locked
Exchange 2010 server blue screened last night however we did not get any SCOM alerts. We need to get alerts when an server gets a BSOD. RRS feed

  • Question

  • Exchange 2010 server blue screened last night however we did not get any SCOM alerts. 

    We need to get alerts when an server gets a BSOD.

    Also from an exchange 2010 MP prespective is there a alert that need to be turned on?


    dsk

    Friday, March 9, 2012 10:32 PM

Answers

  • Hello,

    This is from System Center Core MP, you should get 2 alerts, (Health Service Heartbeat Failure) and (Computer Not Connected) at the time of this hang, this is based on the Heartbeat Agent/Server settings, which is by default (Agent: 60 seconds), (Server: Allow 3 missed heartbeats then Ping = 180 seconds)

    If the whole issue resolved before the 180 seconds you will not receive any alert.

    Hope this helps!

    Regards,
    Mazen

    • Marked as answer by Yog Li Tuesday, March 20, 2012 8:26 AM
    Saturday, March 10, 2012 8:37 AM
  • Like mazen says or when you have a notification delay of X mins and didnt get a notification it's bc the alert autoresolved before a X time has passed (u should see the alert in a closed alert view then).

    If u always want to get an alert (afterwards), you can create an alertrule of the "unexpected shutdown" eventlog message (source = eventlog in the system log).


    Rob Korving
    http://jama00.wordpress.com/


    • Edited by rob1974 Saturday, March 10, 2012 11:31 AM
    • Marked as answer by Yog Li Tuesday, March 20, 2012 8:26 AM
    Saturday, March 10, 2012 11:27 AM

All replies

  • Hello,

    This is from System Center Core MP, you should get 2 alerts, (Health Service Heartbeat Failure) and (Computer Not Connected) at the time of this hang, this is based on the Heartbeat Agent/Server settings, which is by default (Agent: 60 seconds), (Server: Allow 3 missed heartbeats then Ping = 180 seconds)

    If the whole issue resolved before the 180 seconds you will not receive any alert.

    Hope this helps!

    Regards,
    Mazen

    • Marked as answer by Yog Li Tuesday, March 20, 2012 8:26 AM
    Saturday, March 10, 2012 8:37 AM
  • Like mazen says or when you have a notification delay of X mins and didnt get a notification it's bc the alert autoresolved before a X time has passed (u should see the alert in a closed alert view then).

    If u always want to get an alert (afterwards), you can create an alertrule of the "unexpected shutdown" eventlog message (source = eventlog in the system log).


    Rob Korving
    http://jama00.wordpress.com/


    • Edited by rob1974 Saturday, March 10, 2012 11:31 AM
    • Marked as answer by Yog Li Tuesday, March 20, 2012 8:26 AM
    Saturday, March 10, 2012 11:27 AM
  • +1 with Rob in the afterwards suggestion.. and to complete the picture, the unexpected shutdown Event ID is 6008 on the System eventlog

    Regards,

    Mazen

    Saturday, March 10, 2012 11:35 AM