In a lot of default SCOM management packs provided by Microsoft, we can found 2-state or 3-state monitor without consolidator. This means that as soon as the state detection condition (based on a script for example) executed at a regular interval no longer fulfills the criteria, the associated monitor goes directly into a warning or critical condition and generally create an alert. But mostly, this is only a temporary status that corresponds to side effects resulting from other network services, and it’s not relevant for monitoring administrators to see these alerts in SCOM console or even receive notifications about it.
The simplest way to find if a monitor includes a consolidator mechanism is to look at monitor’s overridable parameters directly in SCOM console. If you can’t see “number of samples” parameter either in configuration or override tab, it means that monitor is not using consolidator mechanism.
If you need to work with some monitors based on default management pack provided by Microsoft without consolidator mechanism, you will have to create management pack(s) containing improved monitors and associated overrides. In this article, I will create a management pack containing improved monitor for SYSVOL share health monitoring on Active Directory Domain Controller and associated override. To achieve this I will use Visual Studio 2013 and VSAE extension available here.
The first thing to do is to find management pack that contains monitor to improve by going to its properties and looks at parent management pack.
Then you need to list management pack dependencies that you will have to reference in your custom management pack. You can find management pack dependencies by going to Administrator pane, then Management Packs and research for the MP we find previously. In dependencies tab of the properties window, you will have the full list of dependencies.
You need to get MP files for each of listed management packs as your custom management pack will use them as dependencies too. You can find default management packs in setup source files and download the others from Microsoft catalog. Then you will need to create a new project in Visual Studio depending on your version of SCOM.
You will add all dependencies management pack files and the management pack to improve.
Then you will need to create an empty management pack fragment that will contain improved monitor.
Next step will be to construct your monitor based on the existing one. The easiest way to accomplish this is to copy all parts (data source, monitor type, monitor, string resource and language pack) of the monitor to improve in an empty fragment.
Then you need to change unique ID of each object. For example, you can change data source ID from Microsoft.Windows.Server.2008.AD.EssentialService.SysVol.DataSource to Microsoft.Windows.Server.2008.AD.EssentialService.SysVolUpdated.DataSource.
You also need to update targets to your references alias or update your references alias to match existing target (preferred solution).
Then you will update monitor type by adding consolidator section.
You need to disable old monitor using override. In order to do this, you have to add a monitor property override into overrides section.
Finally, you can build management pack and import it into your SCOM environment.