I need to make an Event Correlation monitor. Easy right? The catch is that the second event is missing. It’s easy enough to make a missing event correlation monitor, but the first event has to be there. There doesn’t seem to be a way through the GUI to make the monitor find event A, wait an hour, and look for another event --- if event B is missing send an alert. If the event is there = healthy. I can find event A then find event B and things are healthy, but I need an alert if event B is missing.
I exported the management pack and changed the SecondCorrelated to reflectSecondMissingCorrelated. But SCOM wont validate the MP on import which makes sense because the string is in the wrong monitor type.
Any ideas?
I find it weird that this functionality isn’t built in. I can have two events show up and create an alert, or I can have two events not show up and create an alert. But I can’t have one event show up, and the correlating event be missing to create an alert. Am I missing something?
OpsMgr 2007 R2 btw if that akes a difference.
- Get on the floor, do that dinosaur