If you have an environment containing both Hyper-V 2008 and 2012 servers and thus have the Hyper-V 2008 Management Packs installed you’ll find you get some false alerts for your 2012 Hyper-V servers.

The 2008 Hyper-V Management pack looks for event logs that no longer exist in Hyper-V 2012 thus you’ll receive an alert stating an event log is inaccessible.

Example SCOM Alerts:

Alert description: The Windows Event Log Provider is still unable to open the Microsoft-Windows-Hyper-V-Network-Admin event log on computer ‘hostname’. The Provider has been unable to open the Microsoft-Windows-Hyper-V-Network-Admin event log for 720 seconds.

Alert description: The Windows Event Log Provider is still unable to open the Microsoft-Windows-Hyper-V-Image-Management-Service-Admin event log on computer ‘hostname’.
The Provider has been unable to open the Microsoft-Windows-Hyper-V-Image-Management-Service-Admin event log for 6480 seconds.

To resolve this you need to create an override that excludes your Hyper-V 2012 hosts from these monitors as follows:

1. In the SCOM Management console navigate to Authoring > Management Pack Objects > Monitors
2. Click Scope button at the top of the console, enter ‘Hyper-V’ > View All Targets > Select All > OK
3. In the Look for field enter ‘Connectivity’ > Find
4. For both ‘Port Connectivity’ and ‘Port Disconnectivity’ right click the Monitor > Overrides > Disable the monitor > For a specific object of class
5. You should see your Agent managed Hyper-V hosts, tick the 2012 Hyper-V Hosts > OK
6. Back to the Look for field enter ‘mounted drive’ > Find
7. Find the ‘Mounted Drive Read-Only’ monitor > Right click > Overrides > Disable the monitor > For a specific object of class
8. Select your 2012 Hyper-V hosts > OK

I found the alerts didn’t recover automatically after adding the overrides and had to manually mark them as resolved/closed.

James

I’ve been working on a System Center Operations Manager (SCOM) 2012 deployment recently. Now that Microsoft have made Service Pack 1 fully available it appears the normal Alert URL is somewhat broken.

The original Alert URL looks something like this: http://scomwebserver/OperationsManager/default.aspx?DisplayMode=Pivot&ViewType=AlertView&AlertID=$UrlEncodeData/Context/DataItem/AlertId$
However since the installation of Service Pack 1 the Alert View never actually completes loading.

The workaround for the time being is to update the Alert URL in your Channel Notification to: http://scomwebserver/MonitoringView/default.aspx?DisplayMode=Pivot&ViewType=AlertView&AlertID=$UrlEncodeData/Context/DataItem/AlertId$
This works, but you must first authenticate at the /OperationsManager URL first as it appears that authentication fails if you browse to the MonitoringView without having visited the OperationsManager URL first!

A pretty irritating problem, hopefully it won’t take long for MS to release a fix. Cumulative Update 1 for SP1 was released pretty quickly after the release of SP1.
I’ll post an update once a fix has been released.

James