SCOM notification email has {1} in subject

If you monitor services with a wild card, like in this mp, and have email notifications setup, when an alert triggers, the email subject has {1} instead of the alert parameter specified in the monitor settings.

For example, here's my email subject:

Alert Name: {1} Service Not Running

Oddly, here's the alert description which contains the correct parameter:

Alert description: The 'McAfeeTest1' service on computer is not running.

The alert name and description are also correct in the console.

Here are the alert settings from the unit monitor. The line in red is the one not being displayed correctly in the email subject:

<AlertParameters>
<AlertParameter1>$Data/Context/Property[@Name='Name']$</AlertParameter1>
<AlertParameter2>$Data/Context/Property[@Name='DisplayName']$</AlertParameter2>
<AlertParameter3>$Target/Host/Property[Type="Windows!Microsoft.Windows.Computer"]/PrincipalName$</AlertParameter3>
</AlertParameters>

Here are the display strings:

<DisplayString ElementID="TestA.Trellix.Monitor.Services.AlertMessage">
<Name>{1} Service Not Running</Name>
<Description>The '{1}' service on {2} is not running.</Description>
</DisplayString>

I did some testing but couldn't fix it so ended up changing the alert name to Trellix Service Not Running.

This isn't over.

Comments