In this post, we’ll show you how to start training EZalert in order for the machine learning software to learn your SCOM alert handling behavior for optimal automation.
When EZalert has been freshly installed and is untrained, its default behavior is to ignore all alerts in Operations Manager. Because EZalert is untrained it is unable to predict what state you would assign to a SCOM alert, so the default “Suggested State” on the “Training” tab is “Unable to predict” as shown below.
Training an Alert State
On the training tab, all the active alerts in Operations Manager are listed. To start training EZalert right-click the alert and then from the context menu click “Train State as” and then click the state you would usually assign to the alert for example “Closed”. After doing so an “apply States” dialog box appears. This box enables you to apply the training state in operations manager immediately, setting the state of the alert to “Closed” if “yes” is clicked. If you click “no”, the alert will remain unchanged in operations manager while EZalert is being trained.
You can also train EZalert to apply other resolutions states to the open SCOM alerts in Operations Manager. To do this, you do not select closed as we previously did. Instead, you select a different state from the “Train State As” context menu, for example, “Resolved”.
Assigning the resolution state “New” will cause EZalert to leave a particular new incoming alert in the resolution state “New”. Assigning this state might seem counterintuitive at first, but EZalert needs to be trained to know which Alerts should be left open and remain in the “New” resolution state.
Once you have started training EZalert, you will notice that new incoming alerts will have a suggested state. If the suggested state for a particular alert is not the state you would have expected, you can go through the same cycle and assign the desired state for that particular alert. Do this by using the context menu again.
Please note that during a training cycle the suggested resolution state is never applied to the incoming alerts, this is only done when we set “Enable Auto Apply” on the “Settings” tab.
After the training cycle, assuming you are satisfied that the suggested state for the alert is correct, you can set EZalert to automatic by clicking the settings tab, selecting the “Enable Auto Apply” checkbox and clicking Apply.
Retraining a SCOM Alert
After “Enable Auto Apply” has been set in the “Settings” tab, the “Training” tab will be disabled. You can click on the history tab in order to keep an eye on what state EZalert is automatically applying to the new alerts that are coming in. In the history tab, a log is kept for the state that is applied to each alert. If EZalert learned the wrong behavior and applied the wrong state to an alert, it can be corrected. To do this select the alert with the wrong state, right click it and set the correct state by selecting “Retrain State As”. When you repeat this cycle, EZalert will learn and become increasingly accurate over time.
Watch the how to use EZalert video to learn how to manage your SCOM alerts more easily!
Also, make sure to read the following blog by MVP Tao Yang