Enforced should almost *never* be used unless there is known override conflict and we do not like the default behavior.
In priority order (from lowest priority to highest priority): Most derived type (Example – a class level (all objects of some class/type) override targeted at Windows Computer wins over an override targeted at Computer because it is more derived/specific) Most contained group (Example – group A contains group B contains Object C. An override targeted at Group B wins over an override targeted at Group A because it is more contained/specific) Object (This is the most specific override because it is about a single object and therefore beats all others) Even given this algorithm there are cases where you can have a “conflict” (example – two groups which are the same number of containment hops away from the actual object in question). In these cases, overrides are applied based on some “merge” logic which allows us to automatically err on the side of generating the most alerts (so we don’t miss any). Example: CPU Utilization threshold – Group A = 80%; Group B = 70% Merged policy = 70% since that will err on the side of generating an alert if it is greater than 70. If we cannot successfully merge an override (example: string parameters) then we effectively choose a random value for the time being and drop an event in the event log which should generate an alert so that the administrator can check into it. From: [email protected] [mailto:[email protected]] On Behalf Of Gareth Miles Sent: Tuesday, March 1, 2016 7:27 AM To: [email protected] Subject: [msmom] Multiple enforced overrides Hi Folks I’m trying to figure out what the predictable behaviour will be when using multiple overrides using enforced. In this example I’m referring to the monitor “Cluster Disk - Free Space Monitor (MB)” I have an override targeting a dynamic group of cluster disks over 500GB in size, with a warning threshold of 30GB and error of 20GB. I have a second override targeted at a subset of cluster disks over 500GB in size, these SQL servers can drop space quickly so I have an error threshold of 100GB and warning of 60GB. Currently I have the 30GB/20GB override enforced, the 100GB/60GB is not enforced. One of the disks in the subset, which is in both groups, got a warning and critical alert for 30GB/200GB, but not for 100GB/60GB. If I set the 100GB/60GB override to enforced, and not the 30GB/20GB, I assume that would apply the 100GB/60GB override to the subset of disks over 500GB, and apply the 30GB/20GB override to the rest? If I enforce both overrides, does the outcome become unpredictable? I’m interested to know the impact of setting both to enforced. Thanks [ITServiceAssurance_Logo (2)] Gareth Miles System Center Technical Lead Phone: +27 31 580 1582 Mobile: +27 83 648 8559 ________________________________ The information transmitted is intended only for the person or entity to which it is addressed and may contain confidential and/or privileged material. Any review, retransmission, dissemination or other use of, or taking of any action in reliance upon, this information by persons or entities other than the intended recipient is prohibited. If you received this in error, please contact the sender and delete the material from any computer. Furthermore, the information contained in this message, and any attachments thereto, is for information purposes only and may contain the personal views and opinions of the author, which are not necessarily the views and opinions of the company. ________________________________
