SCOM: Monitoring Windows Event Logs Using SCOM

HI, All
In my IT environment I am using “Symantec Backup Exec” to backup the data of the servers. from past few days some Backup Jobs are getting failed. We knew the failure of these backup jobs after few days after failure. After this incident I decide to monitor these backup failure using “SCOM”. For me the best option was to monitor “Windows Event Log”, because in SCOM it is very easy to monitor “Event Logs”
The “Symantec Backup Exec” log a “failure” or “success” event in “Application” Log. The event code for Failure is “341132. So for Monitoring i need to create a monitor which can alert me when Event ID 34113 created. So I plant to Monitor “Event ID 34113” from “Source Backup Exec”
Problem

Step: 1 Create a Monitor
Open “Authoring” Pane, select “Monitors”

Right click on “Monitors”, choose “Create a Monitor” and choose “Unit Monitor”

Expand “Windows Events” then expand “Simple event detection” and choose “Manual Reset” then choose you management pack where you are planning to save this “Monitor”

Type “Name” for this Monitor i am using “failure of Differential backup” and write a brief “Description” and in “Monitoring Target” i am choosing “Windows Server Operating System” because in my environment “Symantec backup exec” in installed on windows 2003 and 2008 servers, not click Next

choose the “Log Name” where your application write “event logs” in my case “Symantec Backup Exec” writes event in “Application Log” that’s why i choose “Application” now click on Next

Now we need to provide the Event ID and Event Source in Expression Builder so that is any event log matched this criteria created SCOM can alert us. In My case “Event ID is 34113” and Event Source is “Backup Exec” , now click on NEXT

Now we need to “Configure Health Conditions” so If “Event is Raised” then the status is “Warning” otherwise it is “Healthy” now click on “Next”

We need an alert when is Event is Created , so click on “Generate Alerts for this Monitor” and click on “Create”


Step: 2 Create a subscription
I am creating a New Subscription for it so that whenever this Event ID creates or Backup Job Fails then it should send an alert "our “Backup Administrators”
Click on “Administration” and Select “Subscriptions”

Right click on “Subscriptions” and choose “New Subscriptions”

Now Type “Subscription Name” and Description and click Next

In “Subscription Criteria” click on “Created by Specific rules or Monitors” and choose our previously created “Monitor” “Failure of Differential backup” and click on Next

Add users which intended to receive the alerts, after adding users click on NEXT
 
Choose Channels by which you are going to send an alerts, in my case I am sending alerts using an email. click NEXT

Click on “Enable this notifications subscription” and click on Finish.


Step: 3 Testing
Now its time to test the monitor, I used Logevent.exe to create an demo alert in window Application Log. See this link to know more about Logevent utility.


Step: 4 Result
Bingo !!! It shows warning in SCOM Alert window.

and it also send me an email about this alert :-)


I hope that this help someone :-)

Thanks
Aman Dhally