Monday, May 16, 2011

SCOM: Monitoring Windows Event Logs Using SCOM

HI, All
In my IT environment I am using “Symantec Backup Exec” to backup the data of the servers. from past few days some Backup Jobs are getting failed. We knew the failure of these backup jobs after few days after failure. After this incident I decide to monitor these backup failure using “SCOM”. For me the best option was to monitor “Windows Event Log”, because in SCOM it is very easy to monitor “Event Logs”
The “Symantec Backup Exec” log a “failure” or “success” event in “Application” Log. The event code for Failure is “341132. So for Monitoring i need to create a monitor which can alert me when Event ID 34113 created. So I plant to Monitor “Event ID 34113” from “Source Backup Exec”
Problem
1
Step: 1 Create a Monitor
Open “Authoring” Pane, select “Monitors”
2
Right click on “Monitors”, choose “Create a Monitor” and choose “Unit Monitor”
3
Expand “Windows Events” then expand “Simple event detection” and choose “Manual Reset” then choose you management pack where you are planning to save this “Monitor”
4
Type “Name” for this Monitor i am using “failure of Differential backup” and write a brief “Description” and in “Monitoring Target” i am choosing “Windows Server Operating System” because in my environment “Symantec backup exec” in installed on windows 2003 and 2008 servers, not click Next
5
choose the “Log Name” where your application write “event logs” in my case “Symantec Backup Exec” writes event in “Application Log” that’s why i choose “Application” now click on Next
6
Now we need to provide the Event ID and Event Source in Expression Builder so that is any event log matched this criteria created SCOM can alert us. In My case “Event ID is 34113” and Event Source is “Backup Exec” , now click on NEXT
7
Now we need to “Configure Health Conditions” so If “Event is Raised” then the status is “Warning” otherwise it is “Healthy” now click on “Next”
8
We need an alert when is Event is Created , so click on “Generate Alerts for this Monitor” and click on “Create”
9

Step: 2 Create a subscription
I am creating a New Subscription for it so that whenever this Event ID creates or Backup Job Fails then it should send an alert "our “Backup Administrators”
Click on “Administration” and Select “Subscriptions”
10
Right click on “Subscriptions” and choose “New Subscriptions”
11
Now Type “Subscription Name” and Description and click Next
12
In “Subscription Criteria” click on “Created by Specific rules or Monitors” and choose our previously created “Monitor” “Failure of Differential backup” and click on Next
13
Add users which intended to receive the alerts, after adding users click on NEXT
14 
Choose Channels by which you are going to send an alerts, in my case I am sending alerts using an email. click NEXT
15
Click on “Enable this notifications subscription” and click on Finish.
16

Step: 3 Testing
Now its time to test the monitor, I used Logevent.exe to create an demo alert in window Application Log. See this link to know more about Logevent utility.
18

Step: 4 Result
Bingo !!! It shows warning in SCOM Alert window.
19
and it also send me an email about this alert :-)
20

I hope that this help someone :-)

Thanks
Aman Dhally

5 comments:

  1. I struggled my head with this problem and couldn't get it solved. I started looking for a freelancer and found a team of friendly people called called ServerBuddies.
    They provide quality remote server management, including troubleshooting, Server Management, Plesk Support, Server Maintenance, Server Monitoring, Server Troubleshooting and support at a affordable rates. They also provide Server Optimization, Plesk Support, Linux Support, cPanel Support and Plesk Support.
    They are great, I highly recommend to use these guys!

    ReplyDelete
  2. Fantastic, I'm enjoyed read this post, Every time search this type of post. Really I enjoyed. This article is really very interesting and effective. I think its must be helpful for us. Thanks for sharing your informative. Buy Twitter Followers

    ReplyDelete
  3. Thanks for the useful information.Your blog is really informative.Web apps24x7 have global monitoring station to use check your server status.Download this
    https://play.google.com/store/apps/details?id=com.webapps.webapps

    ReplyDelete
  4. I like your post, but I cant use logevent.exe. I'm waiting the problem occers.

    ReplyDelete
  5. You have shared really a valuable information,
    Thanks for sharing,.
    Big Data

    ReplyDelete