Rules vs. Monitors

From many customers I get questions about rules and monitors. Most of the time they do not know when to use a rule or not. To make it even more confusing for them, certain SCOM tasks can be performed by a rule or a monitor. (like checking whether a certain service is up & running). So how to differentiate between both can be challenging.

However, there is a rule of thumb which makes it much easier to differentiate between rules and monitors:

Rules are used for collecting performance data or to run scripts and Monitors check on the health state of a component.

Of course there is much more to know but it is a good starting point. Lets continue.

Monitors update almost real-time so they show the actual state of a monitored object. When one opens the Health Explorer for a computer, the monitor will show up as well. So it is relatively easy to see whether a monitor 'has arrived' and entered a working state.

Screendump 1.
A newly built monitor (Intersite Messaging Monitor) is in place but not 'on':


Screendump 2.
The newly built monitor entered a running state:


Besides that, monitors work different compared to rules. Monitors collect data from various sources and based on that information decide the health status of the monitored object (red, yellow or green). Therefore monitors are also called 'State Machines'. This latter also tells about the way collected data by monitors is treated. The collected data is never stored in the OpsMgr database, nor the Data Warehouse, only the changes of state and the related alerts are.

Rules on the contrary store their collected data in the Data Warehouse so it can be used for reports later on. Rules collect their performance data from log files, perfmon, event logs and so on. Based on that collected information, rules are also capable of raising Alerts within SCOM.

So when one wants to monitor a device with SCOM but also wants to run reports on it, one has to build a rule for collecting performance data that will show up in reports and a monitor that shows the state of that device in SCOM.