How to exclude specific services from State monitoring?

[Transam388]

We have MOM 2005 and are just getting WAY to many alerts for things that do
not need to be monitored. IE there is one particular service that always
gives an alert that I would like to exclude. Now in the Override it only
seems to allow me to exclude an entire machine. How can I just drill down to
the rule group and alert, then set the particular event rule to just exclude
this and other services that do not need to be monitored while still keeping
the computer and other services monitored? Have searched the web and really
see no granular exclusions allowing all other services except for the ones
specified to be monitored. Thanks for any help!

[Anders Bengtsson [MVP]]

Hi Transam388,

Are you in MOM 2005 or in Ops Mgr 2007? You wrote MOM 2005 but are talking
about overrides, that we do in Ops Mgr 2007.
In MOM 2005 you can edit the rule and add advanced critera to not generate
an alert if the event description contains *servicename*.

--
Anders Bengtsson
Microsoft MVP - Operations Manager
http://www.contoso.se

T> We have MOM 2005 and are just getting WAY to many alerts for things
T> that do not need to be monitored. IE there is one particular service
T> that always gives an alert that I would like to exclude. Now in the
T> Override it only seems to allow me to exclude an entire machine. How
T> can I just drill down to the rule group and alert, then set the
T> particular event rule to just exclude this and other services that do
T> not need to be monitored while still keeping the computer and other
T> services monitored? Have searched the web and really see no granular
T> exclusions allowing all other services except for the ones specified
T> to be monitored. Thanks for any help!
T>

[Transam388]

It is MOM 2005. The rules have a rule-disable override criteria (My bad on
the wording) but about the only thing it lets you exclude is the entire
machine or a computer group from the rule. Since I still want to know if
other services go down I do not want to exclude based on server name but
specifically which services it does not notify about.

At least from what I have seen in the Advanced criteria though it does not
allow me to specify a set of services not to monitor. I can say monitor only
specific items but then I need to create a separate rule for every service I
do want to monitor since that is based on an include rule set and not an
exclude. Just seems like this would be a very helpful thing and am surprised
MS does not have a quick easy way not to create a whole new rule but just say
keep monitoring all other services except these specific ones.

Thanks for the input!

[Transam388]

OK, and now after looking more into what you said I think I may have this. I
can use the "Description" field and set to does not equal and set the
Description it gives for that alert. So hence it should not match if that is
there and not generate an alert. Thanks again for your help!!

[Transam388]

I just cannot get this hammered out. Now, if I have several specific
services I do NOT want to recieve an alert for how do I put multiple "Does
not equal" parameters in the rule? IE I did not want to recieve an alert for
this i8042prt service not starting so I went to advanced and set field
description not equal to i8042prt. Now if I want to exclude other services
how do I add those as it does not allow multiple "Description" fields? Do I
use a ; or something to separate the values? Thanks and sorry for asking a
million questions on this!

[Anders Bengtsson [MVP]]

Hi Transam388,

Think you can use match boolean expression to include a number of different
words. I dont have a MOM 2005 console in front of me, but I think there is
a OR that you can use, something like ALERT DESCRIPTION and then contains
*WORD1*|*WORD2*|*WORD3*

--
Anders Bengtsson
Microsoft MVP - Operations Manager
http://www.contoso.se

T> I just cannot get this hammered out. Now, if I have several specific
T> services I do NOT want to recieve an alert for how do I put multiple
T> "Does not equal" parameters in the rule? IE I did not want to
T> recieve an alert for this i8042prt service not starting so I went to
T> advanced and set field description not equal to i8042prt. Now if I
T> want to exclude other services how do I add those as it does not
T> allow multiple "Description" fields? Do I use a ; or something to
T> separate the values? Thanks and sorry for asking a million questions
T> on this!
T>
T> "Transam388" wrote:
T>

[Transam388]

Well first Anders I would like to thank you for hanging in there with me on
this one!

The criteria description now has this... Event Number matches regular
expression '^(7000|7001|7002|7003|7008|7013|7014|7022|7023|7025|7026|7038)$'
Source Name equals 'Service Control Manager'
Description not equals '*i8042prt* | *IPLink Media Service*'

Now it was with your help that I got the Description not equals so if it
does then those two service outages should not send an alert. Does the above
look correct? Thanks again Anders!!

[Anders Bengtsson [MVP]]

Hi Transam388,

That was something like that I had in mind, with the |

--
Anders Bengtsson
Microsoft MVP - Operations Manager
http://www.contoso.se

T> Well first Anders I would like to thank you for hanging in there with
T> me on this one!
T>
T> The criteria description now has this... Event Number matches regular
T> expression
T> '^(7000|7001|7002|7003|7008|7013|7014|7022|7023|7025|7026|7038)$'
T> Source Name equals 'Service Control Manager'
T> Description not equals '*i8042prt* | *IPLink Media Service*'
T> Now it was with your help that I got the Description not equals so if
T> it does then those two service outages should not send an alert.
T> Does the above look correct? Thanks again Anders!!
T>
T> "Anders Bengtsson [MVP]" wrote:
T>

[Howard Catling]

Hi Transam388

Where you able to exlude multiple services in the end?
If yes could you perhaps give me the full syntax?

Thanks