Monitoring and backing up event logs with MOM

Automatically Applying hot fixes (patches) to MOM Agents

PatchAholic...The WSUS Blog! — Tue, 11 Apr 2006 09:33:51 GMT

Automatically Applying hot fixes (patches) to MOM Agents

re: Monitoring and backing up event logs with MOM

alipka — Tue, 11 Apr 2006 22:20:04 GMT

Athif,

Great, thanks for that.
Just to add on: for agents behind firewall you have to apply the hotfix directly on the managed computer. This is obvious, but I went through this and its a bit of a pain especially if you have a lot of agents that have only port 1270 open to the mom management server. That is why I'd advise to keep such agents in small number in your environment.

re: Monitoring and backing up event logs with MOM

Mohammed Athif Khaleel — Sat, 15 Apr 2006 13:57:20 GMT

Hi Alipka,

That's True. I was able to update all the agents except a couple of agents which are still in 'Pending Actions' container. I have verified the version and it's already updated to 5.0.2911.28 but still it says 'Requires Patching' in 'Pending Actions' container :-(.

ISSUES:

1. I am currently testing your 'Monitor and backup event logs Management Pack' and encountered with the following error;

An error occurred on line 52 while executing script 'PKO clear event logs'
Source: Microsoft VBScript runtime error
Description: Permission denied. Please refer to the events associated with this alert to view the computers on which this problem occurred.

Can you highlight the permissions required for the script to run?
NOTE: MOM ACTION account is already part of LOCAL ADMINSITRATORS Group.

2. Moreover, I don’t see the logs copied to network location (LogDest=\\mom\SavedLogs$) when they are full (RULE: Backup logs automatically when they are full).
NOTE: LogDest is accessible via Windows Explorer.

Thanks again,
Athif
PatchAholic...http://msmvps.com/blogs/athif/

re: Monitoring and backing up event logs with MOM

alipka — Tue, 18 Apr 2006 10:34:56 GMT

Hi Athif,

My name is Andrzej. ALipka is just my alias-> Andrzej LIPKA.
Anyway to your points:
1. What is the agent action account that you configured for this agent? If it is local system, then you need the hotfix I mentioned. If it is any other domain account that is in local administrators group make sure you have backup privilege (granted via local/domain GPO). This is the privilege that is needed to run the script.
2. Again, the AGENT ACTION ACCOUNT needs write access to that folder on share and NTFS level permissions. If it is a local system account, then make sure the machine domain account has that access granted.

--Andrzej

re: Monitoring and backing up event logs with MOM

alipka — Tue, 18 Apr 2006 16:38:45 GMT

Ok, So I found the 5 seconds to take look back at the code:
Line 52 is:

fso.MoveFile strLogTempPlace & strCompName & "_*" & strYear & strMonth & strDay & ".evt", strLogDestPlace

Agent action account must have NTFS and share level WRITE access to LogDest parameter just as I wrote.
bye,
Andrzej

re: Monitoring and backing up event logs with MOM

Athif — Wed, 19 Apr 2006 12:12:10 GMT

Hi Andrzej,

Sorry for messing with your name:).

I am using Local System Account and applied the HOTFIX too. I think permission was the problem. I just granted MOM ACTION Account WRITE permissions as said. Let me see how it goes.

Thanks again,
Athif

re: Monitoring and backing up event logs with MOM

Ziemek Borowski — Wed, 03 May 2006 20:17:23 GMT

http://spike.aspweb.cz/alipka/monitoreventlogs.zip -- 404 Not Found.

re: Monitoring and backing up event logs with MOM

Andrzej Lipka — Mon, 08 May 2006 13:43:12 GMT

The site or server must be down (its free, so I dont expect it to be 24h;)) - I'll post the attachment on a new link as soon as I have access to the server (should hopefully be tomorrow).
Thanks for letting me know!
Andrzej

re: Monitoring and backing up event logs with MOM

alipka — Mon, 08 May 2006 21:58:56 GMT

Should be ok now - i moved the attachment to another server.

