People
Main  »  My Profile Search More
Steve G
Local Network
  • Steve Giordano
  • Country:
Has (1) Friends
Joined (1) Groups
0

0
Steve G
Level: System Center Specialist | Points: 5600
Steve G post a question under Operations Manager.
Alerting on strings in Event Description
I'd like to generate an alert when more than one string is found in the event description.  Basically trying to create an "and" query instead of an "or" query using RegEx and having no luck.  This is what I had - EventDescription matches regular expression gPlink|organizationalUnit|Write Property but that's an "or" statement and generates more alerts for stuff we don't need.  Here's my latest attempt at setting this - EventDescription matches regular expression (?=.*organizationalUnit)(?=.*Write Property)(?=.*f30e3bbe-9ff0-11d1-b603-0000f80367c1) and i now get an alert indicating Expression Filter Module Failed Initialization.  How do you properly use "and" when setting up a Simple Event monitor?
Steve G post a question under Operations Manager.
Ops 2007 - DW Perf Collection Issue
We've been having some performance issues with our SCOM 2007 implemenatation and I've been focused on the Ops db but noticed something with the DW db.  I ran a report to show me the Data Warehouse Performance Collection:Writer Average Batch Processing Time data for this year and I have a management server that's averaging 101.6 (seconds I assume) with 1643 agents reporting to it.  My other MS is averaging 22.31 seconds with 1576 agents reporting to it.  From what I've been reading in research has said anything larger than 20 seconds is an issue.  If this is a good rule of thumb then where should I start looking?  The db disk perf?  Something specific on the MS?
Steve G post a question under Operations Manager.
Text Log Monitoring Issue
I'm setting up a Generic Text log rule in SCOM 2007 R2 with a simple expression to look for the string 'error' in the file.  I configured the alert to display the text found by using Params/Param[1] in the alert description.  I have a blank text file to start and I enter the text "Error message 1" and no alert.  Then on a new line I enter "Error message 2" and I get an alert with the text "Error message 1" in the description.  Finally on a new line I enter "Success message 1" which doesn't match to expression to look for and it generates an alert with "Error message 2" in the description (Params/Param[1]).  Seems like it's a line behind for some reason.  Anyone else experience this and know how to resolve?  Thanks for the suggestions.
Steve G post a question under Operations Manager.
Working with Groups very slow
We have SCOM 2007 R2 CU5 monitoring 3500 servers in our environment.  Over time working with groups in the console has become extremely slow (we have about 730 groups)!  As long as several minutes to create or edit a group.  I'm guessing it could have something to do with querying non-indexed tables (maybe?).  I was wondering if there were a set of tables to focus on in the Ops DB to try and narrow down where the issue might be.  I could run SQL Profiler but before i rollup my sleeves and do that (I'm not very good at troubleshooting SQL at that level) I figured I check if there's a simpler way.  Thanks.
Steve G post a question under Operations Manager.
Availability Data
Is there a rule that collects availability data in SCOM?  My management is looking for availability reports but they would like to see the value as a whole.  In other words the existing availability reports show availability data per server when a group of servers in selected.  They would like to see the availability number for that partiuclar group - not by members of the group.  Is there another report that will do this or is there another way to get this data?
1 - 5 of 140     Oldest >>
I Recommend
Subject From Date
Recommended
Subject From Date
About Me
ACHIEVEMENTS:
The Editor
Master of Submissions
Rating Points (5)
Submission Points (25)
Albums: (0) View My Albums
Latest Photos (0) Photos
Bookmark Profile

Community
Submit

Rank (3) Views 109 On Wed, May 16, 2012 11:49 AM, 5 days ago By Steve G

0

0

Time must be set to UTC time. Everything I query is 4 hours behind. Is there a place to set that?

   Comments(0)

Rank (4) Views 103 On Wed, May 16, 2012 10:49 AM, 5 days ago By Steve G

0

0

I just downloaded LogSmith and yes it's easier but querying the Security logs of a DC is painful!! But I guess that's true of any tool querying Sec logs. I tried saving a copy to my local machine and importing in the EVent Viewer but can't figure out how...

