Hi
We have recently deployed SCOM2012r2 with 3 Management Servers, Web and Reporting server. Recently we are getting around 65000 alert generated event in 4hrs from one of the management server.
when we look on deep they were Event ID 4672, 4624, 4634 and 4648 i.e. successful log on and log off by scom service account. Account in questions are mainly from Data Reader, Config and data access logon and logoff.
we were wondering if this is normal to receive these many events from those account? we only have 10 servers being monitored as we are still on pre-production stage and we will have more than 300 servers once we go live.
we were wondering if you had this and what did you do.
Thank you