Configuring Notifications – to include specific alerts from specific groups and classes

So.... Say I am an Exchange Administrator in a global company.... in the good old USA.

My company has recently implemented OpsMgr 2007 to monitor our Exchange servers.  I am going to configure my notification subscriptions so I can get an email anytime one of my Exchange servers has an issue.

Try #1:  I start by creating a notification subscription, and I dont scope it by groups or classes (all groups, all classes).  I think this sounds fine.  However, instantly I find I am flooded with email notifications from every single alert coming into the console.  This is NOT good!

Try #2:  Therefore – I decide I really need to see only Exchange alerts.  I scope the notification *classes* down to just Exchange classes.  This will ensure I only receive notifications from Exchange target classes.  Good?  Nope....  I soon find that when an alert comes in from the base OS, or heartbeat, or hardware, we won’t get those.  We need to add those classes back.  If we add the heartbeat (Health Service Watcher) class – we will now get heartbeat failures for ALL machines… not just restricted to exchange servers.  No good.

Try #3:  So – we need to scope the subscription using groups.  We create a group with all our Exchange Server Windows Computer objects in it.  We can manually add these in (Explicit) or we can use a dynamic rule based on criteria - I chose NetBIOS name, and used a naming standard of EX* (all my exchange servers start with "ex").  I used an "OR" statement since the wildcard is case sensitive.


Now I create a subscriptions - and scope it to this group - and choose ALL classes....  thinking that this way, we should get ALL notifications, including base OS, exchange, and heartbeat alerts… right? 

Nope.  Because of the object oriented monitoring model – we will only receive alerts from a rule/monitor with a target class that has a child relationship to the Windows Computer class.  This is the only class type in the group we created.  So – using the model in #3, we will get notifications from pretty much any class needed – except heartbeats.  These come from the Health Service Watcher class, and have no relation to the Windows Computer class.

Try #4:  I am thinking, we must add the class type to our group – and any instances of that class we are interested in.  Since most object classes are a child of Windows Computer, there should not be many of these that we will have to do.

In the group – add the Health Service Watcher display name instances, in the same way we add the Windows Computer NetBIOS names:


The AND/OR verbiage is misleading…. This was opened as a bug then closed – because it is “as designed”.

Essentially – The or group at the top will include ANY of the following and groups below it…. BOTH the windows computer objects AND the Health Service Watcher objects are included:  (you can right click any group and choose to show members)


I tested all kinds of Exchange alerts, and heartbeat failures – and this works.  It is possible there will be other alerts we wont get in this subscription.... IF the rule or monitor that created the alert was using a target class that was unique, and not a child of "Windows Computer"

I don’t think this will be a huge hassle moving forward… because MOST alerting is done on a target which is a child of Windows computer.  If we find one that is not – we just need to go back and add that class’s instances to the groups we create for notifications.


Want alert by alert notifications?  Where you can subscribe to a single alert, rule by rule, monitor by monitor?  Check out:


Comments (19)

  1. Anonymous says:

      Voici une liste de liens trés pratique sur tous les sujets SCOM , installation , configuration…

  2. Kevin Holman says:

    I would recommend picking all the exchange classes – because workflows targeting specific exchange classes will likely only match a notification subscription when explicitly added.

  3. Sir,

    As always an awesome blog. Hope to see more on SCOM 2012 from you as well.

  4. Elizabteh says:

    Hello all!

    I want to create a subscription that forwards to my connector (created via SCOM SDK) the alerts coming from a custom computer group I created and called "MyGroup".

    In order to achieve this goal I completed these steps:

    1) I created the connector via SDK

    2) I created manually the subscription via the SCOM UI selecting only "MyGroup", the first option of Targets and checking all the checkboxes in the criteria

    3) I exported in a XML file via SCOM SDK the subscription just created

    …then I read the XML file and I noticed that it contains the criteria but does not mention any Computer Group (nor "MyGroup").

    Now I need to understand how PROGRAMMATICALLY associate a specific subscription to a specific computer group.

    Can some gentleman help me?

    Thank you!



