|
|
Re: Security Log Monitoring
Posted: Thu, Jun 25, 2009 12:01 PM :: Rank: 83 |
Author
|
|
|
Points: 40744
Level: System Center Expert |
Thank you for your rating!
|
Little stuck on step 2, have you disabled the whole monitor?
|
|
| Your Reports Help Protect the Community |
|
The community depends on each member to help keep Answers a safe and positive place. Do your part by using the form below to report Q&A that violates the Community Guidelines.
|
Additional Detail(optional)
|
Report Abuse |
|
|
|
Re: Security Log Monitoring
Posted: Thu, Jun 25, 2009 1:25 PM :: Rank: 63 |
Author
|
|
|
Points: 6866
Level: System Center Specialist |
Thank you for your rating!
|
Yes. disabled the whole monitor. But enabled it by creating an override just for the group which I had created. ..
Makes sense?
|
|
| Your Reports Help Protect the Community |
|
The community depends on each member to help keep Answers a safe and positive place. Do your part by using the form below to report Q&A that violates the Community Guidelines.
|
Additional Detail(optional)
|
Report Abuse |
|
|
|
Re: Security Log Monitoring
Posted: Thu, Jun 25, 2009 1:57 PM :: Rank: 77 |
Author
|
|
|
Points: 6866
Level: System Center Specialist |
Thank you for your rating!
|
OK.. Simons question did make me think on the disabled monitor.
What I had done was that I wanted this event to be monitored for only a bunch of servers.
I created a group for those servers. I disabled the monitor and created an override just for that group where the override settings were "True".
Well, I enabled the monitor for all the groups and deleted the override.. This worked.
But I still wonder that why if I disable a monitor and create an override for only a group, that would not work..
Thanks all for all your help so far..
|
|
| Your Reports Help Protect the Community |
|
The community depends on each member to help keep Answers a safe and positive place. Do your part by using the form below to report Q&A that violates the Community Guidelines.
|
Additional Detail(optional)
|
Report Abuse |
|
|
|
Re: Security Log Monitoring
Posted: Thu, Jun 25, 2009 9:13 PM :: Rank: 69 |
Author
|
|
|
Points: 6007
Level: System Center Specialist |
Thank you for your rating!
|
But I still wonder that why if I disable a monitor and create an override for only a group, that would not work.. Thanks all for all your help so far..
This probably falls under override precedence. You might try clicking the "Enforce" box for your Rule-Enable override. |
|
| Your Reports Help Protect the Community |
|
The community depends on each member to help keep Answers a safe and positive place. Do your part by using the form below to report Q&A that violates the Community Guidelines.
|
Additional Detail(optional)
|
Report Abuse |
|
|
|
Re: Security Log Monitoring
Posted: Fri, Jun 26, 2009 10:30 AM :: Rank: 54 |
Author
|
|
|
Points: 6866
Level: System Center Specialist |
Thank you for your rating!
|
Thanks Brian. So you mean to say, that I disable the alert, and then create and override where I enable it for a group and check the enforce rule?
Will try this and see if it works..
thx
|
|
| Your Reports Help Protect the Community |
|
The community depends on each member to help keep Answers a safe and positive place. Do your part by using the form below to report Q&A that violates the Community Guidelines.
|
Additional Detail(optional)
|
Report Abuse |
|
|
|
RE: Security Log Monitoring
Posted: Thu, Jul 02, 2009 1:27 AM :: Rank: 72 |
Author
|
|
|
Points: 6007
Level: System Center Specialist |
Thank you for your rating!
|
So you mean to say, that I disable the alert, and then create and override where I enable it for a group and check the enforce rule? Will try this and see if it works.. thx
I think you understand my meaning... You create a override to disable the rule/monitor for all classes of the target, then you create an override to enable the rule/monitor for a group or specific instance. If this doesn't work, then "enforcing" the override to enable will make sure it works. |
|
| Your Reports Help Protect the Community |
|
The community depends on each member to help keep Answers a safe and positive place. Do your part by using the form below to report Q&A that violates the Community Guidelines.
|
Additional Detail(optional)
|
Report Abuse |
|