Alert is actually generated from the “Computer Not Reachable” Monitor.

Default-Alerts-On-Server-Down Customizing SCOM Alert Notifications - "Health Service Heartbeat Failure" and "Failed To Connect To Computer"

Alert Details – Health Service Heartbeat Failure

Default-Alerts-On-Server-Down Customizing SCOM Alert Notifications - "Health Service Heartbeat Failure" and "Failed To Connect To Computer"

Alert Details – Failed To Connect To Computer

Now that we know the exact Rule or Monitor that generates the Alert, we can use this information when setting up the Notification Subscription.

Create A Customized Notification

Navigate to the Administration Workspace, to Administration > Notifications > Subscriptions. You will first need to make sure that you have a Channel and Subscriber setup. If you need assistance in doing these, see my SCOM 2012 SP1 in a LAB – Configuration Guide (Enable Notification Channels) article.

Let’s say that you already have a Subscription setup for the SCOM Administrators and/or other technical personnel that need to know when these Alerts occur. But, as mentioned at the beginning of this article, we want our own custom email subject/information for those that are less technical (i.e. Managers). So, start by making a new Subscription, and give it a name that clearly identifies it. Something like “Manager Alerts – Server Connectivity Alerts.”

The important part is on the Criteria page. On the Subscription Criteria page, select the “created by specific rules or monitors (e.g., sources)” option. You will see in the Criteria Description the word “specific” looks like a hyperlink.

Default-Alerts-On-Server-Down Customizing SCOM Alert Notifications - "Health Service Heartbeat Failure" and "Failed To Connect To Computer"

Notification Subscription – Criteria

When you click on the “specific” linked word, you will be presented with the Monitor and Rule Search dialog. It is from this dialog that you can search for the Rule or Monitor that generates the Alert you want to notify someone about. Remember that in this example, the “Health Service Heartbeat Failure” Alert is actually generated from the “Health Service Heartbeat Failure” Monitor; and the “Failed To Connect To Computer” Alert is actually generated from the “Computer Not Reachable” Monitor. So enter one of those Monitors in the Filter By textbox, and click Search. You will then see the Rule or Monitor listed in the Available Rules and Monitors list. Select in, then click Add to add it to the Notification Subscription Criteria. Then click OK.

Default-Alerts-On-Server-Down Customizing SCOM Alert Notifications - "Health Service Heartbeat Failure" and "Failed To Connect To Computer"

Monitor And Rule Search Dialog

Now that we have the Criteria set for our Subscription, there is still one area that we need to modify to make the resulting email (if that’s the Channel you are using), more non-tech friendly. Continue through the wizard, adding the Subscriber(s) as required. On the Channels screen, instead of just adding an existing channel, click on New and select Create Customized Copy. This will allow us to customize the message and subject for this specific Subscription, instead of using whatever has been configured by default.

Default-Alerts-On-Server-Down Customizing SCOM Alert Notifications - "Health Service Heartbeat Failure" and "Failed To Connect To Computer"

Notification Subscription – Channels

On the Channel Search dialog, find and add the Channel you plan to use (more than likely the SMTP Channel). After you have selected this Channel and pressed OK, the Email Notification Channel wizard will appear. Basically this is walking you through creating a new SMTP Channel, which will contain the customizations you want. You can give the new channel a more meaningful name, such as “SMTP Channel – Manager Notifications” to more easily identify what customizations you may have made to it. Continue through the wizard until you reach the Format screen. It is here where you can customize the Subject and Body of the email that will be sent.

For example, instead of accepting the default Email Subject of: Alert: $Data[Default=’Not Present’]/Context/DataItem/AlertName$ Resolution state: $Data[Default=’Not Present’]/Context/DataItem/ResolutionStateName$; you could change it to read something like: Server $Data[Default=’Not Present’]/Context/DataItem/ManagedEntityDisplayName$ Offline/DownIf you are a little confused by the long string, that is the display name object reference. For both of the Alerts in our example, the Alert Source is the computer name. Make any other similar changes to the body of the email as well, and complete the rest of the wizard.

Default-Alerts-On-Server-Down Customizing SCOM Alert Notifications - "Health Service Heartbeat Failure" and "Failed To Connect To Computer"

Notification Subscription – Channel – Custom Format

Test Customized Notification Subscription Results

Now it’s just a matter of testing the notification to ensure the email appears how you want it. Here’s a screenshot of my example. Notice the different Subject (I didn’t modify the Body, but you could definitely do so to your liking).

Default-Alerts-On-Server-Down Customizing SCOM Alert Notifications - "Health Service Heartbeat Failure" and "Failed To Connect To Computer"

SCOM Alert Notification – Customized Email Format

So, with these examples, you can create separate Notification Subscriptions for IT personnel, and for Management in order to make it easier for people to know/understand exactly what is going on. The same type of modifications can be applied to various Monitors such as: Logical Disk Free Space, Total CPU Utilization Percentage, and Available Megabytes of Memory; to name a few common Monitors.

I hope this article has been of assistance in understanding how you can further customize your email notification, and have different amounts of information/details sent to key stakeholders, depending on their needs. If this has been of help, please rate the article, comment on it, and share it with others. And if you are in a very generous mood, you can always donate to the operational costs of this site. Thanks.

Stay tuned for more articles, and if you have a request for something specific, feel free to contact me by sending an email via the About Me page (as the one individual did requesting this article). Oh, and don’t forget to follow/subscribe to this site!

This article is also available in video format!

%d bloggers like this: