Sorry team first for my confusion on very some basic SCOM concepts... still on 07R2 latest CU for now, will have side by side migration 12 in a couple weeks.
1. Exchange team complained that Microsoft Exchange File Distribution service (MSExchangeDFS) stopped but no alert was sent. Shouldn't this be captured in Windows Event Viewer, then alert is sent from the Warning or Critical subscriptions for Exchange servers? I then searched for all enabled/disabled Rules and Monitors for this specific service but didn't find any, so I followed this link http://technet.microsoft.com/en-us/library/bb381240.aspx to create a unit monitor for this specific service and create an alert subscription for this but still receiving no alerts. My guess is although it is easy to set, I could be confused with different criteria to select for Monitoring Target of Class or Group, default Priority/Severity but it could be changed, etc... generally I leave it mostly default unless having to change such as saving to custom MP, MSExchangeDFS service specifically for monitoring. 2. AD team wants to receive alert for Event ID: 448, Source: NTDS ISAM, Level: Error, Log Name: Directory Service, my similar confusion to item 1 above is shouldn't the alert being sent from the Warning/Critical subscriptions for AD servers? Then I searched for all rules/monitors and there's no 448 related so similarly, I create a custom unit monitor for this specific Windows Event ID 448 and tie to the alert subscription but still no alert sent. 3. Both item 1 and 2 above, I created the alert subscription based on New (0) resolution state, my understanding is it is only sending the alert one time only when the issue first occur which is what support teams want, but since the above 2 items still haven't sent the alert and the issues are not resolved yet, I change the alert subscription resolution state to "Not equals 255" (some folks out there use this) hoping it sends the alert but still don't, so I'm still confused with what's the same/difference of available options New (0), Notified (10), Closed (255) or Not Equals to 255, etc... Any clarification you may have for me is greatly appreciated.... Cheers & Best Regards, | [email protected]<mailto:[email protected]> |È1.630.730.1003 | [cid:[email protected]] Information Systems & Services LEGAL DISCLAIMER This email and any attachments are confidential and may also be privileged. If you are not the named recipient, or have otherwise received this communication in error, please delete it from your inbox, notify the sender immediately, and do not disclose the contents to any other person or use them for any purpose, or store them in any medium. Thank you for your cooperation. *** Confidentiality Notice: This e-mail, including any associated or attached files, is intended solely for the individual or entity to which it is addressed. This e-mail is confidential and may well also be legally privileged. If you have received it in error, you are on notice of its status. Please notify the sender immediately by reply e-mail and then delete this message from your system. Please do not copy it or use it for any purposes, or disclose its contents to any other person. This email comes from a division of the Invensys Group, owned by Invensys plc, which is a company registered in England and Wales with its registered office at 3rd Floor, 40 Grosvenor Place, London, SW1X 7AW (Registered number 166023). For a list of European legal entities within the Invensys Group, please select the Legal Entities link at invensys.com. You may contact Invensys plc on +44 (0)20 3155 1200 or e-mail [email protected]. This e-mail and any attachments thereto may be subject to the terms of any agreements between Invensys (and/or its subsidiaries and affiliates) and the recipient (and/or its subsidiaries and affiliates).
<<inline: image001.jpg>>
