Monitoring Windows Event Subscription using SCOM 2012

Event subscription is used when we want to centralize Event Logs (receiving logs from remote computers)

We can see overall Event Subcsription status by right clicking subscription and choose Runtime Status

 

But how to monitor this status using SCOM 2012 ?

Read on !!

This is extension of previous post

We’ll configure script based monitor,so we need management pack

We need to configure monitoring on Event Collector server (acs.contoso.com in our case),because wecutil command is not recognized on server where Subscription is not configured.Because in Subscription server there is no installed SCOM console,we’ll connect to acs.contoso.com from SCOM server (scom.contoso.com)

Tools-connect

Authoring-Management Pack Objects-Monitors-Create a Monitor-Unit Monitor

Select Sample PowerShell Script 2 State and management pack

Make sure Monitor is disabled,target set as Windows Server

 

 

$acs = wecutil gr wec | select -Index 2

output of wecutil command  (RunTimeStatus: Active stores in $acs variable

$PropertyBag.AddValue(“ACS”,$acs)

Add the value from the variable $acs to  propertybag in a field called: “ACS” then transfer the fields and values from PropertyBag to SCOM..

Raise event if parameter doesn’t contain word “Active”

Othervise all is ok

 

 

 

Right click monitor-override for Windows Server Class

Select server and click OK

Disable subscription or restart ACS server,alert is raised