Creating Alerts in MOM
New alerts are added to the MOM configuration group through the FrameworkBase.InsertAlerts method.
The Alert.TicketId field can be used to associate the new MOM alert with events, alerts, or other types of source objects in other management systems.
Alerts added to MOM using the InsertAlerts method must have values set for the following fields:
- ComputerDomain
- ComputerName
- Description
- Name
- OwnerName
- ResolutionState
- Severity
- Source
- TimeRaised
The Alert class can represent either alerts that you are adding to MOM or alerts that already exist. Some of the alert fields behave differently depending on the context in which they are being used. When Alert objects are used with the InsertAlerts method, any value assigned to the AckId field or the AlertId field will be ignored by the MCF. Fields with an associated field ending in "Specified", such as ComputerId, are optional when you are using the InsertAlerts method.
The MCF and MOM create a new computer object to represent the computer that caused the alert, if the computer isn't already defined. When inserting alerts for computers that MOM could manage at a later point, you should use the correct values for the computer name and domain name fields of the alert. If the domain name is not used on all alerts, multiple computer objects could be created in MOM to represent the same computer.
If the computer does not use domains, or the domain can't be determined, the computer domain field of the alert should not remain blank. The connector should consistently set the computer domain to a specific string value, such as the connector's name, when the real domain name is not available.
The RuleId field associates the alert with a MOM rule. This is useful when the rule's Product Knowledge entry contains content that is relevant for the alert. If the alert does not have a rule, the RuleId should be set to null.
Alert Creation Rates
It is possible for one or more connectors to overload the alert queues on a MOM management group, since the MOM server does not restrict the rate at which new alerts are added using the InsertAlerts method. For example, when the connector starts up following a period of inactivity, it will often send a larger than normal number of alerts over a very short period of time in an attempt to catch up and synchronize with the MOM management group.
To avoid overloading the server, connectors should provide a configurable setting to specify the maximum rate of alert creation. The value will depend on the number of connectors registered with MOM, the number of servers monitored by MOM, and the capacity for the server running MOM to handle above-normal loads.