Home » System Center Operations Manager 2007 » ACS Forwarder Failover


Welcome to contoso.se! My name is Anders Bengtsson and this is my blog about Azure infrastructure and system management. I am a senior engineer in the FastTrack for Azure team, part of Azure Engineering, at Microsoft.  Contoso.se has two main purposes, first as a platform to share information with the community and the second as a notebook for myself.

Everything you read here is my own personal opinion and any code is provided "AS-IS" with no warranties.

Anders Bengtsson

MVP awarded 2007,2008,2009,2010

My Books
Service Manager Unleashed
Service Manager Unleashed
Orchestrator Unleashed
Orchestrator 2012 Unleashed
Inside the Microsoft Operations Management Suite

ACS Forwarder Failover

Tonight I have been thinker with ACS forwarder failover. You can read more about Audit Collection Services (ACS) in prior posts, but the fundamental is that the agent can be a ACS Forwarder which forward security events to a ACS collector (management server). My thought what is happening if a ACS collector goes down? What will the ACS forwarder do?

When you enable Audit Collection on a machine, in the “Run Task – Enable Audit Collection” box, there is a Override button (if you have multiple ACS collectors). If you click that one you can manually input collector servers. If you input “opsmgracs01.contoso.local, opsmgracs02.contoso.local” bot of these machines will be written in your ACS forwarder registry as AdtServers. You can verify that in the registry at HKEY_LOCAL_MACHINE\SOFTWARE\Policies\

If you disconnect the first machine, opsmgracs01, from the network you will get a event (ID 4369) in the event viewer at the ACS forwarder. This event tells you that the agent can not connect to any ACS collector, but a couple of seconds later you will see a event (ID 4368) telling you that the ACS forwarder is now connected to the other ACS collector, opsmgracs02.

I have been waiting around 30 minutes, after I reconnected the first ACS collector, and I have not seen a event telling me that the ACS forwarder has return back to the first ACS collect. You could control this with a extra script.

Summary: If you use the override button during enable audit collection you can setup multiple ACS collectors for your ACS forwarder. Remeber that if the agent failover, you will have ACS data in two different databases.