none
Exchange 2010 MP is not reporting alerts to SCOM

    Question

  • Hello, I have a Systems Center Operations Manager 2007 and I recently installed the Exchange 2010 MP as we are upgrading our environment from Exchange 2007 to 2010. The previous Exchange 2007 MP has always worked as expected. However, the Exchange 2010 MP does not seem to report any alerts. It does run the various exchange tests such as MAPI connectivity etc.. but no actual events are reported. We tested this by causing various malfunctions in our LAB such as databases being dismounted etc but no alerts are generated.

    As far as I know, we do have all the prerequisites in stalled. KB 974144 is installed on all Exchange 2010 boxes being monitored. The agents for SCOm have all been deployed , are run by the local system account, and show in a healthy state. The Agent prroxy setting is enabled. The Exchange monitoring Correlation service was set to automatic and started.

    We've tried uninstalling and reinstalling the MP as well as other troubleshooting steps such as re-applying the agents but nothing seems to get SCOM to retrieve the Exchange alerts. Any assistance would be greatly appreciated.

    Regards,
    Amit

    Friday, March 04, 2011 4:42 PM

Answers

  • You can override the severity of an alert/monitor.  However, with the Exchange 2010 MP you have to be careful because there are KHI monitors and Forensic Monitors.  Any change you make to one of these has to be replicated to the other.

    In regards to service monitoring, find the server you did this on, in the Exchange 2010 views.  Find the role that host this service.  Open health explorer and look to see if it's monitored.  If it is, look at the historical state changes.  Finally open the monitor and look at what it is configued to do (keep in mind there may be a KHI and Forensic, so you may have to do this in the authoring space instead - after you get the monitor name).


    Regards, Blake Email: mengotto<at>hotmail.com Blog: http://discussitnow.wordpress.com/
    • Marked as answer by Vivian Xing Friday, March 11, 2011 9:14 AM
    Wednesday, March 09, 2011 6:17 PM

All replies

  • Perhaps your Exchange environment is working really well and there is no need to alert. If you look at the Exchange 2010 views, are things "green"?
    This posting is provided "AS IS" with no warranties, and confers no rights. Use of included script samples are subject to the terms specified at http://www.microsoft.com/info/cpyright.htm
    Friday, March 04, 2011 11:26 PM
  • Did you test this in a lab first?  Bring down a non crit service, see if it's detected as being offline.  What does discovered inventory look like for E2K10 classes?
    Regards, Blake Email: mengotto<at>hotmail.com Blog: http://discussitnow.wordpress.com/
    Monday, March 07, 2011 5:44 AM
  • Hi, we tested SCOM alerts after the installation by performing various tests. I should point out this is a LAB environment so we can take things off like, at least exchange wise, as needed. For example, we dismounted various stores. Ideally we should at least be getting 9175 MAPI connectivity errors. Also, we have rebooted mailbox servers which should have reported DAG activity and CAS connectivity issue, etc..

    Tuesday, March 08, 2011 2:04 PM
  • Hi Blake, I should have pointed this out in my initial post, but this is in fact a LAB environment. We brought down both crit (if it was PROD) and non-cirt services, dismounted stores, rebooted servers, and no reporting was done.

    I'm not sure what you mean by the discovered inventory for the 2010 classes. I am well versed in Exchange but new to SCOM. Thanks for your help.

    Tuesday, March 08, 2011 2:06 PM
  • Hey everyone,

    Just to elaborate on my previous posts here is some more information regarding the issue:

    In my LAB, which is where the issue is located, I have 2 Mailbox servers configured in a DAG ad well as 2 servers with the CAS/HUB roles installed.

    SCOM does successfully run tests on Exchange 10 (test-owaconnectivity, etc...)

    SCOM does not, however, report any service or event type errors. For example, I rebooted one of My mailbox servers in order to force a DB failover in the case of an actual server failure. I recieved a 4087 service error stating "Failed to move active database 'database' from server 'server'" etc.. This error did not show as critical in SCOM. I also stopped the System Attendant on the Exchange MB server and no errors were generated stating that the service was down.

    Hope that helps to elabortate things,

    Thanks,
    Amit


    Amit B. Agarwal
    Wednesday, March 09, 2011 4:17 PM
  • Hi Blake, I should have pointed this out in my initial post, but this is in fact a LAB environment. We brought down both crit (if it was PROD) and non-cirt services, dismounted stores, rebooted servers, and no reporting was done.

    I'm not sure what you mean by the discovered inventory for the 2010 classes. I am well versed in Exchange but new to SCOM. Thanks for your help.


    If you open up the ops console, then select discovered inventory from the right hand pane, you should have an action that will let you change "target type".  From that screen you should be able to now look at each exchange 2010 class and find out what servers are hosting those roles.
    Regards, Blake Email: mengotto<at>hotmail.com Blog: http://discussitnow.wordpress.com/
    Wednesday, March 09, 2011 6:15 PM
  • You can override the severity of an alert/monitor.  However, with the Exchange 2010 MP you have to be careful because there are KHI monitors and Forensic Monitors.  Any change you make to one of these has to be replicated to the other.

    In regards to service monitoring, find the server you did this on, in the Exchange 2010 views.  Find the role that host this service.  Open health explorer and look to see if it's monitored.  If it is, look at the historical state changes.  Finally open the monitor and look at what it is configued to do (keep in mind there may be a KHI and Forensic, so you may have to do this in the authoring space instead - after you get the monitor name).


    Regards, Blake Email: mengotto<at>hotmail.com Blog: http://discussitnow.wordpress.com/
    • Marked as answer by Vivian Xing Friday, March 11, 2011 9:14 AM
    Wednesday, March 09, 2011 6:17 PM