Disable OOTB Event Management Alert Creation

[kirkr]

We are in the process of building out Event Management, starting with SCOM.

The goal is to pull in events from SCOM and selectively create Event Rules to generate Alerts for things we care about most, and expand from there.

The trouble is that we've enabled a SCOM connector and disabled all SCOM Event Rules, but alerts are still being created. I've manually closed all Alerts, but a lot of them become automatically Reopened from a couple noisy servers.

How do we disable all OOTB creation and reopening of Alerts that we don't manually define?

[stevemacamway · Accepted solution]

Create a new Event Rule that has a lower 'Order' number, and tell it to ignore the Events. 

Note: Order field

Note 'Ignore events that match this filter' checkbox. 

[kirkr]

Ah, that'll probably do it. Let me give it a try

[stevemacamway]

Good luck, and remember that as you create Rules that you DO want to process specific SCOM events, make sure the 'Order' number is lower than the Block rule. 

[bill_blaney]

Hi there.  I think you can create an Event Rule, specify the criteria for the events you want to disregard, and then click the "Ignore events that match this filter" checkbox.