The System Center Operations Manager Support Team Blog

This is the OpsMgr 2007 blog for the Microsoft support team. If you were looking for the SCOM 2007 or MOM 2005 blog then you are in the right place.

When taking agent out of maintenance mode, old events are reprocessed and new alerts generated

When taking agent out of maintenance mode, old events are reprocessed and new alerts generated

  • Comments 1
  • Likes

image We’ve been seeing a couple instances of this so I thought it would be worthy of a mention just in case any of you are running into the same thing.

Issue: When taking a System Center Operations Manager 2007 R2 agent out of maintenance mode, an agent with a large number of events in the application event log may have each of those events reprocessed, generating false or irrelevant alerts.

Resolution: There are three potential workarounds for this issue:

1. Clear the event log prior to putting a machine into Maintenance Mode.

2. Manually setup overrides to ignore the events.

3. Add the following registry key:

HKLM\Software\Microsoft\Microsoft Operations Manager\3.0\Modules\Global\NT Event Log DS

Create a DWord value named MaxEventBufferSize and set it to a decimal value of 500000.

Hope this helps,

Jeff Carter | Senior Support Engineer

Comments
  • This workaround works for Windows Event Log based monitoring, but what about other type of log monitoring?

    I have the Unisys ES7000 Management pack installed, and have this same issue with alerts from it.

    The rule name is:  Unisys.ES7000.AlertMonitor.Slapi.Rule

    Any idea how to prevent the duplicates from it?

Your comment has been posted.   Close
Thank you, your comment requires moderation so it may take a while to appear.   Close
Leave a Comment