Monday, July 16, 2012 9:39 PM
Running SCOM 2012 with CU1, Windows Server and AD MPs installed.
I'm wondering if there's a way to override the Collection rule for Service or Driver Failed to Start events?
I have a service that fails on every server several times a day and is owned by a separate product support group who don't have a real fix for the issue. It isn't affecting the server performance and it almost seems like a false positive.
Is there any way I can tune out just that service from the rule? It looks to be all or nothing when I go into Authoring.
Tuesday, July 17, 2012 5:58 AMModerator
You can only make changes that have been exposed as overrides as the rule is in a sealed management pack.
It looks for a variety of event ids (a range within 7000 -> 7041) with Event Source service control manager. The only override though is enable \ disable.
Your only solution would be to disable this rule and create your own identical rule tweaked to exclude the service that you didn't want.
- Marked As Answer by Nicholas LiMicrosoft Contingent Staff, Moderator Thursday, July 26, 2012 1:37 AM