The first part covered how to setup a SCOM monitor and trigger a fake alert. This post will focus on configuring the connector between SCOM and SCSM. The goal is to have incidents that are auto-generated from SCOM events.

 

Configure the incident template.

In SCSM, under “Library – Templates”, create a new template. Give it an explanatory name, like “Fake SCOM Alerts Template”, and choose the class “Incident”. Put this in a new MP.

Complete the form with all required info, but leave out the “Title”, “Urgency” and “Priority” – these will be inherited from the SCOM alert, or from the SCOM connector rule. For this scenario, also fill the Primary Owner field with a mail-enabled user / group.

Create the Operation Manager Alert Connector

In SCSM, under “Administration – Connectors” category, you can create an “Operation Manager Alert connector” (don’t confuse it with “Operation Manager CI connector”, which is right under it).

Give a self-explanatory name for this connector, and make sure it is enabled.

Configure the “Run As Account” (recommendations on the accounts required for creating Operations Manager Alert Connectors can be found here, v.2007 is similar to v.2012). The best practice states: “Domain account specifically created for this purpose that is only in the Users local security group and in an Administrator user role in Operations Manager and in an Advanced Operator user role in Service Manager.”

On the “Alerts Routing Rules”, add the Incident template defined above.

Leave the default poll alerts interval unchanged (30 seconds). Make sure to enable the “Close alerts in Operation Manager when Incidents are resolved or closed” and the “Resolve Incidents automatically when the alerts in Operations Manager are closed” checks.

Finish.

Configure the SCOM Internal Connector Subscription.

Go to SCOM, under “Administrator – Product Connectors – Internal Connectors”, find the connector we just defined in SCSM (it has the same name), open it, and add a subscription.

Give the new subscription an explanatory name.

You can leave all the groups checked or go into detail and fine tune this option. I just left it as default.

Again leave the default or go in depth with the target selection.

For “Criteria”, leave the default.

Checking the functionality

Trigger a fake incident following the indication from the previous post. As a result, in SCSM a new Incident would appear, with the status “Active”.

If you open it, you will notice that part of the fields are already filled with data from the Incident template and from the SCOM alert – this means the connector between SCOM and SCSM is working as expected.

Next post will cover the Orchestrator runbook that is triggered when incidents are created.