Monday, May 16, 2011

SCOM: Monitoring Windows Event Logs Using SCOM

HI, All
In my IT environment I am using “Symantec Backup Exec” to backup the data of the servers. from past few days some Backup Jobs are getting failed. We knew the failure of these backup jobs after few days after failure. After this incident I decide to monitor these backup failure using “SCOM”. For me the best option was to monitor “Windows Event Log”, because in SCOM it is very easy to monitor “Event Logs”
The “Symantec Backup Exec” log a “failure” or “success” event in “Application” Log. The event code for Failure is “341132. So for Monitoring i need to create a monitor which can alert me when Event ID 34113 created. So I plant to Monitor “Event ID 34113” from “Source Backup Exec”
Step: 1 Create a Monitor
Open “Authoring” Pane, select “Monitors”
Right click on “Monitors”, choose “Create a Monitor” and choose “Unit Monitor”
Expand “Windows Events” then expand “Simple event detection” and choose “Manual Reset” then choose you management pack where you are planning to save this “Monitor”
Type “Name” for this Monitor i am using “failure of Differential backup” and write a brief “Description” and in “Monitoring Target” i am choosing “Windows Server Operating System” because in my environment “Symantec backup exec” in installed on windows 2003 and 2008 servers, not click Next
choose the “Log Name” where your application write “event logs” in my case “Symantec Backup Exec” writes event in “Application Log” that’s why i choose “Application” now click on Next
Now we need to provide the Event ID and Event Source in Expression Builder so that is any event log matched this criteria created SCOM can alert us. In My case “Event ID is 34113” and Event Source is “Backup Exec” , now click on NEXT
Now we need to “Configure Health Conditions” so If “Event is Raised” then the status is “Warning” otherwise it is “Healthy” now click on “Next”
We need an alert when is Event is Created , so click on “Generate Alerts for this Monitor” and click on “Create”

Step: 2 Create a subscription
I am creating a New Subscription for it so that whenever this Event ID creates or Backup Job Fails then it should send an alert "our “Backup Administrators”
Click on “Administration” and Select “Subscriptions”
Right click on “Subscriptions” and choose “New Subscriptions”
Now Type “Subscription Name” and Description and click Next
In “Subscription Criteria” click on “Created by Specific rules or Monitors” and choose our previously created “Monitor” “Failure of Differential backup” and click on Next
Add users which intended to receive the alerts, after adding users click on NEXT
Choose Channels by which you are going to send an alerts, in my case I am sending alerts using an email. click NEXT
Click on “Enable this notifications subscription” and click on Finish.

Step: 3 Testing
Now its time to test the monitor, I used Logevent.exe to create an demo alert in window Application Log. See this link to know more about Logevent utility.

Step: 4 Result
Bingo !!! It shows warning in SCOM Alert window.
and it also send me an email about this alert :-)

I hope that this help someone :-)

Aman Dhally


  1. I struggled my head with this problem and couldn't get it solved. I started looking for a freelancer and found a team of friendly people called called ServerBuddies.
    They provide quality remote server management, including troubleshooting, Server Management, Plesk Support, Server Maintenance, Server Monitoring, Server Troubleshooting and support at a affordable rates. They also provide Server Optimization, Plesk Support, Linux Support, cPanel Support and Plesk Support.
    They are great, I highly recommend to use these guys!

  2. Fantastic, I'm enjoyed read this post, Every time search this type of post. Really I enjoyed. This article is really very interesting and effective. I think its must be helpful for us. Thanks for sharing your informative. Buy Twitter Followers

  3. Thanks for the useful information.Your blog is really informative.Web apps24x7 have global monitoring station to use check your server status.Download this

  4. I like your post, but I cant use logevent.exe. I'm waiting the problem occers.

  5. You have shared really a valuable information,
    Thanks for sharing,.
    Big Data


  6. Hi, Great.. Tutorial is just awesome..It is really helpful for a newbie like me.. I am a regular follower of your blog. Really very informative post you shared here. Kindly keep blogging. If anyone wants to become a .Net developer learn from Dot Net Online Training from India. or learn thru ASP.NET Essential Training Online . Nowadays Dot Net has tons of job opportunities on various vertical industry.
    JavaScript Online Training from India

  7. You got an extremely helpful website I actually have been here reading for regarding an hour. I’m an initiate and your success is incredibly a lot of a concept on behalf of me.
    python training in chennai
    python course institute in chennai

  8. Thanks for the detailed blog. It gives a great reading experience. Awesome info about games and apps You may also visit to party truck game center and play various games.
    oneplus mobile service centre in chennai
    oneplus mobile service centre
    oneplus service center near me
    oneplus service
    oneplus service centres in chennai