How do I configure SCOM to send alert on specific event on AD-server?
Hi,
I have 3 windows 2003 servers running a Windows 2003 domain and I have System Center Operation Manager 2007 R2 version 6.1.7221.0.
I would like to setup an alert, so if a specific eventlog occur on either of the AD-servers, I would like SCOM to generate an alert on it, and to send an email to a specific email adress.
The event I would like to monitor for, is the following:
Event Type: Error
Event Source: NETLOGON
Event Category: None
Event ID: 5805
Date: 01-06-2011
Time: 11:37:10
User: N/A
Computer: ADS1
Description:
The session setup from the computer P06077 failed to authenticate. The following error occurred:
Access is denied.
For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 22 00 00 c0 "..À
Kind regards,
Carl-Marius
June 10th, 2011 4:59am
Hi,
Check this blogposts for details:
http://blogs.technet.com/b/kevinholman/archive/2008/04/22/using-event-description-as-criteria-for-a-rule.aspx
http://blogs.technet.com/b/kevinholman/archive/2009/02/25/authoring-rules-for-windows-2008-events-and-how-to-cheat.aspx
http://OpsMgr.ru/
Free Windows Admin Tool Kit Click here and download it now
June 10th, 2011 5:05am
Hi Alexey,
What should I do without your help! :)
Thank you for your links!, I will use these as inspiration.
Kind regards,
Carl-Marius
June 10th, 2011 5:33am