Get machine name out of alert

We are working to create integration with our alerting system and need to get the machine name out of the alert so it can properly route the alert. We have not seen anything standard that just shows the machine name for the source yet. They all include other data either before a / or after a \ or even after a ; Has anyone found an easy solution for this?

Hey Rick,

Not sure how you are interfacing with the ticketing system now, I assume you use a command channel?

I think you will have to use the MonitoringObjectPath of the alert and strip it with powershell (with something like split).

Br,
Jasper

Hi Rick,

We are doing this using a script to connect via API to our ticketing system. From the alert details we use ‘Netbioscomputername’ and if that is null then it uses ‘MonitoringObjectDisplayName’ so we try both source and path.

For some objects such as clusters we have had to add them into our ticketing system as “Servers” so that it can pull back details from it but apart from that it works for almost everything and we’re putting in workarounds where it doesn’t work.

Yes we would have to use the command channel the issue we ran into is there does not seem to be a standard for the format.

Exchange-2013.zip (2.01 KB)

That sounds like exactly what I need. I have never written anything like this for SCOM before though can you give me some details on how get those out of there?

Do you have Orchestrator configured in your environment? Its what we use for SCOM notifications/job logging and really simplifies this and adds way more functionality than the command channel. There is a SCOM integration pack which includes a “get-alert” activity that pulls all the information from alerts and then we feed that to a script connecting via API to our ITSM tool,

If you dont have that in place I think the command channel parameter for Alert Source already includes both Source and Path so you’d need to include that into the script somehow.

I’m not sure thats any help at all sorry! Would highly recommend Orchestrator though :slight_smile: