I have been setting up linux log file monitoring in SCOM 2007 R2 using the cross platform agents. Sometimes they work, but most of the time I get this alert on the RMS (where the xplat agents are pointing to). I have modified the regular expression a million times thinking that was the issue with no consistent luck. The permissions seem fine. I have tried to research this error with nothing really relating to the issue. Can anyone give me a good idea how I can understand and fix this issue? The scx.log file does not give me any good info as to why it is erroring. What else can I do to diagnose it? Ideas on what the problem is and how to fix it?
Generic Event Mapper Module Failed Execution
Alert Rule: Generic Event Mapper Module Execution Failure
Execution failure in event mapper module Error: 0x80ff0016 Details: One or more workflows were affected by this. Workflow name: LogFileTemplatePage_6dd2cdf27262498997d6ac020cfa60ba.Alert Instance name: <my server> Instance ID: {00DC7D01-E056-71DF-9E54-34F66708D994} Management group: <my group>
Knowledge
--------------------------------------------- In the Ops Mgr event Log: Execution failure in event mapper module Error: 0x80ff0016 Details: One or more workflows were affected by this. Workflow name: LogFileTemplatePage_6dd2cdf27262498997d6ac020cfa60ba.Alert Instance name: <my server> Instance ID: {00DC7D01-E056-71DF-9E54-34F66708D994} Management group: <my group>
Interesting that when I search the Internet for your error code (0x80ff0016) I get one hit...right here with you. You think permissions are fine, and if I am reading correctly you are saying things do work sometimese, yes?
WIth that being said, it would seem plausible your regular expression is problematic...can you post that expression so we can have a look and perhaps offer some alternatives?
Vlad J. from the product team posted an article you might have a look at for insight about OpsMgr and it's support of regex.
Regular Expression Support in SCOM 2007
This is my expression
.*(Disconnecting)|(Connection timed out)|(RSLM Failure)|(Login failed)|(Could not create connection)|(connection is closed).*
It seems to work in the expressions tester.
I have tried many different variations of regular expressions. Currently I just put int the word "ERROR" and it still gives me the "Generic Event Mapper Module Failed Execution" alert over and over. It would appear to not be the regular expression causing me errors. Any other ideas?