Managing Event Alerts in Your Reports - An SBS Monitoring Feature Enhancement

Managing Event Alerts in Your Reports - An SBS Monitoring Feature Enhancement

  • Comments 27
  • Likes

[Today's post comes to us courtesy of Damian Leibaschoff and Justin Crosby from Commercial Technical Support]

One of the most requested features for the SBS Monitoring component of Windows SBS 2008 and Windows SBS 2011 Standard is the ability to control and filter unwanted errors from the event logs section of the reports.

There are a number of known events that can be safely ignored. Also depending on the particular environment you might have your own list of events you want to ignore. You cannot accomplish this with the built-in, out-of-box, functionality.

This, as-is solution, was built by engineers from the SBS support team and is aimed at improving the functionality and effectiveness of the SBS Monitoring reports.

The relevant portion of a detailed report from SBS 2011 standard before installing the new functionality:

clip_image002

The same report with the feature installed using the default exclusions:

clip_image004

Notice how the critical event count went from 12 to 5, and unimportant DCOM and WinRM events have been hidden.

How it works

This solution configures a database table with a number of source:event combinations (known as exclusions) that need not be collected from the event logs, for example: DCOM 10016. Upon installing the solution a default set of exclusions are added depending on the version of SBS and the existing instances that have already been collected are removed. The same is true when a new exclusion is added manually, existing source:events instances will be deleted.

Upon removing an exclusion or uninstalling the solution, the process of collecting all events will resume and only after the event is experienced again it will then be collected and will appear on the report.

Installation and Usage

  1. Download and extract the SBSAlertsCleanup package which is hosted on the SBS Support Team’s SkyDrive.
  2. Open the location of the extracted files and then the properties of SBSAlertsCleanup.ps1 file.
  3. Unblock the file if the option is shown. Note: you do not need to do this to the .sql files.
  4. Launch an elevated PowerShell prompt.
  5. From PowerShell, browse to the folder where you extracted the files.
  6. From PowerShell, run:
    .\SBSAlertsCleanup.ps1 –Action install [enter]

You will see “Changed database context to ‘SBSMonitoring’

Listing current Exclusions

.\SBSAlertsCleanup.ps1 –Action ListExclusions

ID Event Source
-- ----- ------
1 129 WinRM
2 142 WinRM
3 4107 Microsoft-Windows-CAPI2
4 10016 DCOM
5 10009 DCOM
6 5586 SharePoint Foundation
7 6772 SharePoint Foundation
8 6398 SharePoint Foundation
9 8 MSExchange CmdletLogs
10 6 MSExchange CmdletLogs

Removing an Exclusion

This is a 2 part process, first you have to list the current exclusions, and then we can pick which one to remove.

.\SBSAlertsCleanup.ps1 –Action ListExclusions

ID Event Source
-- ----- ------
1 129 WinRM
2 142 WinRM
3 4107 Microsoft-Windows-CAPI2
4 10016 DCOM
5 10009 DCOM
6 5586 SharePoint Foundation
7 6772 SharePoint Foundation
8 6398 SharePoint Foundation
9 8 MSExchange CmdletLogs
10 6 MSExchange CmdletLogs

.\SBSAlertsCleanup.ps1 –Action RemoveExclusion –ID 1
Removing Exclusion for Source: WinRM, EventID: 129

To confirm:

.\SBSAlertsCleanup.ps1 –Action ListExclusions

ID Event Source
-- ----- ------
2 142 WinRM
3 4107 Microsoft-Windows-CAPI2
4 10016 DCOM
5 10009 DCOM
6 5586 SharePoint Foundation
7 6772 SharePoint Foundation
8 6398 SharePoint Foundation
9 8 MSExchange CmdletLogs
10 6 MSExchange CmdletLogs

Adding an Exclusion

This is a 2 part process, first you have to list the available instances of events that have already been collected, and then we can pick which one to exclude.

.\SBSAlertsCleanup.ps1 –Action ListEvents

ID Event Source
-- ----- ------
346141 11 Disk
349778 13 Server Infrastructure Licensing
349779 14 Server Infrastructure Licensing
349781 15 Server Infrastructure Licensing
349552 25 WindowsUpdateClient
349832 54 MSExchange OWA
349827 135 WinRM
349795 502 Windows Small Business Server 2011 Standard
349809 1000 Application Error
343153 1016 DhcpServer
342822 2002 ESENT
348341 2007 ESE
342823 2007 ESENT

Let’s say that the administrator was been receiving several events for WindowsUpdateClient 25 on a regular basis. The admin has investigated this event and determined that it is not cause for concern on their network and they would no longer like to be notified about this event. The admin can do the following to exclude this event from the report:

