locked
Audit Collection Reports Unavailable for Server 2008 DCs RRS feed

  • Question

  • I'm bringing up Audit Collection Services.  One RMS (functioning as the Audit Collector), one Data Warehouse (hosting both the ACS and DW databases).  We're monitoring less that 50 servers total, and the RMS box indicates it's got an average of around 20% CPU utilization when ACS is collecting data from three high-traffic Domain Controllers.  The DW server averages less than 15% utilization when functioning in the DW role as well as collecting ACS event data.  Neither the RMS or DW servers are virtualized.

    When I enable Audit Forwarding on a Server 2003 DC, I am able to review reports nearly immediately (testing by logging in and out of the DC via RDP).  However I am unable to generate any reports that contain data for any Server 2008 DCs that are forwarding events to the Audit Collection database.

    After seeing this condition initially and getting no traction on a solution, I broke down all ACS components and started from scratch.  I reinstalled ACS on the RMS, and successfully created a new Audit Collection database.  I then enabled Audit Collection on _only_ a Server 2008 DC.  Instantly I can see data being collected in the ACS DB, but it does not matter which report I try to run or what query parameters I use to generate the reports, I do not see any data coming from a Server 2008 DC.  If I then enable forwarding from a 2003 DC, the reports begin displaying data, but only from the 2003 server.

    Google yields no instances that appear close to this.  Am I missing something?  Many thanks in advance...

    - Jason
    Monday, March 16, 2009 11:03 PM

Answers