Get-SCOMAlert Cmdlet, the Criteria Parameter and the Non-Equal Operator
Wow, that is a cryptic blogtitle
Did I already lost you people with this blogpost title? I hope not, because this blogpost is about how to use the Get-SCOMAlert Cmdlet using the Criteria parameter the correct way.
Credits for this blogpost go to my colleague Jens Morawietz, because he explained the implications of using the Get-SCOMAlert Cmdlet with the Criteria parameter to me.
Let’s first start at looking at the help for the Get-SCOMAlert Cmdlet.
| Get-Help Get-SCOMAlert |
If we look at the Examples for this Cmdlet we don’t find much information about the Criteria Parameter
So let’s explore the Criteria Parameter.
If we want to retrieve all New Alerts with a severity Critical and the Alert being generated by a Monitor we can use the following Command:
| Get-SCOMAlert -Criteria "ResolutionState = 0 AND Severity = 2 AND IsMonitorAlert = 1" |
The reason we should use the Criteria parameter instead of filtering using the Where-Object Cmdlet is because of the impact on performance. If we use the Where-Object Cmdlet we first retrieve ALL Alerts before filtering.
| Get-SCOMAlert | Where-Object {$_.ResolutionState -eq 0 -and $_.Severity -eq 2 -and $_.IsMonitorAlert -eq 1} |
Same result:
But if we compare the time it takes to complete both commands we see a difference.
Using the Criteria Parameter is much faster and less resource intensive.
Now we are convinced using the Criteria Parameter there is something you need to know when using this parameter and that is that the criteria parameter method will return only the alerts where the field is set to a value not equal to the given value and the PS method will return the alerts where the field is set to a value not equal to the given value OR is NULL, e.g.:
Let’s try to retrieve all New Alerts with a Severity Critical and the Alert being generated by a Monitor AND the Owner not being “Stefan”
We would think we could use the following statement to retrieve those Alerts:
| Get-SCOMAlert -Criteria "ResolutionState = 0 AND Severity = 2 AND IsMonitorAlert = 1 AND (Owner <> 'Stefan')" |
But when we run these commands we see no Alerts being returned. 
Wen we use the Where-Object Cmdlet we see that there are Alerts where the owner is not “Stefan”
Get-SCOMAlert | Where-Object {$_.ResolutionState -eq 0 -and $_.Severity -eq 2 -and $_.IsMonitorAlert -eq 1 -AND $_.Owner -ne "Stefan"} |
So the resolution is to include OR <property> IS NULL in the criteria, which is in the end the WHERE clause of the SELECT statement on the Ops Mgr db, e.g.:
Get-SCOMAlert -Criteria "ResolutionState = 0 AND Severity = 2 AND IsMonitorAlert = 1 AND (Owner <> 'Stefan' OR Owner IS NULL)" |
Btw, the last method is not only less resource consuming but much faster than the second one.
Have fun and thanks Jens for explaining.