locked
LDAP Search Time is above configured threshold RRS feed

  • Question

  • Hi,

    I got the following alert from SCOM on a particular server every 5 min. The funny thing is I only got a "close" and none "open" alert. Anybody can shine some light?

    Subject: Alert: LDAP Search Time is above configured threshold Priority: 1 Severity: 2 Resolution state: Closed

    Alert: LDAP Search Time is above configured threshold
    Source: Information Store
    Path: servername.domain.com;ServerName
    Last modified by: System
    Last modified time: 5/3/2011 5:35:33 PM
    Alert description: The LDAP Search Time is above configured threshold.  The current value is 8

    Alert view link: http://
    Notification subscription ID generating this message:


    Desmond Tan http://sgwindowsgroup.org/blogs/desmond/

    • Edited by DesmondTan Wednesday, May 4, 2011 8:45 AM Change title
    Wednesday, May 4, 2011 8:22 AM

Answers

  • you can't other than: disable the monitor and recreate the monitor based on the consecutive samples monitor type. But before you do i'd collect and check the ldap search time counter and  check if it's gonna be helpful to change or a threshold value change would do.
    Rob Korving
    http://jama00.wordpress.com/
    • Marked as answer by Nicholas Li Friday, May 13, 2011 9:58 AM
    Thursday, May 5, 2011 4:34 PM
  •  

    Hi,

     

    I think you may find the source monitor or rule via the alert details. Regarding the LDAP Search Time Monitor, I found the following information:

     

    Monitors Disabled by Default

    http://technet.microsoft.com/en-us/library/dd772513.aspx

    Please see “Common LDAP Search Time Monitor”.

     

    LDAP Search Time Monitor

    http://mpwiki.viacode.com/default.aspx?g=posts&t=3708

    Please Note: Since the website is not hosted by Microsoft, the link may change without notice. Microsoft does not guarantee the accuracy of this information.

     

    I also think you can try some adjustments with overrides:

     

    How to Monitor Using Overrides

    http://technet.microsoft.com/en-us/library/bb309719.aspx

     

    Best practices to use when you configure overrides in System Center Operations Manager 2007

    http://support.microsoft.com/kb/943239

     

    Hope this helps.

     

    Thanks.

    Nicholas Li - MSFT
    Please remember to click “Mark as Answer” on the post that helps you, and to click “Unmark as Answer” if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.

    • Marked as answer by Nicholas Li Friday, May 13, 2011 9:58 AM
    Friday, May 6, 2011 5:18 AM

All replies

  • Hi

    If you look at the alert details (Alert History and Alert Context tabs), are there any time sync issues? Is the time the alert get closed before the time the alert is generated?

    Cheers

    Graham


    View OpsMgr tips and tricks at http://systemcentersolutions.wordpress.com/
    Wednesday, May 4, 2011 8:30 AM
  • Hi Graham,

    Where can I find that under SCOM administration console? Btw, I'm using SCOM 2007 R2.

    Cheers,

    Desmond


    Desmond Tan http://sgwindowsgroup.org/blogs/desmond/
    Wednesday, May 4, 2011 8:44 AM
  • Hi Desmond

    In the OpsMgr console, under monitoring, create an alert view for closed alerts (resolution state = 255).

    Then, in this view, (monitoring, closed alerts), you can investigate the details of the closed alerts.

    Cheers

    Graham 


    View OpsMgr tips and tricks at http://systemcentersolutions.wordpress.com/
    Wednesday, May 4, 2011 11:28 AM
  • There's a monitor called "LDAP Search Time Monitor" which generates the alerts. Basically it average the ldap search times over 5 samples and takes 1 sample every 5 minutes. When the average over 5 samples is above 50 it will generate an alert.

    I really think this monitor type is faulty, it will generate unnecessary alerts and it can generate a state change (and raise/close an alert) every sample (moving average, evaluting the threshold for the latest 5 samples every time a new sample is taken). Also it would make more sense to change this to a 5 consecutive sample over threshold monitor so sample values of 1000000,0,0,0,0 don't give an alert (just a spike in which your not really interested).

    All this doesn't help you at all of course. if you really have a lot of this alerts, but no complaining users about performance i'd take a baseline of the ldap search time monitor and set a new value for threshold or just disable the monitor when you will never take any action on this anyway.


    Rob Korving
    http://jama00.wordpress.com/

    Wednesday, May 4, 2011 2:27 PM
  • Hi Graham,

    The time is fine. all alert is close in less than 5sec from the alert created time.

     

    Hi Rob,

    I do agree with you. Could you share with me how I can set the monitor to tave consecutive sample instate of average over 5 sample?

     

    Regard
    Desmond


    Desmond Tan http://sgwindowsgroup.org/blogs/desmond/
    Thursday, May 5, 2011 4:41 AM
  • you can't other than: disable the monitor and recreate the monitor based on the consecutive samples monitor type. But before you do i'd collect and check the ldap search time counter and  check if it's gonna be helpful to change or a threshold value change would do.
    Rob Korving
    http://jama00.wordpress.com/
    • Marked as answer by Nicholas Li Friday, May 13, 2011 9:58 AM
    Thursday, May 5, 2011 4:34 PM
  •  

    Hi,

     

    I think you may find the source monitor or rule via the alert details. Regarding the LDAP Search Time Monitor, I found the following information:

     

    Monitors Disabled by Default

    http://technet.microsoft.com/en-us/library/dd772513.aspx

    Please see “Common LDAP Search Time Monitor”.

     

    LDAP Search Time Monitor

    http://mpwiki.viacode.com/default.aspx?g=posts&t=3708

    Please Note: Since the website is not hosted by Microsoft, the link may change without notice. Microsoft does not guarantee the accuracy of this information.

     

    I also think you can try some adjustments with overrides:

     

    How to Monitor Using Overrides

    http://technet.microsoft.com/en-us/library/bb309719.aspx

     

    Best practices to use when you configure overrides in System Center Operations Manager 2007

    http://support.microsoft.com/kb/943239

     

    Hope this helps.

     

    Thanks.

    Nicholas Li - MSFT
    Please remember to click “Mark as Answer” on the post that helps you, and to click “Unmark as Answer” if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.

    • Marked as answer by Nicholas Li Friday, May 13, 2011 9:58 AM
    Friday, May 6, 2011 5:18 AM