When the following conditions are true in Microsoft Operations Manager (MOM) 2005, multiple distinct alerts in the source management group are incorrectly suppressed into a single alert in the destination management group:

• You use MOM-to-MOM Product Connector (MMPC) to forward alerts.
• An alert-generating rule has an alert suppression criteria that use the following event properties:
  • Source Name
  • Event Number
  • Category
  • Description
  • Event Type
  • Message DLL
  • Message DLL File Version
  • Provider Name
  • User Name

This problem occurs because MMPC forwards alerts to the destination management group but does not forward events associated to those alerts. Then, there is no event to run alert suppression at the top tier. Therefore, alerts that should not be suppressed together are suppressed because the event properties are unavailable and these alerts are incorrectly identified as duplicates.

Hotfix information

A supported hotfix is available from Microsoft. However, this hotfix is intended to correct only the problem that is described in this article. Apply this hotfix only to systems that are experiencing this specific problem. This hotfix might receive additional testing. Therefore, if you are not severely affected by this problem, we recommend that you wait for the next software update that contains this hotfix.

If the hotfix is available for download, there is a "Hotfix download available" section at the top of this Knowledge Base article. If this section does not appear, contact Microsoft Customer Service and Support to obtain the hotfix.

Note If additional issues occur or if any troubleshooting is required, you might have to create a separate service request. The usual support costs will apply to additional support questions and issues that do not qualify for this specific hotfix. For a complete list of Microsoft Customer Service and Support telephone numbers or to create a separate service request, visit the following Microsoft Web site: Note The "Hotfix download available" form displays the languages for which the hotfix is available. If you do not see your language, it is because a hotfix is not available for that language.

Prerequisites

Apply this hotfix to computers that meet all following conditions:

• The computer has the Microsoft Operations Manager Connector Framework (MCF) installed.
• The computer hosts a Microsoft Operations Manager Management Server.
• The computer is in the destination management group of a multi-tiered Microsoft Operations Manager environment.

Restart requirement

You do not have to restart the computer after you apply this hotfix.

Hotfix replacement information

This hotfix does not replace any other hotfixes.

File information

The English version of this hotfix has the file attributes (or later file attributes) that are listed in the following table. The dates and times for these files are listed in Coordinated Universal Time (UTC). When you view the file information, it is converted to local time. To find the difference between UTC and local time, use the Time Zone tab in the Date and Time tool in Control Panel.

Installation instructions

To install this hotfix, follow these steps:

1. Copy the MOM2005-RTM-KB894319-X86-ENU.exe file to a local folder or to a network shared folder. If you use a network shared folder, make sure that you can access the folder from the computers that require this hotfix.
2. Log on as an administrator to one of the computers that requires this hotfix.
3. Run the MOM2005-RTM-KB894319-X86-ENU.exe file on each applicable computer that meets the criteria. You can use a command prompt to run the file, or you can use Microsoft Windows Explorer to run the file.
4. Repeat steps 2 through 3 on each computer that requires this hotfix.

Microsoft has confirmed that this is a bug in the Microsoft products that are listed in the "Applies to" section.

This hotfix resolves the problem by preventing Microsoft Operations Manager from running alert suppression for alerts that have been inserted in a management group by the MCF. Instead, Microsoft Operations Manager uses event properties in the alert suppression criteria of the event properties. The alert suppression has to run at the lower tier and is not required to run again at the top tier. This hotfix does not affect the alert suppression in the source management group where the alert is generated.

For more information, click the following article number to view the article in the Microsoft Knowledge Base: