'**************************************************************************************************
' MOM Script
'
' Name: 	Scan Alerts for Escalations
'
' Function: 	Scans open alerts and for those requiring escalation and creates an escalation alert 
'		for each. 
'
' Parameters: 	None.  
'
' Notes:	The Escalated resolution state must be defined in MOM and the appropriate value
'		provided for the constant RESOLUTION_STATE_ESCALATED.
'		
'**************************************************************************************************

'========== Define constants
Const RESOLUTION_STATE_NEW = 0
Const RESOLUTION_STATE_RESOLVED = 255
Const RESOLUTION_STATE_ESCALATED = 10

'========== Get all open alerts with Resolution State of New
Set objWMI = GetObject("winmgmts:\\.\root\mom")
strQuery = "Select * from MSFT_Alert where " & _
		"ResolutionState = " & RESOLUTION_STATE_NEW & " "  & _
		"and Source <> 'Escalation' " & _
		"and CustomField2 > 0"
Set colAlerts = objWMI.ExecQuery(strQuery)

'========== Step through each alert found
For Each objAlert in colAlerts

	'========== Determine time intervals and check if alert should be escalated
	intEscalationInterval = CInt(objAlert.CustomField2)
	intMinutesOpen = CInt(DateDiff("n",ConvertDateFromUTC(objAlert.TimeRaised),ConvertDateToGMT(Now)))

	ScriptContext.Echo "UTC Time Raised: " & objAlert.TimeRaised
	ScriptContext.Echo "Time Raised: " & ConvertDateFromUTC(objAlert.TimeRaised)
	ScriptContext.Echo "Current Time: " & ConvertDateToGMT(Now)	
	ScriptContext.Echo "intEscalationInterval: " & intEscalationInterval
	ScriptContext.Echo "intMinutesOpen: " & intMinutesOpen
	
	If intMinutesOpen > intEscalationInterval Then
		
		'========== Get the computer that the alert came from
		strQuery = "Select * from MSFT_AlertToComputer Where Alert = 'MSFT_Alert.GUID=""" & objAlert.GUID & """'"
		
		ScriptContext.Echo "computerquery: " & strQuery
		
		Set colComputerStrings = objWMI.ExecQuery(strQuery)
		For Each objComputerString In colComputerStrings
			strComputerGUID = Left(Right(objComputerString.Computer,39),38)
			strQuery = "Select * from MSFT_Computer where GUID = '" & strComputerGUID & "'"
			Set colComputers = objWMI.ExecQuery(strQuery)
			For Each objComputer In colComputers
				strComputerName = objComputer.Name
				strComputerDomain = objComputer.Domain
			Next
		Next
		
		ScriptContext.Echo "ComputerName: " & strComputerName
		ScriptContext.Echo "ComputerDomain: " & strComputerDomain

		'========== Setup the alert to create
		strDescription = "The alert information is as follows:" & vbcrlf & vbcrlf & _
				  "GUID: " & objAlert.GUID & vbcrlf & _
				  "Time Generated: " & ConvertDateFromUTC(objAlert.TimeRaised) & vbcrlf & _
				  "Description: " & vbcrlf & objAlert.Description & vbcrlf & _
				  "URL: " & objAlert.URL 

		Set objNewAlert = ScriptContext.CreateAlert
		objNewAlert.AlertLevel = objAlert.Severity
		objNewAlert.Computer = strComputerName
		objNewAlert.ComputerDomain = strComputerDomain
		objNewAlert.AlertSource = "Escalation"
		objNewAlert.Name = "An alert has exceeded its allowable period without being addressed."
		objNewAlert.SetCustomField 1,objAlert.CustomField1		
		objNewAlert.Description =  strDescription
		ScriptContext.Submit objNewAlert
		
		'========== Set alert to Escalated resolution state
        	Set objAlert = PrepareWMIAlert(objAlert)
		objAlert.ResolutionState = RESOLUTION_STATE_ESCALATED
		objAlert.Put_
		
	End If
Next

'**************************************************************************************************
' Sub: 		ConvertDateFromUTC
' Purpose: 	Converts a variant date UTC format to a variant.
' Returns:	Variant date
'**************************************************************************************************
Function ConvertDateFromUTC(strUTCDate)

	strDateTime = Left(strUTCDate,InStr(strUTCDate,"."))
	intHourOffset = 0 - Right(strUTCDate,4)/60
	strDateString = Mid(strUTCDate,5,2) & "/" & Mid(strUTCDate,7,2) & "/" & Mid(strUTCDate,1,4)
	strTimeString = Mid(strUTCDate,9,2) & ":" & Mid(strUTCDate,11,2) & ":" & Mid(strUTCDate,13,2)
	ConvertDateFromUTC = DateAdd("h",intHourOffset, strDateString & " " & strTimeString)
	
End Function


'**************************************************************************************************
' Sub: 		ConvertDateToGMT
' Purpose: 	Converts a date to GMT.
' Returns:	Variant date.
'**************************************************************************************************
Function ConvertDateToGMT(datLocalDate)

	strQuery = "Select * From Win32_TimeZone"
	Set colTimeZones = GetObject("winmgmts:\\.\root\cimv2").ExecQuery(strQuery)
	For Each objTimeZone in colTimeZones
    		intTimeZoneBias = objTimeZone.Bias
    		intDaylightBias = objTimeZone.DaylightBias
	Next
	ConvertDateToGMT = DateAdd("n",intDaylightBias,DateAdd("n",-intTimeZoneBias,datLocalDate))

End Function

'**************************************************************************************************
' Sub: 		PrepareWMIAlert
' Purpose: 	Prepares a WMI Alert for saving by modfifying all empty properties with Null.
' Returns:	WMI Alert object
'**************************************************************************************************
Function PrepareWMIAlert(objWMIAlert)

    	If Len(Trim(objWMIAlert.AlertHistoryComment)) = 0 Then objWMIAlert.AlertHistoryComment = Null
	If Len(Trim(objWMIAlert.CustomField1)) = 0 Then objWMIAlert.CustomField1 = Null
	If Len(Trim(objWMIAlert.CustomField2)) = 0 Then objWMIAlert.CustomField2 = Null
	If Len(Trim(objWMIAlert.CustomField3)) = 0 Then objWMIAlert.CustomField3 = Null
	If Len(Trim(objWMIAlert.CustomField4)) = 0 Then objWMIAlert.CustomField4 = Null
	If Len(Trim(objWMIAlert.CustomField5)) = 0 Then objWMIAlert.CustomField5 = Null
	If Len(Trim(objWMIAlert.Description)) = 0 Then objWMIAlert.Description = Null
	If Len(Trim(objWMIAlert.OwnerName)) = 0 Then objWMIAlert.OwnerName = Null
	If Len(Trim(objWMIAlert.ResolvedBy)) = 0 Then objWMIAlert.ResolvedBy = Null
	If Len(Trim(objWMIAlert.TimeResolved)) = 0 Then objWMIAlert.TimeResolved = Null
        
        Set PrepareWMIAlert = objWMIAlert
        
End Function