Alerts are not closed automatically in SCOM

This behavior can be seen in one of the following scenarios:
 

• The event that would normally close the alert arrives so quickly after the error event that both share the same time stamp.

The first thing to check is that the closing event arrives and is logged in the nworks collector event log.

If the event is there, and matches the alert generating event, it is a good idea to pay attention to the time stamp. If both the alert generating event and the alert closing event arrive so quickly that they have the same time stamp in the event log, this is an issue with SCOM.

In SCOM SP1, it is a known issue that if the alert generating event and alert closing event have the same time stamp, the alert may not be closed automatically. There is no other option but to close it manually in this case.

As per information from Microsoft, in SCOM R2, the situation is somewhat better; however, there is still no way to ensure that the alert will be closed automatically in the scenario described.