Operations Manager Cross-Group Blog

Tips and tricks from the Microsoft Operations Manager Cross-Group Team Members

How to store SYSLOG in the SCOM Data Warehouse

How to store SYSLOG in the SCOM Data Warehouse

  • Comments 4
  • Likes

If you have ever tried to create a Syslog collection rule in the SCOM Authoring Console, this is the module sequence that it creates this:

This technically works, but your SYSLOG events are not very searchable.  The Logging Computer shows up as blank, the Event ID is always zero, and the Rendered Description is blank.  The full data item is stored in the EventData column of the Event.vEventDetail view as XML.  Searching XML in TSQL isn't as easy as a character column, and sorting out duplicate events is made harder by the inclusion of the time stamp in the EventData column.

The solution is to include a System.Event.GenericDataMapper as a Condition Detection Module.  This allows us to select how individual elements of the System.ApplicationLog.SysLogData item output by the Data Source Module are mapped into the System.EventData of the Write Action module

You may note that I almost always remove the Write Action from my collection rules that writes to the Operations Database.  Here is the configuration that I used:

  <EventOriginId>$Target/Id$</EventOriginId>
  <PublisherId>$MPElement$</PublisherId>
  <PublisherName>$Data/EventData/DataItem/PriorityName$</PublisherName>
  <Channel>Syslog</Channel>
  <LoggingComputer>$Data/EventData/DataItem/HostName$</LoggingComputer>
  <EventNumber>$Data/EventData/DataItem/Severity$</EventNumber>
  <EventCategory>0</EventCategory>
  <EventLevel>2</EventLevel>
  <UserName></UserName>
  <Description>$Data/EventData/DataItem/Message$</Description>
  <Params></Params>

There is not an easy way to directly map the eight severity levels of a SYSLOG to the levels of a Windows event.  So I just hard-coded a value of "2" for Warning.  Since the severity is used for the event ID, that met my needs for easy searching.  If you wanted to, you could create three separate collection rules and filter SYSLOG severities 0-3, 4-5, and 6-7 into three separate collection rules where you hard-code the event levels to Error, Warning, and Informational.

Comments
  • I'm trying to follow your instructions, but I can't seem to get to a dialog box that has a module listing.  When I create or edit a syslog event rule, the tabs I get are: General, Configuration, Product Knowledge, Overrides.  Moreover, on the Configuration tab, the Condition area is greyed out and cannot be edited.  Your screen shots show: General, Modules, Product Knowledge, Options.  Are you using an authoring tool?  I'm new to SCOM and am probably missing something obvious, but I'm clueless as to how to get to the screens you have in this post.

  • I am using the System Center Operations Manager 2007 R2 Authoring Resource Kit which can be found here.

    www.microsoft.com/.../details.aspx

    The management packs that it generates can be used in SCOM 2007 R2 and also SCOM 2012.

  • I've got this working. I decided to leave the action to store events in the operations manager database so that I could see an event view in the monitoring area.

    There seems to be a problem with the Description field. Every time a new event arrives, it overwrites the description field for all similar events from the same network device. Any thoughts about that?

  • Also, do you have an example of how you retrieve this info from the data warehouse?

Your comment has been posted.   Close
Thank you, your comment requires moderation so it may take a while to appear.   Close
Leave a Comment