.\SBSAlertsCleanup.ps1 –Action AddExclusion –ID 349552

Adding Exclusion for Source: WindowsUpdateClient, EventID: 25

To confirm:

.\SBSAlertsCleanup.ps1 –Action ListExclusions

ID Event Source
-- ----- ------
2 142 WinRM
3 4107 Microsoft-Windows-CAPI2
4 10016 DCOM
5 10009 DCOM
6 5586 SharePoint Foundation
7 6772 SharePoint Foundation
8 6398 SharePoint Foundation
9 8 MSExchange CmdletLogs
10 6 MSExchange CmdletLogs
11 25 WindowsUpdateClient

Uninstalling

Upon removing an exclusion or uninstalling the product, the process of collecting all events will resume and only after the event is experienced again it will then be collected and will appear on the report.

.\SBSAlertsCleanup.ps1 –Action Uninstall

Default set of exclusions

We install a set of common exclusions for known events that are generally considered as ignorable. This may not be the case for each and every server so you might have to tweak the list of exclusions, removing and adding as needed as to make your reports show relevant errors that could be of interest for someone administering the health of the server.

SBS 2008

  • 10016 DCOM
  • 10009 DCOM

SBS 2011 Standard

  • 129 WinRM
  • 142 WinRM
  • 4107 Microsoft-Windows-CAPI2
  • 10016 DCOM
  • 10009 DCOM
  • 5586 SharePoint Foundation
  • 6772 SharePoint Foundation
  • 6398 SharePoint Foundation
  • 8 MSExchange CmdletLogs
  • 6 MSExchange CmdletLogs

Hopefully, this simple enhancement can help you regain control of the reports and fine tune them to your needs.

Your comment has been posted.   Close
Thank you, your comment requires moderation so it may take a while to appear.   Close
Leave a Comment
Comments
  • Awesome bit! Thanks for that. :)

  • Thanks for the great work!!! Finally I can show clients "true" reports without bogus errors causing them unnecessary alarm

  • Hi, looks promising.  Can you shed some light on these errors, I ran the script on both an SBS 2011 box and SBS 2008.

    download.activeitdesign.com/sbs2011.jpg

    download.activeitdesign.com/sbs2008.jpg

  • Active IT Design, you need to make sure that all the files in the package are extracted to the same folder. On your install it is not finding the .SQL files that are part of the package.

  • Fantastic!!! Thanks for the work, looking forward to the clean system reports. Cheers

  • This is going to be a HUGE help in clearing up the reports that get sent to our customers running SBS. This will significantly help cut down on the number of calls and e/mails from customers saying "hey, I see these errors in the reports, what's wrong on the server and can you fix it?" Trying to explain to customers that some of these errors are "normal" and "don't mean anything" does not go over well. This will save oodles of time. Please be sure this gets included in the next UR for the current SBS products and is included by default in v.next...

  • Thanks!  All set now, files were all in the same folder but I had to change to that folder before running the command, it didn't like my syntax of the command when I ran it as c:\temp\SBSAlertsCleanup.ps1 –Action install

    Worked much better when sticking to the orginal directions, my bad.

  • I just shouted Hallelujah! Finally! This will save us dozens of hours explaining customers why they should ignore "severe" errors! Many, many thanks!

  • Fantastic - Several clients and I have been waiting for something like this, it's been causing 'confidence' issues in Small Business Server as a 'simple to manage' solution for more than 3 years. Congratulations to the team who finally put their mind to this ongoing issue. Now I no longer need to respond to 'benign' issues.

  • This update finally completes SBS, congrats on releasing this.

  • OK, now the 64k question.... WHICH alerts are you actually EXCLUDING and WHY?

  • Hi Rich,

    The default list of exclusions we are using and are document in the post, are based on support.microsoft.com/.../2483007 and general product experience. If you are looking for community feedback as to which exclusions to set and why, you may have better luck taking your question to the SBS Forums social.technet.microsoft.com/.../threads

  • Ok, seems quite helpful.  However, we are recording errors that we want to exclude but the LIST command does not list them, so we don;t know what ID to use to exclude them.  Am I missing anything?

    Henri

  • Hi Henri C,

    If you are seeing the event in the server event logs section of your SBS reports, then it should show when you run .\SBSAlertsCleanup.ps1 –Action ListEvents

    If the event hasn't happened in the last 30 days (90 in RTM SBS 2008)  then it might not be in the DB and cannot be excluded until it happens again and gets recorded.

  • Duh! I am not religious, but I have to shout Hallelujah!!! These error are killing me!