none
SCOM R2 Reports are empty RRS feed

  • Question

  • Dear All,
    I hope someone can help me on  my issue:
    I have successfully installed SCOM R2 on a server x64, I need now to view some report about Auditing but all of them generate 0 rows.
    I have followed the instructions about the enabling audit collection on all agents installed and I have followed too the instructions detailed on http://contoso.se/blog/?p=198.
    I have discovered that the eventlog named "Forwarded events" on my acs server is always empty.

    Have you some suggestion to get my reports full?

    Thanks to all for the help.

    Marco
    Wednesday, August 26, 2009 8:44 AM

Answers

  • Thanks Graham!

    I am just checking for this (in effect I cannot found this kind of event on the local target eventlog), so maybe the GPO was not enable by the Domain Administrator.

    I will follow up this issue soon with him and I will let you know about the progress.

    Many thanks again for your suggestions, they are very helpfully.

    Best Regards.

    Marco
    Wednesday, August 26, 2009 3:16 PM

All replies

  • Hi Marco

    So you have a Management Server that is configured as an ACS collector. When you enabled ACS on the agents, did you make sure that you set an override on the task (middle of the screen) to set the correct ACS Collector.

    If you look in the operations manager event log on the ACS collector, do you see any 4628 events (ACS Forwarder connected)?

    If you use SQL Management Studio to connect to the ACS database, is there any data in there - go to the OperationsManagerAC database, Tables, righ click one of the dbo.dtEvent_{GUID} tables and choose open table. Is there any data there?

    Cheers

    Graham



    View OpsMgr tips and tricks at http://systemcentersolutions.wordpress.com/
    Wednesday, August 26, 2009 11:18 AM
    Moderator
  • Hi Graham!

    First of all, many thanks for your help.

    Yes, I am sure I have selected the "ovverride" button when I choosed to activate the audit collection... furthermore I have filtered the operations manager event log and no 4628 events were logged.

    If I use SQL Management Studio, I can found a lot of table named dtEvent_{GUID} (I think there is a table for any single agent released, is it correct?) and I have executed the following query on all table:

    select

     

    *

    from

     

    dbo.dtEvent_0eff5e68_b167_4557_ab6d_a44446a3d999

    order

     

    by collectiontime desc

    I can found a lot of rows on all tables... the collectiontime value contains the yesterday date on many of this table.

    Any idea?

    Wednesday, August 26, 2009 12:11 PM
  • Hi Marco

    Sounds like you do have data in the ACS database - when you installed the ACS reports, did you get an error message?

    Cheers

    Graham
    View OpsMgr tips and tricks at http://systemcentersolutions.wordpress.com/
    Wednesday, August 26, 2009 12:45 PM
    Moderator
  • Hi Graham,

    I did not get any error during installation...
    Thanks,

    Marco
    Wednesday, August 26, 2009 12:48 PM
  • Hi Again ;-)

    Are you running the reports from the OpsMgr console or from SQL Reporting Services?

    If you are running the reports from the console, then try firing up Internet Explorer and going to http://<servername>\reports and run the reports from there. Do you get any data back?

    Cheers

    Graham


    View OpsMgr tips and tricks at http://systemcentersolutions.wordpress.com/
    Wednesday, August 26, 2009 1:06 PM
    Moderator
  • Hi Again Graham, and thanks for your help again :-)

    I have tried to submit some report using IE and browsing http:\\localhost\reports but I get the same empty result:

    Total rows: 0

    I have checked the data source and I see (I think so) a correct string on its connection: data source=SCOMR2X64;initial catalog=OperationsManagerAC;Integrated Security=SSPI

    Thanks

    Marco
    Wednesday, August 26, 2009 1:19 PM
  • Hmmm ... running out of options.

    The data source looks good. You have the relevant event tables (one per day). Do you have a test server that has an ACS Forwarder where you can clear the security log? That will generate an event that will definitely go into one of the reports.

    One thing to check in the Operations Manager console - in the view Microsoft Audit Collection Services, Collector, Event View, Do you see any events there? You should see 4628 (Forwarder connected) and 4629 (Forwarder disconnected) as well as other ACS events. Do you have anything in that view?

    Cheers

    Graham


    View OpsMgr tips and tricks at http://systemcentersolutions.wordpress.com/
    Wednesday, August 26, 2009 1:36 PM
    Moderator
  • Hi Graham,
    I have cleared the security log on a test server where I deployed the agent some days ago but no rows are logged on any reports.

    I have also checked the Event View you wrote me and I cannot found any 4628 or 4629 events. There a lot of 4616 (Connection to database established) and some 4660 (Failure: Certificate for SSL based authentication could not be found. SSL authentication will be disabled) after every 4609 (AdtServer is starting up).

    Does they help your suggestions?

    Thanks again!

    Marco

    Wednesday, August 26, 2009 1:47 PM
  • Have you configured any noise filters at the collector?

    In the OpsMgr console, in the view Microsoft Audit Collection Services, Forwarder, are all the forwarders listed in the state view? Amy errors in the Event View?

    Cheers

    Graham
    View OpsMgr tips and tricks at http://systemcentersolutions.wordpress.com/
    Wednesday, August 26, 2009 1:55 PM
    Moderator
  • Hi Graham,

    thanks to your help I have discovered that on the Forwarder state view were logged a lot of 4369 event (Forwarder unsuccessfully tried to connect to the following collector), so I have found the windows firewall enabled and I provided to disable it.

    After this I see a lot of 4368 events (Forwarder successfully connected to the following collector), but even if I wait some minutes my reports (for example Usage_-_User_Logon) are empty.

    I tried to submit other kind of report and by now I get some result on some of them...


    Any other suggestion?

    Thanks!

    Marco
    Wednesday, August 26, 2009 2:34 PM
  • Hi Marco

    You might need to work backwards on some reports - find out what event ids they are looking for and making sure they do appear on a forwarder.

    It might be worth a double check on the audit policy settings to make sure that auditing of logon \ logoff is enabled. Sometimes it isn't due to the amount of data that it can create through the security log.

    Cheers

    Graham
    View OpsMgr tips and tricks at http://systemcentersolutions.wordpress.com/
    Wednesday, August 26, 2009 3:04 PM
    Moderator
  • Thanks Graham!

    I am just checking for this (in effect I cannot found this kind of event on the local target eventlog), so maybe the GPO was not enable by the Domain Administrator.

    I will follow up this issue soon with him and I will let you know about the progress.

    Many thanks again for your suggestions, they are very helpfully.

    Best Regards.

    Marco
    Wednesday, August 26, 2009 3:16 PM
  • Hi Marco

    Just a quick check on how this is going - let us know if we can do any more to assist.

    Cheers

    Graham
    View OpsMgr tips and tricks at http://systemcentersolutions.wordpress.com/
    Sunday, August 30, 2009 4:03 PM
    Moderator
  • Hi Graham,
    thanks to your help we resolved our problem!

    Thanks again and Best Regards.

    Marco
    Wednesday, September 2, 2009 7:56 AM
  • No problem - glad to be of assistance. I'll close the thread now if that is ok with you.

    Cheers

    Graham
    View OpsMgr tips and tricks at http://systemcentersolutions.wordpress.com/
    Wednesday, September 2, 2009 8:51 AM
    Moderator
  • Just Wanted to say thanks, this article was of great help to me in fixing the same issue! ;-)
    Wednesday, February 2, 2011 9:58 AM