Did you atomize your situation?

That's just a fancy way of asking if you selected a unique 'Display Item'under the 'Advanced tab in a situation. When a situation processes a multi row attribute group (e.g., NT_Services) it will behave differently depending on whether the 'Display Item'is grouped by one of the key attributes or not (i.e., atomized). If no display item is selected for the situation then only one situation event will be generated for all the rows that are processed by the situation.

Let's look at an example.

The product supplied 'NT_Services_Automatic_Start'situation checks for services that are stopped and that have a start type of automatic. If the 'Display Item'is not selected for this situation then the first service, out of all services on that system, that is stopped and is defined as automatic will generate a situation event. Even if there are multiple services on this system that meet this criteria you will only see one event from the Situation Event Console'for this situation. Furthermore, you will only see one event forwarded to TEC. From the TEP, you can still see each individual service that meets the situations criteria by selecting the 'Situation Event Results'or selecting a link icon from the event flyover. The single event will also not be closed until all services that meet the situation criteria are cleared (i.e., closed). This is also true for the closing of the TEC event. The single TEC event will also not be closed until all services that meet the situation criteria have cleared.

If you atomize the 'NT_Services_Automatic_Start'situation by selecting the 'Service_Name'attribute as the 'Display Item'in the situation editor then a unique situation event will be generated for every service that meets the situation criteria. For example, if two services are stopped that are both defined as automatic then two events will show up in the 'Situation Event Console'if the situation is atomozed. Also, two events will be sent to TEC. The unique situation events and TEC events will be closed as each individual services start back up.