re: Monitoring and backing up event logs with MOM

Rob — Thu, 18 May 2006 22:54:09 GMT

If the event logs are set to overwrite do they still get backed up?

re: Monitoring and backing up event logs with MOM

alipka — Fri, 19 May 2006 10:30:22 GMT

Yes they do. The MP works in such a way that you can define when you want to backup logs:
every X days/hours, or when the logs are X% full (in case of overwrite logs, I imagine you currently have 100% for all logs, in which case you can configure to backup at >=90%, and then all the logs get backed up (AND CLEARED)).

mom errors

adnan — Thu, 22 Jun 2006 18:23:25 GMT

Error: 9002, Severity: 17, State: 6
The log file for database 'SystemCenterReporting' is full. Back up the transaction log for the database to free up some log space.

any ideas how to fix this error

re: Monitoring and backing up event logs with MOM

alipka — Thu, 22 Jun 2006 19:35:42 GMT

increase the log file in enterprise manager - backing up will not help - the log is needed for DTS job. mom scr db uses a simple recovery model.
see: http://support.microsoft.com/?kbid=899158

re: Monitoring and backing up event logs with MOM

Prasad — Tue, 12 Sep 2006 11:05:06 GMT

Hi

I am not able to download the file, it says host not found.

I am looking for this kind of script for long time. can you mail me the file, or if any one who has allready can mail me the same, that would be great ful.

my mail id is jlprasadreddy@yahoo.com

Thanks

re: Monitoring and backing up event logs with MOM

alipka — Mon, 27 Nov 2006 13:37:27 GMT

I updated the link. Sorry for the downtime. You can find the scripts and akm at:

http://lipkaa.members.winisp.net/MOM%202005/MonitorEventLogs.zip.

re: Monitoring and backing up event logs with MOM

Duvall — Thu, 31 Jan 2008 18:44:32 GMT

I'd like to know how to persist Windows Event Logs on our server without local backups. Our plan was to have a scheduled job that exported Event Logs and inserted them into our Oracle database on another server. Do you know the process for this?

Thanks,

Duvall

re: Monitoring and backing up event logs with MOM

penny1mx — Mon, 18 Feb 2008 17:28:38 GMT

Hello Andrzej's

This is a question, this logs backup works with System Essentials 2007 ???

Thanks,

Carlos ...

re: Monitoring and backing up event logs with MOM

alipka — Mon, 18 Feb 2008 17:42:23 GMT

No it does not. it is only for MOM 2005. If you try to convert it by using migration tools it won't work as expected. I am working on a solution for OpsMgr 2007 wich will also work with SCE 2007. I have currently a basic version ready (local backup) with central backup on the way. Will post it (or some parts of it) here I hope within few weeks.

Ops Mgr 2007 custom MP for monitoring event log size

Andrzej's "IT Thoughts" Weblog — Mon, 03 Mar 2008 17:00:46 GMT

I have done some small work to update my backup event logs MP for MOM 2005 to 2007 ( http://blogs.technet.com/alipka/archive/2006/04/09/monitoring-and-backing-up-event-logs-with-mom.aspx

re: Monitoring and backing up event logs with MOM

AndreyKAZ — Mon, 26 May 2008 14:10:01 GMT

Nice script!

One question: I don't want a clearing of my Events, what I must change in the "backupeventlogs.vbs" script?

Deleting "objLogFile.ClearEventLog()" string is not helpful...

Help me please.

re: Monitoring and backing up event logs with MOM

alipka — Mon, 26 May 2008 14:37:34 GMT

I haven't tried it, but deleting the clearEventLog() string should be good enough as per: http://technet.microsoft.com/en-us/library/bb742445.aspx#EFAA. Does the backup of event log succeed?

re: Monitoring and backing up event logs with MOM

carnaval — Sat, 28 Feb 2009 20:28:26 GMT

Hi all !

now, i don't download above attachment file, i need it. Somebody help me by send me that file via email : lequanghoang@gmail.com.

Thank you very much.