Open Alerts but the Health Explorer shows Healthy (SCOM 2012)

A couple of years ago, I wrote a post about when SCOM shows open alerts in the console (with a warning or error condition), but the Health Explorer shows that the monitored object is actually Healthy … you can find that post here.

In SCOM 2012, this has changed somewhat. For a start, the cmdlet name has changed to Resolve-SCOMAlert.

But running this command doesn’t work whereas in 2007 it did:

Get-SCOMAlert | ? {$_.IsMonitorAlert -eq $True -and $_.ResolutionState -ne 255 -and $_.MonitoringObjectHealthState -eq “Success”} | Resolve-SCOMAlert -comment “Monitor is now Healthy”


As you can see from the screenshot below, it does update the alert with the comment “Monitor is now Healthy” but it DOES NOT Resolve or close it.








So now I’m using this command where I’m using “Set-SCOMAlert” and forcing the ResolutionState to 255 (Closed) and adding the same comment. This one works.

Get-SCOMAlert | ? {$_.IsMonitorAlert -eq $True -and $_.ResolutionState -ne 255 -and $_.MonitoringObjectHealthState -eq “Success”} | Set-SCOMAlert -ResolutionState 255 -comment “Monitor is now Healthy”


This time the alert is closed.


Alert History










This will only work if the entire computer object is healthy. It does not take the health of the monitor objects into consideration.

Therefore i wrote the following that does check the underlying objects;

#get open alerts
$Alerts = Get-SCOMAlert -Criteria “ResolutionState != 255 AND IsMonitorAlert = ‘True’ AND MonitoringObjectInMaintenanceMode = ‘False'”

$MonitorList = New-Object “System.Collections.Generic.List[Microsoft.EnterpriseManagement.Configuration.ManagementPackMonitor]”

#loop through the alerts
ForEach($Alert in $Alerts) {

$Monitor = Get-SCOMMonitor -id $Alert.MonitoringRuleId

if($Monitor) {
$MonitorList.Add($Monitor) | Out-Null
$MonitoredInstance = Get-SCOMClassInstance -Id $Alert.MonitoringObjectId
$Result = $MonitoredInstance.GetMonitoringStates($MonitorList)
if ($Result.HealthState -eq “Success”) {

#Close the alert
$Alert | Set-SCOMAlert -ResolutionState 255 -Comment “Closed by Automation Script” | out-null
Write-Host “Closing alert ‘$($Alert)’ for object ‘$($MonitoredInstance.DisplayName)'”

$MonitorList.Remove($Monitor) | Out-Null



Good work, thanks Tommy.

Leave a Reply