Hi guys,
The situation I have is this:
ServerA (server 2008 is a DC) has a know issue where it can unexpectedly restart. SCOM picked up event 6009 and alerts on it. This works from MP rules "The Domain Controller has shutdown unexpectedly" and I have also created a customer unexpected reboot monitor (just in case) which works.
The issue i have is that these/this rule/s do not always fire off alerts.
Last night the server had unexpectedly restarted at 3:30am and an alert was generated and server was health checked.
But it happened again at 8am and no alerts were generated.
As the server come back after a couple of minutes no heartbeat alerts get generated. (only use these alerts for when server is down and does not recover)
I have check:
- The SCOM maintenance mode history for ServerA and there was none.
- The previous alert at 3:30am was closed at 3:45am (so it didn't repeat) New alert would have been generated.
- The Operations Manger Log nothing indicating any issues with the agent or configuration. I can see logs showing processing of logs started ect...
Any suggestions how I can make sure these events get picked up and alerted every time?
Thanks Martin.