Hi, I got the following alert from SCOM on a particular server every 5 min. The funny thing is I only got a "close" and none "open" alert. Anybody can shine some light? Subject: Alert: LDAP Search Time is above configured threshold Priority: 1 Severity: 2 Resolution state: Closed Alert: LDAP Search Time is above configured threshold Source: Information Store Path: servername.domain.com;ServerName Last modified by: System Last modified time: 5/3/2011 5:35:33 PM Alert description: The LDAP Search Time is above configured threshold. The current value is 8 Alert view link: http:// Notification subscription ID generating this message: Desmond Tan http://sgwindowsgroup.org/blogs/desmond/

Hi If you look at the alert details (Alert History and Alert Context tabs), are there any time sync issues? Is the time the alert get closed before the time the alert is generated? Cheers GrahamView OpsMgr tips and tricks at http://systemcentersolutions.wordpress.com/

Hi Graham, Where can I find that under SCOM administration console? Btw, I'm using SCOM 2007 R2. Cheers, DesmondDesmond Tan http://sgwindowsgroup.org/blogs/desmond/

Hi Desmond In the OpsMgr console, under monitoring, create an alert view for closed alerts (resolution state = 255). Then, in this view, (monitoring, closed alerts), you can investigate the details of the closed alerts. Cheers Graham View OpsMgr tips and tricks at http://systemcentersolutions.wordpress.com/

There's a monitor called "LDAP Search Time Monitor" which generates the alerts. Basically it average the ldap search times over 5 samples and takes 1 sample every 5 minutes. When the average over 5 samples is above 50 it will generate an alert. I really think this monitor type is faulty, it will generate unnecessary alerts and it can generate a state change (and raise/close an alert) every sample (moving average, evaluting the threshold for the latest 5 samples every time a new sample is taken). Also it would make more sense to change this to a 5 consecutive sample over threshold monitor so sample values of 1000000,0,0,0,0 don't give an alert (just a spike in which your not really interested). All this doesn't help you at all of course. if you really have a lot of this alerts, but no complaining users about performance i'd take a baseline of the ldap search time monitor and set a new value for threshold or just disable the monitor when you will never take any action on this anyway. Rob Korving http://jama00.wordpress.com/

There's a monitor called "LDAP Search Time Monitor" which generates the alerts. Basically it average the ldap search times over 5 samples and takes 1 sample every 5 minutes. When the average over 5 samples is above 50 it will generate an alert. I really think this monitor type is faulty, it will generate unnecessary alerts and it can generate a state change (and raise/close an alert) every sample (moving average, evaluting the threshold for the latest 5 samples every time a new sample is taken). Also it would make more sense to change this to a 5 consecutive sample over threshold monitor so sample values of 1000000,0,0,0,0 don't give an alert (just a spike in which your not really interested). All this doesn't help you at all of course. if you really have a lot of this alerts, but no complaining users about performance i'd take a baseline of the ldap search time monitor and set a new value for threshold or just disable the monitor when you will never take any action on this anyway. Rob Korving http://jama00.wordpress.com/

Hi Graham, The time is fine. all alert is close in less than 5sec from the alert created time. Hi Rob, I do agree with you. Could you share with me how I can set the monitor to tave consecutive sample instate of average over 5 sample? Regard DesmondDesmond Tan http://sgwindowsgroup.org/blogs/desmond/

Hi Graham, The time is fine. all alert is close in less than 5sec from the alert created time. Hi Rob, I do agree with you. Could you share with me how I can set the monitor to tave consecutive sample instate of average over 5 sample? Regard DesmondDesmond Tan http://sgwindowsgroup.org/blogs/desmond/

you can't other than: disable the monitor and recreate the monitor based on the consecutive samples monitor type. But before you do i'd collect and check the ldap search time counter and check if it's gonna be helpful to change or a threshold value change would do.Rob Korving http://jama00.wordpress.com/

Hi, I think you may find the source monitor or rule via the alert details. Regarding the LDAP Search Time Monitor, I found the following information: Monitors Disabled by Default http://technet.microsoft.com/en-us/library/dd772513.aspx Please see “Common LDAP Search Time Monitor”. LDAP Search Time Monitor http://mpwiki.viacode.com/default.aspx?g=posts&t=3708 Please Note: Since the website is not hosted by Microsoft, the link may change without notice. Microsoft does not guarantee the accuracy of this information. I also think you can try some adjustments with overrides: How to Monitor Using Overrides http://technet.microsoft.com/en-us/library/bb309719.aspx Best practices to use when you configure overrides in System Center Operations Manager 2007 http://support.microsoft.com/kb/943239 Hope this helps. Thanks. Nicholas Li - MSFT Please remember to click “Mark as Answer” on the post that helps you, and to click “Unmark as Answer” if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.