Microsoft System Center Operations Manager 2007 as well as 2012 provides an API for developers to be able to access and manipulate SCOM event and alert data. While it is possible (and tempting) to open up Operations Manager database directly using SQL Server Management Studio and “figure out” which view or table you want to query directly, to do this in an official/supported way, you need to create a SCOM connector, add a subscription specifying which events should be sent to the connector, and then finally write some code.
In this post we’ll take a look at how to get at those forwarded alerts through the connector. It actually isn’t all that complicated.
Create a New VB Project
I use Visual Basic 2010 Express. Create a new project using Console Application or Class Library template. Which one you would use depends on how you want to consume this data from SCOM – Console Application might be a good fit for a Windows service, whereas Class Library might be suited better as a sub-component in a bigger VB.NET project. Selecting the right project template is not salient to this post.
Add SCOM 2007 or SCOM 2012 SDK References
Depending on which product you use, SCOM 2007 or SCOM 2012, you will need to reference the right version of the SDK from your VB.NET project. In both cases, the SDK is a collection of three DLL files, located inside the product installation directory. In SCOM 2012, directory is as follows:
C:\Program Files\System Center 2012\Operations Manager\Server\SDK Binaries
Grab the three DLLs from this directory and copy to the directory structure of your project, then add references to the following two from within your project:
Import SCOM Namespaces
Start off with importing the namespaces that we will use to work with SCOM SDK objects:
Imports Microsoft.EnterpriseManagement Imports Microsoft.EnterpriseManagement.Administration Imports Microsoft.EnterpriseManagement.Monitoring Imports Microsoft.EnterpriseManagement.ConnectorFramework Imports Microsoft.EnterpriseManagement.Common Imports Microsoft.EnterpriseManagement.Configuration
Connect to the SCOM Server
Connecting to the SCOM server is somewhat tricky. You need to specify which connector you are interested in, so I am going to make an assumption that you know its GUID.
Dim mg As ManagementGroup Dim conGuid As Guid Try mg = New ManagementGroup(My.Settings.ManagementGroup) cfa = mg.GetConnectorFrameworkAdministration conGuid = My.Settings.ConnectorGUID con = cfa.GetMonitoringConnector(conGuid) Catch ex As Exception 'handle runtime errors here End Try
Line 5 takes the name of the SCOM Management Group from the VB.NET project settings. Line 8 takes the GUID of the particular connector from the project settings. Line 9 initializes connection object (con) which you will use in the next step to make a call for new notifications.
Request Notifications from the Connector
As a good practice, always handle runtime errors in your code by using Try…Catch…End Try block. So the next section of the code is the “secret sauce” that does the actual work – calls the connector and gets the references to all alerts that have been created or modified since the previous such call.
Try Dim Alerts As ReadOnlyCollection(Of ConnectorMonitoringAlert) Alerts = con.GetMonitoringAlerts(My.Settings.SubmissionBatchSize) If Alerts.Count <> 0 Then For Each a In Alerts '(handle each message you get from the connector here) Next 'Alert con.AcknowledgeMonitoringAlerts(Alerts) Else 'pending alerts = 0 End If Alerts = Nothing Catch ex As Exception 'handle runtime errors here End Try
Code block assumed on line 7 is really where developer creativity kicks in. On this line you have your variable “a” set to the first object in the collection of objects you received from the connector. Do with it what you will… Full list of MonitoringAlert class properties and methods can be viewed on MSDN.
Retrieve Notifications in Batches
Note that on line 3 I am making a call to the connector, supplying my own batch size value. This is done so as to not overwhelm the connector system as well as SCOM service, in case we have hundreds/thousands of pending alert notifications. You are advised to create a loop here and request/process alert notifications in batches, until all notifications are processed (Alerts.Count = 0).
Acknowledge Notifications Eventually
At the end of the loop that deals with notifications, call AcknowledgeMonitoringAlerts method to let the connector know that you received “those” alerts and don’t want to see the same notifications again (line 10). It is best to supply a collection of alerts back to SCOM during this call, to make sure that there is no ambiguity about which notifications you are acknowledging.
Don’t Forget to Clean Up
When you are done working with the connector, don’t forget to destroy your variables (especially ones containing large alert collections) and also close down your connector:
'con.Uninitialize() - this will delete connector w/o subscriptions; do not call cfa.Cleanup(con)