UPDATE! The community will be go into read-only on April 19, 8am Pacific in preparation for migration on April 21. Read more.
UPDATE! The community will be go into read-only on April 19, 8am Pacific in preparation for migration on April 21.Read more.
Absent Member.
Absent Member.
743 views

Interpereting SCOM 2007 events

Jump to solution

I've recently installed a SCOM connector (2007), but most of the events that come through don't appear to be useful. I don't have any aggregation going on, but the data populated in any field doesn't seem relevant. For instance, if SCOM was reporting low disk space  on a server, I do not see that message anywhere. Instead I see a lot of things that look similar to this (name field):

Microsoft.Windows.DNSServer.Library.Server.Collect.ScriptTraceEvents

Microsoft.SystemCenter. RegistryProbeModule.EventCollection

SMSv4_Status__Message_Monitoring_1_Rule

I would exepct to see those elaborated on in other fields, but that seems to be as specfic as it gets. The "Message" field has things like

"[B@11b30593)" and appears to be unique for each name, even if the name is the same.

Am I missing something in the mapping or something else? I'm having trouble seeing why getting any of these events would be considered useful.

thanks

Labels (2)
0 Likes
1 Solution

Accepted Solutions
Absent Member.
Absent Member.

it looks like a fragment of a flex connector configuration file (just parser expression part) that is placed to the folder

%CONNECTOR%\current\user\agent\fcp\momng_db

View solution in original post

0 Likes
5 Replies
Absent Member.
Absent Member.

From my experience the MOM/SCOM connector does not work properly with the SCOM 2007. We had the same issue and after very extensive work with ArcSight support we got only partial workaround (parser override).

0 Likes
Absent Member.
Absent Member.

Could you share some details about the parser override? I'm not entirely sure what that is or how to implement it? I'm guessing it's forcing a custom flex connector over the one built into the SCOM 2007 connector?

0 Likes
Absent Member.
Absent Member.

it looks like a fragment of a flex connector configuration file (just parser expression part) that is placed to the folder

%CONNECTOR%\current\user\agent\fcp\momng_db

View solution in original post

0 Likes
Absent Member.
Absent Member.

Thank you, I've opened a ticket with Arcsight and used the information you provided.

0 Likes
Absent Member.
Absent Member.

Hi

We are also facing a similar issue.

The SCOM version is 2012.We do not also get the description or message anywhere.

The data seems irrelevant without the message field.

https://skydrive.live.com/view.aspx/Public/OpsMgr%5E_EventIDs.xlsx?cid=aaf797a1484e6150&sc=documents

It would if anyone could provide some info on how to get the description.

Tnx.

Rony.

0 Likes
The opinions expressed above are the personal opinions of the authors, not of Micro Focus. By using this site, you accept the Terms of Use and Rules of Participation. Certain versions of content ("Material") accessible here may contain branding from Hewlett-Packard Company (now HP Inc.) and Hewlett Packard Enterprise Company. As of September 1, 2017, the Material is now offered by Micro Focus, a separately owned and operated company. Any reference to the HP and Hewlett Packard Enterprise/HPE marks is historical in nature, and the HP and Hewlett Packard Enterprise/HPE marks are the property of their respective owners.