  5. GUS says:

    Hi Kevin,

    I tried to duplicate what you did above with no luck. I created a group and added the servers using the explicit method and I received no e-mails after i intentionally caused low disk alarms and heatbeat failures.

    So I added them using the Dynamic method and received the same results no alerts.

    Any ideas on what can be causing this?

  6. GUS says:

    Hi Kevin,

    I tried to duplicate what you did above with no luck. I created a group and added the servers using the explicit method and I received no e-mails after i intentionally caused low disk alarms and heatbeat failures.

    So I added them using the Dynamic method and received the same results no alerts.

    Do you have any ideas on what can be causing this?

  7. vratix says:

    Kevin, great post.  I was wondering if you knew of a way to grapically see what classes/object fell under which in SCOM.  This would greatly help me understand how to target subscriptions.  You mentioned that most alerting and notifications are done targeting Windows Computer or a child of it.  I’ve used the Add Component Wizard in the Distributed Applications designer tool, but it doesn’t really help that much.

    Thank you.

  8. vratix says:

    One more thing I would like to monitor only when a serer goes down and the logical disk space on a group of servers.  So I created a group and placed the Health Service Watcher (Agent) and the C and D drives from the Windows Server 2003 logical disk class into a group for these servers and setup notifications.  I haven’t tested them yet but I wanted to make sure I was doing this correctly.  Also the subscription was scoped to the group I created and to  Health Service Watcher (Agent) and Windows Server 2003 Logical Disk Classes.  Will this work?

  9. curtiss says:

    i’m more concerned with getting *just* exchange alerts out to a certain distro. i can make a group of "production exchange servers" using Windows Server objects, but when i choose the Class for the notification subscription, can i just pick "exchange server role" or do i have to specify every single class with the word "exchange" in its name?

  10. vivak says:

    Would should i add to the group for Unix heartbeat Failures , i do not see health server watcher (Agent) for them

  11. Doug G says:

    I know this is an old post, but I'd love to see some other examples of adding a Health Service Watcher using a method other than a name.  I use registry key discovery (windows Computer_extended) for the computer object on some groups and can't figure out how to get the Health Service Watcher to match.  I suppose this would also apply to using an OU to populate a group.  How do you get the Health Service Watcher to match?  

  12. vijayh says:

    I want to create group for specific set of servers and need to configure email notifications only for SQL aletrs. I did created a group based on windows computer and configured notification as in group used "my group" and class as "SQL role" but not getting notifications. Is this the correct way to do this please help me to fix this.

  13. Murad Akram says:

    Kevin, thank for this write up, but I was wondering if the following configuration would also work?

    “raised by any instance in a specific group”
    “created by specific rules or monitors (e.g., sources)” I included specific monitors and rules list here (free disk space, % CPU used etc.)
    “with specific resolution state”

    1. Kevin Holman says:


      This article is VERY old and SCOM notifications are MUCH more granular now.

      1. Murad Akram says:

        Thanks for the conformation!

  14. Gurpreet says:

    I have base OS monitors that include disk size, CPU %, Memory% and critical OS services – applied to Windows Server class – Since central Systems team need manages it and take action.
    Now, if I create a group for, let say, Citrix and monitor Citrix services. The Citrix team should be notified for the alerts.
    My problem:- In subscription, if I put all alerts generated by ‘Citrix Group’ – then it also sends base OS alerts to the Citrix team. So i have to add individual monitor name. This is a problem if we have 100s different app teams with different types monitor specific to them. Please suggest

  15. Morning, Failed to send notification and failed to send notification using server/device errors! I am getting these daily, sometimes 3-5 sometimes 7 and I cannot nail down what is causing it! They are not at the same time, they occur for different delivery email addresses,,,I have checked/tripple checked firewall rules/settings to SMTP servers (we use an anonymous SMTP setup here so no account to configure), verified config for channels, subscribers and subscriptions! Only thing left i can think of is the database. My SQL server is shared (as of the past number of months)by an also very busy Config Mgr 2012 setup, separate DB instances….my SCOM system performance has been affected by this since its jopining, some days are not too bad, some days are absolutely slowwwwww.
    Any assistance, pointers, suggestions are extremely welcome!!

Skip to main content