I have a few custom event log rules that look for legacy app specific flags that are sent off to different oncall groups through subscriptions. However, I also need to send any critical alerts generated in SCOM 2007 R2 to a primary oncall team.
Setting up the notification subscription for anything generated by a specific rule or monitor is easy but how can I set up a catch all subscription to say 'send any critical alert NOt generated by any of my custom rules to a recipient'?
If I setup a subscription to send any critical alert it will send everything even alerts generated by my custom rules which will include a lot of alerts not meant for the primary oncall team.
Any ideas on how to create a subscription to catch anything not generated by any custom rules (overrides) I have created?