Alerts may not get forwarded as expected via a connector in Operations Manager

This article has been archived. It is offered "as is" and will no longer be updated.
Symptoms
When using connectors to forward alerts in System Center Operations Manager 2007 (OpsMgr 2007) or System Center 2012 Operations Manager (OpsMgr 2012, SP1 and OpsMgr 2012 R2), in certain situations such as an alert storm (defined as a large number of alerts being generated in a very short period of time) there may be alerts that are not forwarded via a connector. When this occurs, these alerts will never be forwarded and will remain in a "New" state.
Cause
This can occur if there is an alert storm and the connector processes alerts in batches (e.g. 100 at a time).  If there are too many alerts to be processed within 5 seconds (the default value) from the time they were inserted into the database, they will be skipped and never reprocessed.  
Resolution
To resolve this issue, increase the amount of time allowed for the alerts to be processed. This can be done using the registry value named AlertSubscriptionWatermarkLatencyMilliseconds. This value can be set to increase the latency value so that when the query executes to collect the alerts for forwarding, the alerts that have a timestamp less than or equal to the current time minus the latency value (the current default is 5000 milliseconds). 

This registry value does not exist by default but it can be created on the Root Management Server (for OpsMgr 2007) or on all of the Management Servers (for SCOM 2012).

Location: SOFTWARE\Microsoft\Microsoft Operations Manager\3.0\
Value: AlertSubscriptionWatermarkLatencyMilliseconds
Registry Type: REG_DWORD
Default value: 5000

Note: When this key is added, the Health Service on the Root Management Server (or on Management Servers in OpsMgr 2012) must be restarted to implement the change.

The value should only be increased, never decreased. It should be incremented (for example, adding 5000 milliseconds at a time) and tested to make sure the value is sufficient to not skip alerts.  Setting it too high can cause performance issues by causing the connector to look at too many alerts at the same time unnecessarily.
Note This is a "FAST PUBLISH" article created directly from within the Microsoft support organization. The information contained herein is provided as-is in response to emerging issues. As a result of the speed in making it available, the materials may include typographical errors and may be revised at any time without notice. See Terms of Use for other considerations.
Properties

Article ID: 2277825 - Last Review: 12/12/2015 09:37:32 - Revision: 2.0

Microsoft System Center Operations Manager 2007, Microsoft System Center Operations Manager 2007 R2, Microsoft System Center Operations Manager 2007 Service Pack 1, Microsoft System Center 2012 Operations Manager, Microsoft System Center 2012 Operations Manager Service Pack 1, Microsoft System Center 2012 R2 Operations Manager

  • kbnosurvey kbarchive KB2277825
Feedback
ERROR: at System.Diagnostics.Process.Kill() at Microsoft.Support.SEOInfrastructureService.PhantomJS.PhantomJSRunner.WaitForExit(Process process, Int32 waitTime, StringBuilder dataBuilder, Boolean isTotalProcessTimeout)