Get all alerts within a certain time period

  • [アーティクル]

A co-worker of mine ran into an alert flood scenario and needed to resolve a large number of alerts.  He tried the following PowerShell command:

Get-Alert | where {$_.ResolutionState -eq "New"} | Resolve-Alert

This eventually ended up throwing an out of memory exception.  This command is obviously attempting to resolve all of the alerts from the flood at once.  Another alternative would be to resolve them in chunks.  I provided a script that retrieves all alerts that were raised within the last 30 minutes.  This can be modified to get only new alerts, set the resolution state of each alert, and also get the alerts from the past hour, day, month, etc... 

#rslaten 08/29/2008

#get current time
$now = Get-Date

#subtract 30 minutes
$newTime = $now.AddMinutes(-30)

#format time correctly
$timeFormat = $newTime.ToShortDateString() + " " + $newTime.ToLongTimeString()

#set criteria
$criteria = "TimeRaised >= '" + $timeFormat + "'"

#query OpsMgr
$alerts = Get-Alert -Criteria $criteria

#print to console
Write-Host "Command = Get-Alert - Criteria" + $criteria
foreach ($alert in $alerts) {$alert.name + ":" + $alert.TimeRaised}

Check out the PowerShell Team Blog for more commands that you can use on the DateTime object.

Comments

  • Anonymous
    September 02, 2008
    PingBack from http://housesfunnywallpaper.cn/?p=3633

  • Anonymous
    September 05, 2008
    I usually also append | Out-Null to the Resolve-Alert cmdlet. having to display the output in the console greatly reduces the performance of the command shell... while suppressing output really speeds it up. But it is true that when manipulating many objects in powershell you can run out of memory pretty easily if you don't pay attention. For example, the commands I had posted here do run out of memory, even in relatively small environments (especially the event one) http://www.muscetta.com/2008/01/25/looking-at-opsmgr2007-alert-trend-with-command-shell/