Hello,
Which SMS MP guide are you referring to?
I have checked the Microsoft System Center Configuration Manager 2007 Guide unsucessfully as I could not see any SMS MP name ... should I install one on top of my existing configuration? Does it have another name in SCOM 2007?
Thanks,
Dom
Dom:
Which MP are you running - the SCCM MP, or the SMS MP? Or both?
From the SCCM MP guide:
Defining the SMS Environment Variable to Support Log-Based Rules
A number of rules in the Configuration Manager Management Pack read Configuration Manager-based log files to check for errors.
The following rules under ConfigMgr Site Servers - Common are based on the sender.log, distmgr.log, and policypv.log files, respectively:
• ConfigMgr 2007 Component: The sender cannot connect to remote site over the LAN (Standard Security)
• ConfigMgr 2007 Component: The sender cannot connect to remote site over the RAS connection
• ConfigMgr 2007 Component: The sender cannot connect to remote site over the LAN (Advanced Security)
• ConfigMgr 2007 Component: Distribution Manager failed to process a package
• ConfigMgr 2007 Component: Distribution Manager failed to insert an SMS Package because SDM Type Content is not present in the CI_Contents table
• ConfigMgr 2007 Component: Policy Provider failed to get new software update policies from the SMS Site Database
• ConfigMgr 2007 Component: Policy Provider failed to create new software update policy
• ConfigMgr 2007 Component: Policy Provider failed to get new compliance policies from the SMS Site Database
• ConfigMgr 2007 Component: Policy Provider failed to create new compliance policy
• ConfigMgr 2007 Component: Policy Provider failed to notify Hierarchy Manager of a policy change
In order to monitor these logs, the location of the Configuration Manager installation folder must be specified. To do so, create the %SMS_INSTALL_DIR_PATH% system environment variable on a site server so that the MOM Agent running under Local System or a local administrator user context has access to the log files in the %SMS_INSTALL_DIR_PATH%\Logs directory. For more information about setting system environment variables, see the system environment variable Web page (http://go.microsoft.com/fwlink/?LinkId=92316).
In order for the Operations Manager Health Agent to use this system environment variable, the Configuration Manager Site Server may need to be restarted.
Hello,
I found this ...
http://technet.microsoft.com/en-us/library/cc655729.aspx#BKMK_ApplicationProviderPath
For these rules to work, you need to create the %SMS_INSTALL_DIR_PATH% environment variable on your site server
with the installation path that was specified for your site installation. The environment variable path should not end in a backslash.
Each Configuration Manager 2007 server with a sender must be a managed computer.
http://technet.microsoft.com/en-us/library/cc755616(WS.10).aspx
Is it what is missing ONLY?
Thanks,
Dom
Dom,
Try this :-
Variable:
SMS_INSTALL_DIR_PATH
Value:
your installation Drive:\SMS
my case :
F:\SMS
Most common event in my OpsDB so far (which is not that long) is:
Source: Health Service Script
Generating Rule: Collect Distributed Workflow Test Event
Event Number: 6022
Level: Information
Description: LogEndToEndEvent.js : This event is logged to the Windows Event Log periodically to test a event collection.
Seems like a decent candidate for disabling but I didn't see it anyones list here.
Thoughts?
If the TEST event is your largest event - you just dont have anything goin on yet.
:-)
(but yeah - I'd disable it if it was my top event and showed me no value)
Hello,
So I'm trying to create overrides for some of the top events in our database. For instance, Event 21402 and 21403 which you also list in your list of common events to disable. This rule (Collect Batch Response Module Events) is targeted to Health Service and when I right click the event to create an override it shows "Override the rule... For all objects of class: Health Service". I select this target, put a check mark in the "override" field, change Override Value to "False", select a custom MP to store the override in and click OK. I can even view the override using the Summary link. But, the events keep coming in... several days later, so it's not that I'm just not waiting long enough for the new configuration to take effect. I've found that overrides I create for rules that target something other than "Health Service" work fine... but they seem to never work for Health Service.
Is there something I'm missing here? Should I be targeting a different class?
Thanks.
Hello Kevin,
Looks like we have a busy DNS mp. We have the most current version of DNS MP. I'm guessing it should be ok to disable these since they don't have alerts configured and of course no Product Knowledge.
Thanks,
Tom
Event ID: 1161
Total Events: 113602
Generating Rule: Collect Script Trace Events
Management Pack: Microsoft Windows DNS Server Library
Description:
DNS-NslookupAllTests.js :
Duration: 0.157
Start: 17:14:28.239
End: 17:14:28.396
Event ID: 1162
Total Events: 37868
Generating Rule: Collect Script Trace Events
MP: Microsoft Windows DNS Server Library
Description:
DNS-NslookupAllTests.js : Final Summary:
SuccessCount: 1
NonAuthoritativeCount: 1
FailureCount: 0
BestHost: 107.107.38.in-addr.arpa.
BestServer: xxx.xxx.xxx.xxx
BestTime: 0.094
WorstHost: 107.107.38.in-addr.arpa.
WorstServer: xxx.xxx.xxx.xxx
WorstTime: 0.094
FailingPairs:
Event ID: 1199
Total Events: 37868
Generating Rule: Collect Script Trace Events
Management Pack: Microsoft Windows DNS Server Library
Description:
DNS-NslookupAllTests.js : Exiting normally. NslookupAllTests Duration 0.172 seconds.
We have these:
EventID TotalEvents EventSource
10457 23390 Health Service Modules
11771 9127 Health Service Modules
10409 5113 Health Service Modules
10403 4468 Health Service Modules
6522 4212 DNS
1063 2443 Microsoft-Windows-DHCP-Server
31717 2173 Health Service Modules
11903 2055 Health Service Modules
7001 1909 Service Control Manager
21402 1356 Health Service Modules
21403 1299 Health Service Modules
1206 1009 HealthService
7036 825 Service Control Manager
31552 636 Health Service Modules
4618 579 AdtServer
6022 570 Health Service Script
1103 547 MetaFrameEvents
31709 546 Health Service Modules
11052 496 Health Service Modules
7031 418 Service Control Manager
Great post Kevin, thanks. I made a slight change that may be useful to others: I added the Channel field which - in SCOM 2012 - shows the event log the events are from. Saves a lot of time digging :) The query on my side now is:
SELECT top 20 Number as EventID, COUNT(*) AS TotalEvents, Publishername as EventSource, Channel as EventLogName
FROM EventAllView eav with (nolock)
GROUP BY Number, Publishername, Channel
ORDER BY TotalEvents DESC
Hi, We are getting following error on our SCOM management servers, no cause is given, looks like its cut off after "Cause", no additional details in xml view:
Log Name: Operations Manager
Source: Health Service Script
Date: 9/15/2013 3:09:22 PM
Event ID: 3000
Description: AgentMinRequiredVersionCheck.vbs : An error occurred while reading the registry. Cause:
Would appreciate any ideas!
Do we have any method to delete the collected events from OperationsManager DB.
