Generate an alert is Server has rebooted
Based on my research I appreciate there are SCOM Health state monitors and ICMP Ping Monitors, but can anyone please put me in the right direction to setup a monitor or rule to setup the followingSetup an alert if:- Server has rebooted- Server in unknown state or has shutdown unexpectedly- Network interfaces monitorAny guidance would be appreciated
January 8th, 2010 2:14pm

I think the best approach would be to find an event that is generated when one of these things happens.You would then create an alert generating event rule in the authoring pane of the console.Matt.Matt White ( http://systemcenterblog.hardac.co.uk/ )
Free Windows Admin Tool Kit Click here and download it now
January 8th, 2010 2:26pm

Check out Matt Goedtel's Extended Windows Server OS Management Pack which adds in alerts for unexpected server restarts etc. Works well.
January 8th, 2010 3:18pm

Event ID 6008 in the system log (at least in Win 2K3, I think it's the same in 2K8) is the unexpected shutdown event. Event id 6005 from source eventlog in the system log says that the eventlog service has started and is a good indicator of a reboot."Fear disturbs your concentration"
Free Windows Admin Tool Kit Click here and download it now
January 8th, 2010 7:46pm

Cheers for all the feedback the events ID 6005 works really well for server rebooting
January 11th, 2010 6:22pm

HiIf Andy has answered the question to your satisfaction then I'll close the thread. Please feel free to reopen if you need more information and we'll continue to assist.ThanksGrahamView OpsMgr tips and tricks at http://systemcentersolutions.wordpress.com/
Free Windows Admin Tool Kit Click here and download it now
January 11th, 2010 6:45pm

HI all I have created a Rule for server restarted with System Event ID 6005. I got the server restart alert from all server perfectly. but the problem is that 2 days before i got the 25 server restart alert from same server, when i have restart the server. Second problem is that i got the alert at time when my server is not restart. Please, help me Mahesh Kumar-MCTS Microsoft Management services
May 13th, 2010 8:24am

Did you set this up as a monitor or a rule?"Fear disturbs your concentration"
Free Windows Admin Tool Kit Click here and download it now
May 13th, 2010 7:15pm

I have set this as a Rule.Mahesh Kumar-MCTS Microsoft Management services
May 14th, 2010 9:08am

Is the SCOM agent healthy and reporting OK? And are you sure you have the rule targeted correctly?"Fear disturbs your concentration"
Free Windows Admin Tool Kit Click here and download it now
May 18th, 2010 11:54pm

I set a monitor for Event ID 6008 for the System log to monitor unexpected server shutdowns. When I artificialy created this event I got the alert in SCOM as expected. When I did a real like test (reset the virtual server) the Event ID 6008 was there in event viewer but not raised as an alert in SCOM. Im assuming that the event is written before the SCOM agent has started up and so it doesnt know about it. Either i'm doing something wrong or this method doesnt work reliably, Cheers
August 12th, 2011 8:55am

If you crated a monitor, you did it wrong. A monitor is "state-based" like a hard drive being over or under 90% full. You should have created a rule. A rule (among other things) alerts when a specific event happens (like an event in the event log)."Fear disturbs your concentration"
Free Windows Admin Tool Kit Click here and download it now
August 20th, 2011 10:23am

This topic is archived. No further replies will be accepted.

Other recent topics Other recent topics