Monitoring Windows Event Subscription using SCOM 2012

Posted: September 16, 2016 in SCOM

Event subscription is used when we want to centralize Event Logs (receiving logs from remote computers)

We can see overall Event Subcsription status by right clicking subscription and choose Runtime Status

untitled1

 

untitled

But how to monitor this status using SCOM 2012 ?

Read on !!

This is extension of previous post

We’ll configure script based monitor,so we need management pack

We need to configure monitoring on Event Collector server (acs.contoso.com in our case),because wecutil command is not recognized on server where Subscription is not configured.Because in Subscription server there is no installed SCOM console,we’ll connect to acs.contoso.com from SCOM server (scom.contoso.com)

Tools-connect

untitled

Authoring-Management Pack Objects-Monitors-Create a Monitor-Unit Monitor

Untitled.png

Select Sample PowerShell Script 2 State and management pack

untitled

Make sure Monitor is disabled,target set as Windows Server

Untitled.png

 

Untitled.png

 

$acs = wecutil gr wec | select -Index 2

output of wecutil command  (RunTimeStatus: Active stores in $acs variable

untitled

$PropertyBag.AddValue(“ACS”,$acs)

Add the value from the variable $acs to  propertybag in a field called: “ACS” then transfer the fields and values from PropertyBag to SCOM..

untitled

Raise event if parameter doesn’t contain word “Active”

untitled

Othervise all is ok

 

untitled

 

 

untitled

untitled

Right click monitor-override for Windows Server Class

Untitled.png

Select server and click OK

untitled

Disable subscription or restart ACS server,alert is raised

Untitled.png

Advertisements
Comments

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s