I'm trying to set up an alert-generating rule to generate alerts for specific syslog messsages, and am running into a bit of a wall. Perhaps someone else has gotten this working?

As a bit of background, I've configured one of my monitored Cisco devices (an ASA) to forward syslog messages to my RMS. I also have the xSNMP Syslog Alerts working, so I know that the RMS is, in fact, receiving syslog messages. (A nestat -an | findstr 514 also shows that the RMS is listening on UDP 514)

However, while the xSNMP Syslog Alerts look for syslog events by severity, I would like to search for specific messages, by looking for certain event #'s within the "message" parameter.

While I want to look for specific events, such as 733104 & 733105 (Possible Syn Flood attack), for this example/as a proof-of-concept I am looking for 106001, as those are presently being logged. In other words, when it's working, I'll know that it's working within a few minutes.

The goal is to be able to set up an Alert-Generating Syslog rule raising an alert for syslog messages where "facility" = 16, and "message" contains "106001".

A sample alert (from xSNMP alerts) looks like:

Facility: 16
Severity: 2
Priority: local0.critical
Timestamp: Sep 3 20:28:16

Message: Sep 03 2010 14:29:22 FW1 : %ASA-2-106001: Inbound TCP connection denied from 69.69.31.28/1199 to xxx.xxx.xxx.xxx/135 flags SYN on interface Internet

I've followed the instructions at both, with no luck:

http://contoso.se/blog/?p=158

and

http://support.microsoft.com/kb/942863/en-us

...which slightly differ (the first one has the rule targeted at the MS, the second has it targeted at an agent, if memory serves). I've also tried rules targeted at "xSNMP  Device" and "SNMP Network Device" to no avail.

Here's the rest of the steps I have taken in my rule attempts:

1. Configure my Cisco ASA to forward syslog messages to my RMS.
2. Authoring > Rules > New Rule
3. Rule Type = Alert Generating > Syslog (Alert)
4. Entered rule name & description
5. Rule category = Alert
6. Rule target (I've tried Root management server, agent, SNMP network device, xsnmp network device; should I be trying something else?)
7. Expression: "facility equals 16" (I decided to keep it simple and try to get everything, and then attempt to filter it down by a string with the messsage parameter; better more results than none, to begin with)
8. Set up the alert name, description, set severity to "Information" (for now, so any output doesn't get lost in the xSNMP alerts, which are all Critical & Warning).

The properties/configuration of the completed rule(s) shows the Data Source as "SyslogDS" and the Response as "Alert".

So far, no luck.

So, I guess the question is, how does one create an alert-generating syslog rule (that actually generates alerts)? I think the problem lies either within the targeting of the rule, or maybe the rule category?

Any insight appreciated!

Thanks!

I found a blog somewhere (wish I had the link to give them credit) that said that sometimes even though you use an elevated cmd prompt it doesn't always work.  It said to disable UAC, reboot, and try again.

As soon as I did that, everything worked perfectly.  No idea why, but it did.

We're trying to run step #5, but it is failing.  In the MSI install log we see:

...

(date) (time) Error: AddWebConfigAppSettingCA: Error: could not get MG ID from MG Server name

...

We see that error after the install stalls for almost exactly 20 minutes.

Any ideas?  We're trying to upgrade an install that is currently functional.

All the permissions seem to be fine.

As suggest, I try to run the script manually using the command line. The script complete sucessfully and return the expected XML.

The Mp containing the vbs is available here : http://pastebin.com/JL9KtQJm

Using the function LogScriptEvent(), I manage to figure out the call to oAPI.Return() hang when the propertybag is too big.

At first, I had done the installation with my account, which has all the access needed (even SA).  Everything went fine, but I noticed the update packages didn't get put into the agentmanagement folders.  I manually copied them in, but this didn't change anything (even after cycling the HS on the RMS and each MS).

Then I logged in as the action account, which is also local admin and SA.  Install went fine again, it DID copy the files into place, but still the agents don't show up in pending.

I manually updated two agents, and they show up just fine as having the CU2 update in the agent view.  But I can't get any of the other agents to show up in pending.  Am I going to have to resort to a 3rd party tool to push the update out?

This is my first post here and I'm seeking your collective SCOM know-how. I am a newbie with the software so Im sure what I am asking is easy to configure and probably somewhere within these forums so I apologize in advance.

I have been tasked with creating a notification via email (already figured out subscriptions and notification channels etc and am being alerted for other things) when a particular service is NOT running on our windows servers. I may apply this to other services in the future, but for right now, the service I am trying to monitor its runnign state is the Task Scheduler service.

Can anyone PLEASE guide me as to how to achieve this goal?  Any help and advice is most definitely appreciated!

Thanks

David

OpsMgr 2007 R2 CU2 rollup hotfix ships – and my experience ...

I have a request to monitor a few devices - datapower x150, apache httpd and IBM webshpere.

The application owners have sent us the MIB's. And we want to configure these into scom for alerting.

Any idea how we can get this done?

Thanks

http://www.avicode.com/AVIcodeOpsMgr2007/3/opsmgr2007features.htm

I've set up rules that monitor the application log for specific Events and this works fine. When an event is dropped in the Event Log, an Error is generated in SCOM. These events sometimes happen frequently and I've specified a Repeat Count to prevent the Alert Console from being flooded.

Now I have a customer request to only alert if the problem happens twice within a 5 minute time frame and I can't figure out how to do this (Monitors have a repeat setting with a counting mode, but lack the Repeat Count that prevents flooding).

How can I edit the rule or management pack to only alert if the problem occurs twice?

Thx