Alerts are not closed automatically in SCOM.
This behavior can be seen in one of the following scenarios:
- The closing event does not arrive.
- The event that would normally close the alert arrives so quickly after the error event that both share the same time stamp.
The first thing to check is that the closing event arrives and is logged in the nworks collector event log.
If the event is there, and matches the alert generating event, it is a good idea to pay attention to the time stamp. If both the alert generating event and the alert closing event arrive so quickly that they have the same time stamp in the event log, this is an issue with SCOM.
In SCOM SP1, it is a known issue that if the alert generating event and alert closing event have the same time stamp, the alert may not be closed automatically. There is no other option but to close it manually in this case.
As per information from Microsoft, in SCOM R2, the situation is somewhat better; however, there is still no way to ensure that the alert will be closed automatically in the scenario described.
Please be aware that we’re making changes which will restrict access to product updates for users without an active contract.