   Comments(0)

Rank (3) Views 115 On Wed, May 16, 2012 9:23 AM, 6 days ago By Steve G

0

0

Downloaded LogParser and having some trouble getting the syntax correct. I'm running the query : C:\Program Files\Log Parser 2.2>LogParser.exe -i:EVT "SELECT Top1 Strings AS Parameters FROM E:\SecLogs.evt WHERE EventID=566" and all is does is show me the...

   Comments(0)

Rank (5) Views 89 On Tue, May 15, 2012 8:53 AM, 7 days ago By Steve G

0

0

Here's the event we're looking for. I'd like to alert when all three strings are found (gPlink, ogranizationalUnit, Write Property). Event Type:Success Audit Event Source:Security Event Category:Directory Service Access Event ID:566 Date:4/12/2012 Time:12...

   Comments(0)

Rank (7) Views 681 On Mon, May 14, 2012 3:08 PM, 7 days ago By Steve G

0

0

I'd like to generate an alert when more than one string is found in the event description.  Basically trying to create an "and" query instead of an "or" query using RegEx and having no luck.  This is what I had - EventDescription matches regula...

   Comments(0)

Rank (28) Views 189 On Fri, May 04, 2012 2:42 PM, 17 days ago By Steve G

0

0

CORRECTION!! These numbers are from the same MS! Reporting on the Data Warehouse Performance Collection:Writer Average Batch Processing Time counter I'm seeing 101.6 for State and 22.31 for system.event.linkdata. Sorry for the confusion! Again - should I...

   Comments(0)

Rank (29) Views 160 On Fri, May 04, 2012 2:37 PM, 17 days ago By Steve G

0

0

OK - that's what I get for making assumptions. It is measured in ms - not seconds. Either way - there seems to be a big difference between ms's. Out of the four instances (alert, performance, state and system.event.linkdata) state and system.event.linkdat...

   Comments(0)

Rank (22) Views 456 On Fri, May 04, 2012 2:19 PM, 17 days ago By Steve G

0

0

We've been having some performance issues with our SCOM 2007 implemenatation and I've been focused on the Ops db but noticed something with the DW db.  I ran a report to show me the Data Warehouse Performance Collection:Writer Average Batch Processin...

   Comments(0)

Rank (19) Views 206 On Tue, Apr 24, 2012 1:23 PM, 27 days ago By Steve G

0

0

Well, doing more digging I answered my own question. My monitor was always a line behind because in the text file I was using for test I wasn't hitting enter after each line and the trigger for the monitor is a new line (0x0A0x0A hex sequence). I also wro...

   Comments(0)

Rank (28) Views 451 On Mon, Apr 23, 2012 2:55 PM, 28 days ago By Steve G

0

0

I'm setting up a Generic Text log rule in SCOM 2007 R2 with a simple expression to look for the string 'error' in the file.  I configured the alert to display the text found by using Params/Param[1] in the alert description.  I have a blank text...

   Comments(0)

Rank (29) Views 755 On Thu, Apr 12, 2012 8:23 AM, 40 days ago By Steve G

0

0

We have SCOM 2007 R2 CU5 monitoring 3500 servers in our environment.  Over time working with groups in the console has become extremely slow (we have about 730 groups)!  As long as several minutes to create or edit a group.  I'm guessing it...

   Comments(0)

Rank (27) Views 182 On Tue, Apr 03, 2012 3:30 PM, 48 days ago By Steve G

0

0

No good - doesn't return any data when I run the report.

   Comments(0)

Rank (24) Views 608 On Tue, Apr 03, 2012 2:59 PM, 48 days ago By Steve G

0

0

Is there a rule that collects availability data in SCOM?  My management is looking for availability reports but they would like to see the value as a whole.  In other words the existing availability reports show availability data per server when...

   Comments(0)

Rank (32) Views 626 On Mon, Apr 02, 2012 3:35 PM, 49 days ago By Steve G

0

0

We're having some perf issues with our OPS db and I found an article from Kevin Holman that included running the SQL command 'DBCC SHOWCONTIG WITH FAST'.  He recommends to pay close attention to Scan Density (above 80%) and Logical Scan Fragmentation...

   Comments(0)