Microsoft KB Archive/894319

= Multiple distinct alerts in the source management group are incorrectly suppressed into a single alert in the destination management group in Microsoft Operations Manager 2005 =

Article ID: 894319

Article Last Modified on 7/24/2007

-

APPLIES TO


 * Microsoft Operations Manager (MOM) 2005

-





SYMPTOMS
When the following conditions are true in Microsoft Operations Manager (MOM) 2005, multiple distinct alerts in the source management group are incorrectly suppressed into a single alert in the destination management group:
 * You use MOM-to-MOM Product Connector (MMPC) to forward alerts.
 * An alert-generating rule has an alert suppression criteria that use the following event properties:
 * Source Name
 * Event Number
 * Category
 * Description
 * Event Type
 * Message DLL
 * Message DLL File Version
 * Provider Name
 * User Name



CAUSE
This problem occurs because MMPC forwards alerts to the destination management group but does not forward events associated to those alerts. Then, there is no event to run alert suppression at the top tier. Therefore, alerts that should not be suppressed together are suppressed because the event properties are unavailable and these alerts are incorrectly identified as duplicates.



Hotfix information
A supported hotfix is now available from Microsoft. However, this hotfix is intended to correct only the problem that is described in this article. Apply this hotfix only to systems that are experiencing this specific problem. This hotfix might receive additional testing. Therefore, if you are not severely affected by this problem, we recommend that you wait for the next service pack that contains this hotfix.

To resolve this problem, submit a request to Microsoft Online Customer Services to obtain the hotfix. To submit an online request to obtain the hotfix, visit the following Microsoft Web site:

http://go.microsoft.com/?linkid=6294451

Note If additional issues occur or any troubleshooting is required, you might have to create a separate service request. The usual support costs will apply to additional support questions and issues that do not qualify for this specific hotfix. To create a separate service request, visit the following Microsoft Web site:

http://support.microsoft.com/contactus/?ws=support

Prerequisites
Apply this hotfix to computers that meet all following conditions:
 * The computer has the Microsoft Operations Manager Connector Framework (MCF) installed.
 * The computer hosts a Microsoft Operations Manager Management Server.
 * The computer is in the destination management group of a multi-tiered Microsoft Operations Manager environment.

Restart requirement
You do not have to restart the computer after you apply this hotfix.

Hotfix replacement information
This hotfix does not replace any other hotfixes.

File information
The English version of this hotfix has the file attributes (or later file attributes) that are listed in the following table. The dates and times for these files are listed in Coordinated Universal Time (UTC). When you view the file information, it is converted to local time. To find the difference between UTC and local time, use the Time Zone tab in the Date and Time tool in Control Panel. Date     Time    Version     Size        File name

16-Mar-2005    22:44   6.0.2900.2180   1,301,224   Mom2005-rtm-kb894319-x86-enu.exe 15-Mar-2005    17:02   5.0.2749.15     899,824     Momactions.dll 15-Mar-2005    17:02   5.0.2749.15     1,530,608   Momdbconnector.dll 15-Mar-2005    17:02   5.0.2749.15     1,629,936   Momengine.dll 17-Feb-2005    14:46           1,285,120   Q894319.msp 17-Feb-2005    14:47           29,678      Readme.rtf 17-Feb-2005    14:47           11,118      Relnote.htm 17-Feb-2005    14:47           118,784     Updatemom.exe

Installation instructions
To install this hotfix, follow these steps:
 * 1) Copy the MOM2005-RTM-KB894319-X86-ENU.exe file to a local folder or to a network shared folder. If you use a network shared folder, make sure that you can access the folder from the computers that require this hotfix.
 * 2) Log on as an administrator to one of the computers that requires this hotfix.
 * 3) Run the MOM2005-RTM-KB894319-X86-ENU.exe file on each applicable computer that meets the criteria. You can use a command prompt to run the file, or you can use Microsoft Windows Explorer to run the file.
 * 4) Repeat steps 2 through 3 on each computer that requires this hotfix.



STATUS
Microsoft has confirmed that this is a bug in the Microsoft products that are listed in the &quot;Applies to&quot; section.



MORE INFORMATION
This hotfix resolves the problem by preventing Microsoft Operations Manager from running alert suppression for alerts that have been inserted in a management group by the MCF. Instead, Microsoft Operations Manager uses event properties in the alert suppression criteria of the event properties. The alert suppression has to run at the lower tier and is not required to run again at the top tier. This hotfix does not affect the alert suppression in the source management group where the alert is generated.

For more information, click the following article number to view the article in the Microsoft Knowledge Base:

824684 Description of the standard terminology that is used to describe Microsoft software updates

Additional query words: master

Keywords: kbqfe kbhotfixserver kbbug kbfix kbexpertiseinter kbmompre2005sp1fix kbopman2005spfix KB894319

-

[mailto:TECHNET@MICROSOFT.COM Send feedback to Microsoft]

© Microsoft Corporation. All rights reserved.