locked
Microsoft.SystemCenter.DataWarehouse.PublishEventData RRS feed

  • Question

  • Hi Team,

    write action Microsoft.SystemCenter.DataWarehouse.PublishEventData not writing logfile events to DW from the targeted application server class agent, When I configure the target as SCOM management server data writing to the DW. 

    What setting need to be there to write the data into to DW from application server. Any permission issues? 

    Thursday, May 14, 2020 9:25 AM

Answers

  • Hi,
     
    Thanks for the update. I am glad that we find a method to resolve the issue, After reviewing "Rules that use Microsoft.SystemCenter.DataWarehouse.PublishEventData write action module", It seems most writeaction without RunAs will use Default as its RunAs. Here, I suggest to compare the two RunAsProfile to see if there’s any permission missing.
     
    Hope it can help.
     
    Best regards.
    Crystal

    Please remember to mark the replies as answers if they help.
    If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com.

    • Marked as answer by RatheeshAV Friday, May 15, 2020 2:07 PM
    Friday, May 15, 2020 2:05 AM

All replies

  • The agent never communicates directly with the DW, it sends its monitoring data to its Management Server which in turn writes data in the DW.

    Do you see any error message?

    Thursday, May 14, 2020 9:44 AM
  • no error message found. Once question 

    The current write action as below 

    <WriteAction ID="CollectEventOpsDB" TypeID="SC!Microsoft.SystemCenter.CollectEvent"  />
              <WriteAction ID="CollectEventDWDB" TypeID="MSDL!Microsoft.SystemCenter.DataWarehouse.PublishEventData"  > 

    If I add the runas profile and target to scom management server ? This will write to DW.

    Rule ID="abcd.LogfileTest.Rule2.XYZ.Log.Error" Target="abcd.LogfileTest.Class.XYZLOG.Servers" Enabled="true" ConfirmDelivery="false" Remotable="true" Priority="Normal" DiscardLevel="100">
            <Category>Custom</Category>
            <DataSources>
              <DataSource ID="DS" TypeID="SAL!System.ApplicationLog.GenericLog.FilteredEventProvider">
                <LogFileDirectory>E:\PQRS\Q_instance_2\logs</LogFileDirectory>
                <LogFilePattern>server.log</LogFilePattern>
                <LogIsUTF8>false</LogIsUTF8>
                <Expression>
                  <RegExExpression>
                    <ValueExpression>
                      <XPathQuery Type="String">Params/Param[1]</XPathQuery>
                    </ValueExpression>
                    <Operator>ContainsSubstring</Operator>
                    <Pattern>Unexpected</Pattern>
                  </RegExExpression>
                </Expression>
              </DataSource>
            </DataSources>
            <WriteActions>
             <WriteAction ID="CollectEventOpsDB" TypeID="SC!Microsoft.SystemCenter.CollectEvent" Target="SC!Microsoft.SystemCenter.RootManagementServer" RunAs="xyzprofile" />
              <WriteAction ID="CollectEventDWDB" TypeID="MSDL!Microsoft.SystemCenter.DataWarehouse.PublishEventData"  Target="SC!Microsoft.SystemCenter.RootManagementServer" RunAs="xyzprofile"/>
            </WriteActions>
          </Rule>

    Thursday, May 14, 2020 10:41 AM
  • That's very weird, there are litterally thousands of rules using that writeaction (you can see them in systemcenter.wiki : https://systemcenter.wiki/?ShowReferences&ElementName=Microsoft.SystemCenter.DataWarehouse.PublishEventData&RelationType=MemberModule&TargetType=Rule ), and none of them use a target nor a runas.

    Are you sure there are no error related to the datawarehouse in the operations manager event log, even in the SCOM Management Servers?

    Thursday, May 14, 2020 11:54 AM
  • Hi,
     
    Thanks for the update. I am glad that we find a method to resolve the issue, After reviewing "Rules that use Microsoft.SystemCenter.DataWarehouse.PublishEventData write action module", It seems most writeaction without RunAs will use Default as its RunAs. Here, I suggest to compare the two RunAsProfile to see if there’s any permission missing.
     
    Hope it can help.
     
    Best regards.
    Crystal

    Please remember to mark the replies as answers if they help.
    If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com.

    • Marked as answer by RatheeshAV Friday, May 15, 2020 2:07 PM
    Friday, May 15, 2020 2:05 AM