[SCOM] How to Override Existing Rules

From the existing post on [SCOM] Create Monitor Based on Event Viewer Log, we can see this request  to monitor few custom applications wherein they wanted to monitor Event IDs. As per configuration on [SCOM] Create Monitor Based on Event Viewer Log, SCOM will monitor all the servers. So in this post, I will show how to override the rules and monitor just one particular server. Below shows the steps;

Step 1: Open SCOM Management Console and go to Authoring tab

Step 2: On Authoring, go to Rules and search rules name. E.g. Event Viewer Monitoring



Step 3: Right click on Event Viewer Monitoring rules, and choose Overriders > Override the Rule > For a specific object of class: Windows Computer


Step 4: Choose the object you want to override and click OK. E.g. ICG-AP-SQL01.INFRONTAPAC.local


Step 5: On Override Properties, click on Override as below;



Step 6: Click Apply and OK.

Configuration for Override Rules completed. If you have any issue on this, please email to me. I will help you as soon as possible. Thanks!

[POWERSHELL] How to Simulate Error on Event Viewer Logs

Hye all, today I will share with you guys how to simulate error on Event Logs. If you works in an Enterprise level, you most likely have some type of central monitoring system that collect errors from your event logs such as System Center Operation Manager.

To begin this, let’s open Windows PowerShell console and see what cmdlets are available that deal with the event logs;

Step 1:  Open the Windows PowerShell console and type “get-command –Name *eventlog”. This command will search all the command contain work “eventlog”. To simulate the error, we need to use Write-EventLog command.

Command: get-command –Name *eventlog



Step 2: To simulate the Error EventLog, please follow below command;

Command: Write-Eventlog –LogName Application –Source “Firdaus” –EntryType Error –EventID 8888 Message “for testing only”

As you can see, the Write-EventLog now return with no error. And if we check the event log entries, we should now see out test message.


Step 3: Open Event Viewer and verify the Error EventLog



Event Properties details of the message:



As you can see, the source is now populated with “Firdaus”. You can also use this to create an event log specifically for your script or to create a source for event logs other than the Application log.

[SCOM] Override Storage Threshold Monitoring for AS/400 ASP Monitor

It is always important to understand how AS/400 server workload are doing. Getting visibility into our systems allows us to proactively deal with future issues. As an example, monitoring can let us know that we are running out of disk space on one of our volumes so we can prepare all the necessary things before it happens.

One of our customer received an alert as below from their SCOM monitoring system.

Alert: AS/400 ASP Monitor
Resolution Status: New
Alert Descriptions: ASP number 1 on ASCMYPRD is 61 % used.
Source: ASCMYPRD.1.66
Path: PWMXXXXXXXX.XXBank.my;PWMXXXXXXXX.XXBank.my;XXXXPRD
Last modified by: System
Last modified time: 6/26/2018 10:11:22 AM

From this alert, we can see that disk utilization for AS/400 environment hits 61% whereby the minimum of the disk utilization set for this server only 60%. Customer request to increase disk utilization as the business are keep growth. Below are the steps how to override the value for AS/400 ASP Monitor.

Step 1: Open SCOM Management Console and click on Authoring tab.

Step 2: Click on Monitors and search monitor called AS/400 ASP Disk Utilization Monitor



Step 3: Open AS/400 ASP Disk Utilization Monitor properties



Step 4: Click on Overrides tab and click View Summary button and choose “For all object of class: AS/400 ASP Disk Utilization”



Step 5: On Override Summary, choose the Effective Value = 60 and click Edit. We need to change this value to 68.



Step 6:  Change the override value from 60 to 68 and click Apply. Then click OK




Step 7: Verify the Effective Value in the Overrides Summary



Overriding configuration for AS/400 ASP Disk Utilization monitor completed. Verify the Alert on the SCOM management console.