How to create alarm for failover cluster server event – Cluster group online/offline

Forum: Operations Manager4
Viewing 11 posts - 1 through 11 (of 11 total)
  • #91491

    Jelena L
    Participant

    I have oracle servers in failover cluster, and want to get alert when Resource Cluster Group becomes offline/online (Windows System Events IDs 1204/1201). Event ID 1204 (group offline) comes before ID 1201 (group online).

    I tried to create Unit Monitor – Windows Simple Event Detection, and put Unhealthy expression: (ID: 1204)and(source: Clussvc) and Helathy Expression: (ID: 1201)and(source: Clussvc),
    to generate alarm (and e-mail also) if ID 1204 appearas, and to close alert when ID 1201 appears.

    But, SCOM detect first event 1204 on (for example, server APP1), and generate alert, and expect event 1201 on SAME server, but event ID appears on APP2 (Cluster group is now online on this server). And,I still have open Alert, although problem doesn’t exist, and another node – APP2 is online and working.

    What to choose as Monitoring target?

    #91497

    ARentsch
    Participant

    Why not use the Windows Cluster MP?

    #91498

    Jelena L
    Participant

    I already use Microsoft Windows Cluster MP, but it shows this as Events (information about IDs 1204 and 1201).

    But, I want to get alert, or e-mail at least, about this event.

    When I checked in Properties of this events, in Monitoring console, I saw that this events are collected by rule: ‘Event Collection for Cluster Server’, whit Monitoring Target: Monitoring Cluster Service.

    I tried to create subscription to send me e-mail when detect this rule, but not getting anything?

    #91500

    Tao Yang
    Participant

    I implemented this at work. when every time a cluster resource has failed over to the other node, there’s an event logged in the cluster event log. you can simply setup a rule to detect this event and generate alert. Sorry I can’t remember the event ID on top of my head.

    #91502

    Andreas Zuckerhut
    Participant

    What is the target of the collection rule? Use that one for your alerting rule and see if that works out for you.

    #91503

    Jelena L
    Participant

    For me is important to get email, alert is not necessary.

    Target of collection rule is ”Monitoring Cluster Service”, and I don’t get mail.

    #91505

    Andreas Zuckerhut
    Participant

    Subscriptions are only available for alerts, not for collections.

    #91506

    Jelena L
    Participant

    Thanks! It means if I create rule for this event, I can get email only if it is alerting rule? In that case, I have to close alert manually.

    #91508

    Jelena L
    Participant

    Thanks again, this works! I got email, and alert in console.

    Is there any way to get this with monitors, in order to get alerts auto-closed (what I can’t get with rules)?

    #91531

    Jelena L
    Participant

    Event reset would be best resolution, but problem is:

    if I put as unhealthy state condition: (ID 1204 (group offline) + source:Clussvc), and as healthy state condition: (ID 1201 (group online) + source:Clussvc).

    It seems that SCOM detects event ID 1204 on for example, NODE1, and doesn’t auto close it because event ID is generated on NODE2.

    Is there any option that unit monitor watch cluster, without source computer name investigating? () option maybe?

    #91539

    Jelena L
    Participant

    In my previous post, somehow it is deleted what I have written in brackets, – will help maybe adding ”AllowProxying” option in XML file which is related to monitor?

Viewing 11 posts - 1 through 11 (of 11 total)

You must be logged in to reply to this topic.