Kevin Holman's System Center Blog

Posts in this blog are provided "AS IS" with no warranties, and confers no rights. Use of included script samples are subject to the terms specified in the Terms of UseAre you interested in having a dedicated engineer that will be your Mic

How to test fire ANY Windows Event on ANY server from ANY application

How to test fire ANY Windows Event on ANY server from ANY application

  • Comments 7
  • Likes

I have been meaning to blog about this for some time now.  When creating management packs, or adding monitoring for specific events, it is very helpful to have tools to test fire these events.  In the past, we would use built in tools like EventCreate, or the MOM2005 event creator tool.  However, these have limitations in which event sources they can create events for, or limitations in the event ID numbers.

 

Recently – Microsoft released the System Center Operations Manager 2007 R2 Admin Resource Kit.

 

One of the tools is the  MP Event Analyzer.  You can read about some of the scenarios here: 

 http://blogs.technet.com/b/momteam/archive/2011/06/03/system-center-operations-manager-2007-r2-admin-reskit-released.aspx

 

The MP Event Analyzer is built on the original release of EventLog Explorer which never got enough credit or exposure, for such an incredibly powerful tool.

 

Install the resource kit to your desktop or tools machine, and then you can copy the MP Event Analyzer tool (two files) to any server where you want to test fire an application or OS based event.  You can also run the tool from a mapped drive or UNC path as well:

 

image

 

Open the MPEventAnalyzer.exe.  Select the Investigate Event Sources tab at the bottom:

 

image

 

In this example – I want to test a complex event log entry from SQL, so in the “Source” list I find my Event Source for my SQL instance – in this case “MSSQL$I01”:

 

image

 

Notice that ALL POSSIBLE events that COULD be fired under this event source show up on the right pane.  This is the power of this tool.  You could use this tool to investigate any application that writes to the event log under a given event source, and quickly write a management pack to alert on the most import events.

I my case, I am looking to test a very specific event ID – 3041 – which is a backup failure.  I find this event ID in the list, and place a check mark in the box next to it:

 

image

 

Then choose Action – Add marked events to Execution list:

 

image

 

Once the event shows up in the execution list – you can right click the event, and choose Parameters, and input any specific parameters into the event, if your event rule datasource is only alerting when specific text in present in specific params:

image

 

You can also edit the severity of the event to be generated. 

When you are happy – press the green “Fire” button at the top:

 

image

 

You will see your event fired perfectly in the log:

image

 

And OpsMgr and the management pack fired the alert:

 

image

 

 

The huge benefit of this tool for testing, is while you are developing your custom MP’s for custom application events, or windows events, this tool can be used to test fire any event possible on the system just as it would be fired by a real issue, with no restrictions on event source, event ID, and you can input highly customized and specific event parameter data.

Comments
  • Kevin, thanks for taking the time to blog this.  Awesome tool, exactly what I've been looking for to test application event monitoring with SCOM.

  • A truly amazing tool, thanks Kevin.

  • Nice write up Kevin.....I don't know how many times I've asked vendors to give me the events they write to the event log.  With this tool I can finally see that.  Now I can write MPs for my custom applications.     Thanks!

  • thankyou so much ... you are making my learning curve as a scadmin much easier.     :-)

  • thank you so much ..this tool indeed helpful..as i started doing authoring stuff with the limited knowledge on SCOM 2007

  • Has anyone gotten this to work with the Windows security/auditing log? I always get a permissions error. I even tried giving "Everyone" the user right to "Generate audit logs" in the local policy. Hate to use this vouch for tech support, but this is the first hit I get with Google on this topic.. :-)

  • This is such a great tool, thanks Kevin!

Your comment has been posted.   Close
Thank you, your comment requires moderation so it may take a while to appear.   Close
Leave a Comment
Search Blogs