locked
Detecting restart events in SCOM RRS feed

  • Question

  • Hi,

    We have a problem detecting re-start events for Windows computers on SCOM.

    The default heart beat interval of 3 mins is long to detect a heart beat failure. Is there any script for deteting the restart events.

    I have tried creating a monitor which detects event ID 6005 from the system EventLog and which points to the Agent managed computer group.

    But im still unable to pick the re-start events.

    kindly advice.

     

    Thanks,

    Dhanraj

    Monday, March 28, 2011 11:58 AM

Answers

  • Hi.  I may not be reading it right, but you cannot target a rule/monitor to a group, "Agent Managed Computer Group" in this case.  Change the rule/monitor to target a class such as Windows Server (or similar).  We use event 6005 to detect restarts and have a rule targeted at Windows Server.


    Layne, 2011 Microsoft Community Contributor Recipient
    • Proposed as answer by Nicholas Li Wednesday, March 30, 2011 2:28 AM
    • Marked as answer by Nicholas Li Monday, April 4, 2011 1:47 AM
    Tuesday, March 29, 2011 3:12 PM
  •  

    Hi,

     

    Regarding targeting, please also refer to:

     

    Targeting Rules and Monitors

    http://blogs.technet.com/b/brianwren/archive/2007/08/22/targeting-rules-and-monitors.aspx

     

    Targetting

    http://systemcentersolutions.wordpress.com/2009/07/10/targetting/

    Please Note: Since the website is not hosted by Microsoft, the link may change without notice. Microsoft does not guarantee the accuracy of this information.

     

    In addition, please also see the following post which is about monitoring computer restart:

     

    PC shutdown/restart notification

    http://social.technet.microsoft.com/Forums/en-US/operationsmanagergeneral/thread/ff8ce5e9-a534-4224-b9e6-57a757b1e37a/

     

    Hope this helps.

     

    Thanks.


    Nicholas Li - MSFT
    Please remember to click “Mark as Answer” on the post that helps you, and to click “Unmark as Answer” if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.
    • Marked as answer by Nicholas Li Monday, April 4, 2011 1:47 AM
    Wednesday, March 30, 2011 2:37 AM
  • We have collection rules built into the Windows management packs that pick up restart events.  There is no need to create these collection workflows.  Just run an event report to see this data.
    HTH, Jonathan Almquist - MSFT
    • Marked as answer by Nicholas Li Monday, April 4, 2011 1:46 AM
    Wednesday, March 30, 2011 4:04 AM
  • This is not a good target, because an agent-managed computer could also be a *nix system.  *nix systems do not generate these events, but the MS would attempt to deliver this workflow to it anyway with this targeting and it wouldn't work.  If it's a Windows event, make sure you target instances that have Windows Computer base class somewhere in the class path.
    HTH, Jonathan Almquist - MSFT
    • Marked as answer by Nicholas Li Monday, April 4, 2011 1:46 AM
    Thursday, March 31, 2011 3:05 PM

All replies

  • Hi.  I may not be reading it right, but you cannot target a rule/monitor to a group, "Agent Managed Computer Group" in this case.  Change the rule/monitor to target a class such as Windows Server (or similar).  We use event 6005 to detect restarts and have a rule targeted at Windows Server.


    Layne, 2011 Microsoft Community Contributor Recipient
    • Proposed as answer by Nicholas Li Wednesday, March 30, 2011 2:28 AM
    • Marked as answer by Nicholas Li Monday, April 4, 2011 1:47 AM
    Tuesday, March 29, 2011 3:12 PM
  •  

    Hi,

     

    Regarding targeting, please also refer to:

     

    Targeting Rules and Monitors

    http://blogs.technet.com/b/brianwren/archive/2007/08/22/targeting-rules-and-monitors.aspx

     

    Targetting

    http://systemcentersolutions.wordpress.com/2009/07/10/targetting/

    Please Note: Since the website is not hosted by Microsoft, the link may change without notice. Microsoft does not guarantee the accuracy of this information.

     

    In addition, please also see the following post which is about monitoring computer restart:

     

    PC shutdown/restart notification

    http://social.technet.microsoft.com/Forums/en-US/operationsmanagergeneral/thread/ff8ce5e9-a534-4224-b9e6-57a757b1e37a/

     

    Hope this helps.

     

    Thanks.


    Nicholas Li - MSFT
    Please remember to click “Mark as Answer” on the post that helps you, and to click “Unmark as Answer” if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.
    • Marked as answer by Nicholas Li Monday, April 4, 2011 1:47 AM
    Wednesday, March 30, 2011 2:37 AM
  • We have collection rules built into the Windows management packs that pick up restart events.  There is no need to create these collection workflows.  Just run an event report to see this data.
    HTH, Jonathan Almquist - MSFT
    • Marked as answer by Nicholas Li Monday, April 4, 2011 1:46 AM
    Wednesday, March 30, 2011 4:04 AM
  • Hi ,

    Thanks Nicholas and Jonathan for ur replies. .

    This is what I did..

    I tried creating an event generating rule that checks the system event log for the event 6005 and directed it to the group of agent managed computers.

    I tested this on my test environment and it worked fine.

     

    Thursday, March 31, 2011 9:40 AM
  • This is not a good target, because an agent-managed computer could also be a *nix system.  *nix systems do not generate these events, but the MS would attempt to deliver this workflow to it anyway with this targeting and it wouldn't work.  If it's a Windows event, make sure you target instances that have Windows Computer base class somewhere in the class path.
    HTH, Jonathan Almquist - MSFT
    • Marked as answer by Nicholas Li Monday, April 4, 2011 1:46 AM
    Thursday, March 31, 2011 3:05 PM
  • Ok I'll direct it to the Windows Computer class... Thanks Jonathan. .
    Friday, April 1, 2011 10:48 AM