Thanks for reaching out to Microsoft Q&A.
To configure System Center Data Protection Manager (DPM) to only send critical alerts without the "Resolved" alerts, you can manage it in a few ways, though DPM itself doesn’t provide a direct option to filter only critical alerts. Here are some approaches to achieve this:
ServiceNow Alert Filtering:
- Set up a filter rule in ServiceNow to exclude incidents where the alert message contains "DPM: Resolved alert." This approach will ensure that only critical alerts are processed in ServiceNow, while resolved alerts are ignored.
DPM Notification Configuration:
- Within DPM, alerts are usually configured under
Management -> Notifications
. Although it doesn’t allow granular filtering between "Critical" and "Resolved" directly, you can fine-tune the alert notification recipients based on the type of alert by configuring separate notification channels. Set up a channel for critical alerts, excluding resolved alerts, if available.
Using SCOM (System Center Operations Manager):
- If you have SCOM integrated with DPM, create a custom rule or monitor in SCOM to filter out the "Resolved" alerts and only forward critical ones to ServiceNow. SCOM provides greater flexibility in handling and customizing alerts, making it easier to exclude specific alerts.
PowerShell Script to Monitor DPM Alerts:
- A custom PowerShell script can periodically check DPM for alerts and filter them based on their severity or status. This script could forward only the critical alerts to your desired endpoint (like an email or webhook for servicenow). This way resolved alerts can be ignored at the script level.
These methods should help you streamline alert management and ensure only critical DPM alerts create incidents in ServiceNow.
Please feel free to click the 'Upvote' (Thumbs-up) button and 'Accept as Answer'. This helps the community by allowing others with similar queries to easily find the solution.