locked
Server Reboot - Unexpected Server reboot using Scom 2007 RRS feed

  • Question

  • Hi i have just implemented Scom 2007 to monitor a few of our servers and would really like to have an alert to know when a server has rebooted.. We do have scheduled reboots every week for windows updates, so we do know about these,   but for other times incase of failure etc I would like to know what is the best way to set up a monitor for this please

    Thanks in advance


    DJ Jacklin
    Wednesday, March 9, 2011 11:24 AM

Answers

  • Hi.  While you can certainly create a monitor for this, I would consider using a rule, especially since your monitor is a manual reset.  If you forget to manually reset the health of the monitor, the alert will never fire again until the state goes healthy -> unhealthy again.

    We use rules for these kinds of things, and have them setup as follows:

    EventID equals 6005
    EventSource equals EventLog

    That's all, plus you never have to reset health.


    Layne, 2011 Microsoft Community Contributor Recipient
    • Marked as answer by Yog Li Friday, March 18, 2011 10:27 AM
    Thursday, March 10, 2011 4:42 PM
  • Yes you are right, a rule is the better solution.
    Have a look at: http://www.scapaot.de
    • Marked as answer by DJ Jacklin Thursday, March 24, 2011 2:30 PM
    Thursday, March 10, 2011 10:33 PM
  • HI Thank you for all the comments and responses,

    I have now set this and it is reporting fine, i set this by the heartbeat monitor to send an alert via an overide.

    Thanks again


    DJ Jacklin
    • Marked as answer by DJ Jacklin Thursday, March 24, 2011 2:30 PM
    Thursday, March 24, 2011 2:30 PM

All replies

  • There are many posibilities to monitor the server avaiability and the restart.

    For example, build a new monitor for the eventlog and monitor the system eventlog for EventID 6005.
    This is the entry, that the eventlog was started.

    In normal case the eventlog is only startet on a reboot.
    The rare cases where the eventlog is started manuelly could be ignored or the better way, the server could be put into maintaince before...

    Kind regards,

    benedikt


    Have a look at: http://www.scapaot.de
    • Marked as answer by Blake Mengotto Wednesday, March 9, 2011 6:54 PM
    • Unmarked as answer by DJ Jacklin Thursday, March 10, 2011 3:49 PM
    • Unmarked as answer by DJ Jacklin Thursday, March 10, 2011 3:49 PM
    Wednesday, March 9, 2011 1:58 PM
  • HI,

    Thanks for the reply's.

    I have tried the event log ID but im not convinced its working correctly,

    I have set the Monitor up as follows :

    Availabilty, Create Monitor, Unit Monitor, Windows Event, Simple Event Detecton, Manual Reset,  Then ive set the Event ID to 6005 but this is where im getting stuck,   its the event source im not sure on,   ive set the value to " ID" it then adds "$Target/Id$" into the value tab..

     Im leaving the Event Raised = Warning and then  maunal reset as = Healthy..

    For testing purposes I've added this to Windows Client and got it applied to an agent XP machine..   After serveral power downs and reboots, im still not recieving an email alert to let me know this service has been started, At first i though the XP machine may not be monitored correctly but i added a simple print spooler monitor, stopped and started this and the alerts came through so im happy this is being monitored now and the email alerts are working as they should be..

    Does anyone have any further help for me, Am i setting this up correctly ?

    Thanks again in advance..

     


    DJ Jacklin
    Thursday, March 10, 2011 9:26 AM
  • Hi.  While you can certainly create a monitor for this, I would consider using a rule, especially since your monitor is a manual reset.  If you forget to manually reset the health of the monitor, the alert will never fire again until the state goes healthy -> unhealthy again.

    We use rules for these kinds of things, and have them setup as follows:

    EventID equals 6005
    EventSource equals EventLog

    That's all, plus you never have to reset health.


    Layne, 2011 Microsoft Community Contributor Recipient
    • Marked as answer by Yog Li Friday, March 18, 2011 10:27 AM
    Thursday, March 10, 2011 4:42 PM
  • Yes you are right, a rule is the better solution.
    Have a look at: http://www.scapaot.de
    • Marked as answer by DJ Jacklin Thursday, March 24, 2011 2:30 PM
    Thursday, March 10, 2011 10:33 PM
  • HI Thank you for all the comments and responses,

    I have now set this and it is reporting fine, i set this by the heartbeat monitor to send an alert via an overide.

    Thanks again


    DJ Jacklin
    • Marked as answer by DJ Jacklin Thursday, March 24, 2011 2:30 PM
    Thursday, March 24, 2011 2:30 PM