http://support.microsoft.com/kb/2592561
in particular there's a tidbit about modifying the alert severity and priority - something i've been trying to figure out for a while but with all the conflicts posts, i just gave up (hence my last post). well, this kb article reinvigorated the thought that it COULD be done, and sure enough, c'est fini!
how to override the alert severity or priority for an alert in the exchange 2010 mp-
the trick is that because of the correlation engine, you have to target the rule towards the root management server class (since that's where the correlation engine resides). i've read articles where they say it's a bad idea to modify any rules and to only modify the monitors - but modifying the monitors doesn't work and modifying the rules does - so... yea. if anyone has any insight as to whether or not i'm committing a sin by overriding a rule, then please enlighten me.
find which alert you want to change the severity or priority for:
right-click any of them > overrides > override the rule > for all object of another class...
choose root management server and click ok (not shown because i'm lazy)
in my case i want this alert (which is normally critical) to be informational. so i set the severity to 0 (use the table below for other options). notice the override target is the root management server class and i've saved this off to my exchange 2010 overrides mp.
|
Severity:
|
|
|
|
|
Critical
|
2
|
|
|
Warning
|
1
|
|
|
Information
|
0
|
|
Priority:
|
|
|
|
|
High
|
2
|
|
|
Medium
|
1
|
|
|
Low
|
0
|
and... wa-lah! after resetting the health from the health explorer on that specific DB and closing the alert, then just wait a few minutes and when the alert triggers again it'll be informational.
this will also help in filtering out specific alerts so they don't create tickets in service manager if you only allow "warning" and "critical" alerts to create IRs in service manager.
No comments:
Post a Comment