The official blog for Windows Server Essentials and Small Business Server support and product group communications.
[Today's post comes to us courtesy of Damian Leibaschoff and Justin Crosby from Commercial Technical Support]
One of the most requested features for the SBS Monitoring component of Windows SBS 2008 and Windows SBS 2011 Standard is the ability to control and filter unwanted errors from the event logs section of the reports.
There are a number of known events that can be safely ignored. Also depending on the particular environment you might have your own list of events you want to ignore. You cannot accomplish this with the built-in, out-of-box, functionality.
This, as-is solution, was built by engineers from the SBS support team and is aimed at improving the functionality and effectiveness of the SBS Monitoring reports.
The relevant portion of a detailed report from SBS 2011 standard before installing the new functionality:
The same report with the feature installed using the default exclusions:
Notice how the critical event count went from 12 to 5, and unimportant DCOM and WinRM events have been hidden.
This solution configures a database table with a number of source:event combinations (known as exclusions) that need not be collected from the event logs, for example: DCOM 10016. Upon installing the solution a default set of exclusions are added depending on the version of SBS and the existing instances that have already been collected are removed. The same is true when a new exclusion is added manually, existing source:events instances will be deleted.
Upon removing an exclusion or uninstalling the solution, the process of collecting all events will resume and only after the event is experienced again it will then be collected and will appear on the report.
You will see “Changed database context to ‘SBSMonitoring’
.\SBSAlertsCleanup.ps1 –Action ListExclusions
ID Event Source -- ----- ------ 1 129 WinRM 2 142 WinRM 3 4107 Microsoft-Windows-CAPI2 4 10016 DCOM 5 10009 DCOM 6 5586 SharePoint Foundation 7 6772 SharePoint Foundation 8 6398 SharePoint Foundation 9 8 MSExchange CmdletLogs 10 6 MSExchange CmdletLogs
This is a 2 part process, first you have to list the current exclusions, and then we can pick which one to remove.
.\SBSAlertsCleanup.ps1 –Action RemoveExclusion –ID 1 Removing Exclusion for Source: WinRM, EventID: 129
To confirm:
ID Event Source -- ----- ------ 2 142 WinRM 3 4107 Microsoft-Windows-CAPI2 4 10016 DCOM 5 10009 DCOM 6 5586 SharePoint Foundation 7 6772 SharePoint Foundation 8 6398 SharePoint Foundation 9 8 MSExchange CmdletLogs 10 6 MSExchange CmdletLogs
This is a 2 part process, first you have to list the available instances of events that have already been collected, and then we can pick which one to exclude.
.\SBSAlertsCleanup.ps1 –Action ListEvents
ID Event Source -- ----- ------ 346141 11 Disk 349778 13 Server Infrastructure Licensing 349779 14 Server Infrastructure Licensing 349781 15 Server Infrastructure Licensing 349552 25 WindowsUpdateClient 349832 54 MSExchange OWA 349827 135 WinRM 349795 502 Windows Small Business Server 2011 Standard 349809 1000 Application Error 343153 1016 DhcpServer 342822 2002 ESENT 348341 2007 ESE 342823 2007 ESENT
Let’s say that the administrator was been receiving several events for WindowsUpdateClient 25 on a regular basis. The admin has investigated this event and determined that it is not cause for concern on their network and they would no longer like to be notified about this event. The admin can do the following to exclude this event from the report:
.\SBSAlertsCleanup.ps1 –Action AddExclusion –ID 349552
Adding Exclusion for Source: WindowsUpdateClient, EventID: 25
ID Event Source -- ----- ------ 2 142 WinRM 3 4107 Microsoft-Windows-CAPI2 4 10016 DCOM 5 10009 DCOM 6 5586 SharePoint Foundation 7 6772 SharePoint Foundation 8 6398 SharePoint Foundation 9 8 MSExchange CmdletLogs 10 6 MSExchange CmdletLogs 11 25 WindowsUpdateClient
Upon removing an exclusion or uninstalling the product, the process of collecting all events will resume and only after the event is experienced again it will then be collected and will appear on the report.
.\SBSAlertsCleanup.ps1 –Action Uninstall
We install a set of common exclusions for known events that are generally considered as ignorable. This may not be the case for each and every server so you might have to tweak the list of exclusions, removing and adding as needed as to make your reports show relevant errors that could be of interest for someone administering the health of the server.
SBS 2008
SBS 2011 Standard
Hopefully, this simple enhancement can help you regain control of the reports and fine tune them to your needs.
nice workaround! and a job well done and very appreciated, one of my students gave me the link and i must admit it is quite a good one (thanks RP).
i'm going to test it right away on my SBS2011, and hopefully pass the link around to all new sessions about SBS in the near future :)
best regards from Aix-en-Provence, France.
Pierre.
Thanks for this, SBS Team!.
Perhaps someone in the community will do a GUI version :-).
- Les.
I ran the script as described above. All default exclusions are showing up, however all the ones that are supposedly excluded on the list still show up on the daily report.
Should this happen as such? Am I missing where it is excluding it from?
-Jared
Jared R.,
The existing alerts should be pruned and new ones skipped, so they should not be showing in your daily report (as a count) or the weekly report as shown in the example in the post. If you are seeing events that match the source:event id in your new reports, then the script either didn't make the needed changes or the report is showing stale data. You could try uninstalling this feature and reinstalling, or even performing the steps in blogs.technet.com/.../how-to-recreate-the-sbsmonitoring-database.aspx to start with a brand new Monitoring DB (you will lose your old reports).
I assume this just hides them in the report and not in the event log?
I'm getting flooded with x8 Error Event Id 10009 messages every 30 minutes. They pertain to the NAS (Samba based) we have attached to the SBS 2011 network which cannot respond to requests from the SBS Server.
I think there should be some simple option to configure non Microsoft based hardware (Linux, Apple, etc.) from these requests from the SBS.
@MrFaize:
It is only being removed from the reports.
The SBS Console will try to query any machines in Active Directory in either the Domain Controllers, SBSComputers or SBSServers, so make sure it is not on one of the OUs. However, the SBSMonitoring service will try to query any machine no matter where they are in AD every 30 minutes. We are evaluating if there any options we can implement to provide such exclude funtionality.
Thanks for the reply. It really affects/annoys a lot of SBS users so would really help if something could be done to improve this. You can search the web for many users reporting problems with Event ID 10009 and using various NAS hardware. I am using a Netgear ReadyNAS and there are people posting in the ReadyNAS forums about this problem for sometime.
My NAS is in "SBS Computers":
(Active Directory Users and Computers > mydomain.local > My Business > Computers > SBS Computers)
This is where it was located when it joined the domain through the NAS administration interface.
Are you suggesting I move the NAS to another/new OU? (I'm no Active Directory expert!!)
Installed the report exclusion enhancement - excellent update (more like these please)!