Audit SCOM Overrides RRS feed

  • Question

  • Hi,
    Can I audit the Overrides on SCOM. eg: When someone create Override, can I report who created the override and when override is created and what was the old value.


    - Manickam A.
    Wednesday, August 12, 2009 11:00 PM


  • Hi Manickam,

    unfortunately there is no way of tracking changes in SCOM yet. As Graham allready said: Silect MP Studio is the only available solution today for this problem.
    BUT: MP Studio could track changes only, if you make them via this software and if you activated the tracking in the MP Studio options. But than you do not only have a change log of who made changes but as well what values have been changed.


    • Marked as answer by manickama Wednesday, August 19, 2009 11:29 PM
    Thursday, August 13, 2009 1:42 PM

All replies

  • You can report when override is created and what is new value with "Overrides" report from Generic Reports Library. But, AFAIK, you can't report who created an override and what was the old value.
    Thursday, August 13, 2009 4:00 AM
  • Silect Software offer a tool that will do the auditing for you but sadly I believe it will only audit changes made through their console so it is possible to bypass the process.

    You can also get a list of overrides via powershell:
    get-managementpack | get-override | format-list name,parameter,value

    And in OpsMgr 2007 R2, you can also see the overrides in the Authoring pane of the console.
    View OpsMgr tips and tricks at
    Thursday, August 13, 2009 7:46 AM
  • What auditing there was in 2005 was definitely not carried forward. This was stored in the database in MOM 2005 (and we had an MP to audit changes from here).and I checked the DB on SCOM back in beta and noticed that the field storing the user name was gone. Silect will create an audit trail, but only if changes are made in their product.

    No perfect world on this issue.

    Pete Zerger, MVP-OpsMgr and SCE |
    Thursday, August 13, 2009 1:57 PM
  • Thanks, is there any plan in future enable audit on who make the changes. Because it’s going to be critical, when we have more than one user/group has Opsmgr Admin privilege. Hope this feature should be out of box, than going to different tool. When a user modifies the MP, It’s easy to track who modify and it may be a matter of storing the info in DB.

    Thursday, August 13, 2009 3:52 PM