What happens when the state changes?

The question came up in relation to a new to develop custom connector.

I’ve been asked what happens when the state of an object/alert changes from warning to critical (or the other way around), more specifically, will the same alert be updated or will the warning alert disappear (closed, deleted, whatever…) and a new critical one raised?

To show that I created an override for the “Windows Server 2012 Logical Disk Free Space (MB) Low” monitor so that it is enabled, generates an alert for either warning and critical state and I configured testing thresholds. Further, I decreased the interval to 60sec for testing.

After that I created a dummy file that is big enough to reach the warning but small enough to not reach the critical threshold using the following command:
fsutil file createnew $env:temp\dummy.bin (40gb)

After 60sec the following warning alert has been created:

I collected the interesting (warning) alert information using Get-SCOMAlert, see table below.

After that I deleted the dummy file:
del $env:temp\dummy.bin

And I created a new file that reaches the critical threshold:
fsutil file createnew $env:temp\dummy.bin (45gb)

Again, within 60sec a critical alert has been raised:

I collected the interesting (critical) alert information using Get-SCOMAlert, see table below.

Again, I deleted the dummy file to clean up:
del $env:temp\dummy.bin

And removed all the overrides I created initially.

Here are the alert details that have been kept behind the scenes:

Warning Alert Details:

Id	:	cdb71a4a-9621-4372-84d3-aad8be07f160
Name	:	Logical Disk Free Space in MBytes is low
Description	:	The disk C: on computer <FQDN> is running out of disk space.
		The value that exceeded the threshold is 6552 free Mbytes.
Severity	:	Warning
TimeRaised	:	02.12.2015 10:04
TimeAdded	:	02.12.2015 10:04
LastModified	:	02.12.2015 10:04
StateLastModified	:	02.12.2015 10:04

Critical Alert Details:

Id	:	cdb71a4a-9621-4372-84d3-aad8be07f160
Name	:	Logical Disk Free Space in MBytes is low
Description	:	The disk C: on computer <FQDN> is running out of disk space.
Severity	:	Error
TimeRaised	:	02.12.2015 10:04
TimeAdded	:	02.12.2015 10:04
LastModified	:	02.12.2015 10:08
StateLastModified	:	02.12.2015 10:08

As you can see: the alert ID is the same. The severity has been changed from Warning to Critical and the (State)LastModified timestamps have been updated.

Conclusion: it’s the same alert with a new severity.

All information is provided "as is" without any warranty! Try in lab before. Handle with care in production.