When speaking on Infrastructure Optimization many companies deploy System Center Operations Manager (SCOM) and believe that they have a complete solution. In Operations Manager alerts can be configured to apply a task or workflow as a response to the alert. In many cases this is simply an email that is sent to a pre-defined group to provide notification that an issue exists. Let’s take this one step further.
 
Notification that a problem exists is only a piece of the pie. Unless an incident is opened and tracked the condition that caused the alert will not be documented. If the issue is not documented it may recur leading to having some technician perform the same troubleshooting, diagnosis and repair on a repetitive cycle.

Microsoft System Center Service Manager (SCSM) provides additional functionality that can help companies facing this scenario. Through the use of connectors SCSM receives the alerts and can be configured to create an incident for the alert and assign the incident to the correct group in the same workflow. Once the issue has been resolved the first time, the resolution can be documented and saved as a Knowledge Article where it can be researched easily when the issue recurs. On recurring incidents the Knowledge Article can even be included as a part of the incident as a resolution recommendation.
  
Let’s look at a simple scenario – 

Scenario: SCOM is configured to provide alerting when a disk reaches or exceeds an 80% full condition. The server that provides services in the accounting department just had a file saved that caused an alert.   The file was actually an MP3 file that was not supposed to be saved. 
 
SCSM receives the alert through the connector and based on the group that maintains the server creates an incident and assigns it to the Tier1 support group responsible for the server. Since there have been repeated instances of MP3 files being saved and causing space issues so a Knowledge Article has been created and is attached to the incident. The Knowledge Article contains recommendations about which files can be safely removed from machines and includes company policy about the MP3 files that should not be stored on servers. 
 
A new hire in the Tier1 support group accepts the incident and begins working on it. He notices that there is a knowledge article associated with the incident and opens it to find the information about MP3 files. Upon researching the files on the server, he notices a large number of MP3 files stored in one location that amount to several GB of storage. Using the guidance in the article, he removes these files which resolves the server issue.

He updates the incident and changes the status to Resolved. SCOM then receives notification through the connector that the alert has been resolved and resolves the SCOM alert automatically. Now the issue has been opened, tracked, resolved and documented fully throughout the lifetime of the incident.
 
InfraScience has specialized experience to work with companies requiring assistance on this topic.Call or email for more information on our Microsoft Desktop and Systems Management Services.
 
Author: Mark Mears is a Senior Consultant with InfraScience in the Systems Management practice. He has been working with Systems Management and IT infrastructure since 1996 and enjoys speaking about the latest technologies to help companies save money and perform better.