Microsoft Audit Connection Service (ACS) is a new function in SCOM 2007 that can collect logs from machines. All logs are saved in a special Audit Collection database. You can then run reports against the database to see trends and do security analyzes. You can also for example trace a user activity over many systems.

Operations Manager (Ops Mgr) comes with a number of ACS reports but most of them only work with Windows Server 2003. I have customers who have upgrade to Windows Server 2008 and now experience that ACS no longer is working. That is due to ACS reports are looking for Windows Server 2003 events. For example the “Usage _-_User_Logon” report is looking for event ID 540 and 528, but in Windows Server 2008 the logon events are ID 4624 and 4648.

Another problem with ACS reports is that you can’t schedule them with relates dates, for example “last week first day” and “last week last day”.

To create a new report to show all logons (event ID 4624) for a domain user, last seven days, you can use the build in SQL Report Builder. These presuppose that you have ACS installed correct. You can read how to deploy ACS here.

1. Start the Operations Manager 2007 console and navigate to the Reporting workspace, click “Design a new report”
2. In “Microsoft Report Builder” select Audit as source of data for your report, select table report layout and click OK
3. Click and add a title, for example “Contoso – Domain User Logon
4. From “Fields” drag and drop “Logon Time” to the table
5. From “Fields” drag and drop “Target User” to the table
6. From “Fields” drag and drop “Event Machine” to the table
7. From “Fields” drag and drop  “String 13” to the table
8. From “Fields” drag and drop “String 02” to the table
9. From “Fields” drag and drop “String 12” to the table
10. From “Fields” drag and drop “String 03” to the table
11. Click “Fields” in the tools menu
12. In the “Filter Data” window, from “Fields” drag and drop “Event ID” to the “Dv Alls with” box. Select event ID 4624 in the drop down menu
13. In the “Filter Data” window, from the “Fields” drag and drop “Logon Time” to the “Dv Alls with” box. Select “Logon Time on or after 7 days ago” and “Logon Time on or before today”
14. In the “Filter Data” window, from the “Fields” drag and drop “Target Domain” to the “Dv Alls with” box. Select “Target Domain equals ”
15. In the “Filter Data” window, from the “Fields” drag and drop “Target User” to the “Dv Alls with” box. Right-click “Target User” and select “Prompt”.If you don’t add a filter to this formula you will get a drop-down menu with all usernames to select from. (Right-click “Target User” and select “Edit As Formula”, double click “Parameter: Target User”, expand, add a simple filter, for example a empty filter)
16. Rename the table cells, to for example
    Event Machine to “Computer (Logon on to)
    String13 = Auth Package
    String02 = Logon Type
    String12 = Logon Process
    String03 = Computer (Logon on from)
17. When you are happy with your new report you can test run it with the “Run Report” button. You can then save the report to your report server on the File menu.

It can also be nice with an information box both what this report does and what all different logon types mean. Also insert a filter description to your report from the Insert menu.

Useful Links
Description of security events in Windows Vista and in Windows Server 2008, link
Audit Category: Logon/Logoff (Vista and Windows Server 2008), link

Today when I was looking for a list of all my agent managed machines I found the Custom Configuration report, under generic reports. It is a fairly nice report in which you can add a group and then select report fields. For example if you add “Agent Managed Computer Group” as a group you can then choose to display hostname, IP Address and OU. It can also be used to generate a report over all logical disc with special attributes, you configure the forumla for the special attributes in a dynamic group.

There has been some discussions about monitoring log files and how Ops Mgr handle them. I did some tests in my sandbox regarding this. I created a monitor to check log files with pattern “*.log*” in C:\AppLogs\. Ops Mgr is looking for “warning” in all .log files. As soon as I input “warning” in my log file applog.log I get an alert in the console. You can use the variables below to add information to the alert description, for example the filename.

Logfile Directory : $Data/EventData/DataItem/LogFileDirectory$
Logfile name: $Data/EventData/DataItem/LogFileName$
String:  $Data/EventData/DataItem/Params/Param[1]$

If I clear the logfile and then input “warning”, I don´t get an alert. Ops Mgr remember where it read last time and will not read the hole file again, and as I am back on line one now, Ops Mgr consider that line as read. But if I add a couple of more lines Ops Mgr will generate an alert as I am beyond that line where Ops Mgr read last time.

If I add a second log file to the same directory, for example applog2.log, and input “warning” in it I get an alert instant.

Summary: If you want to limit the space that your log file needs, configure your application to use multiple log files, instead of clear the log file. For example configure your application to start a new log file every hour or day. Make sure the application are not updating the old files after a new is created. As long as the log file name patter is the same Ops Mgr will find it and monitor it, without any extra configuration. You can then configure another rule to delete old log files to clear up space.

I have note that sometimes, if you are monitoring a number of files that all are all active, the monitor health state will change after the first new “warning”, if you then get a new “warning” in a log file before the monitor is back to health you will not see that second “warning” in the console. Also note that log file monitors are not case sensitive, so if you configure it to look for Warning it will also trigger on warning.

I have seen a lot of questions about checking all services that are configure to start automatically. This can be done with a script. This script checks if the service is configure to start automatic, if it is and it is not running, a warning event will be written in the local application log. You can then pickup that event with Operations Manager and generate an alert.

strComputer = “.”
Set objWMIService = GetObject(“winmgmts:” _
    & “{impersonationLevel=impersonate}!\\” & strComputer & “\root\cimv2”)

Set colListOfServices = objWMIService.ExecQuery _
        (“Select * from Win32_Service”)

For Each objService in colListOfServices

If (objService.StartMode = “Auto”) and (objService.State = “Stopped”) then

Const EVENT_WARNING = 2
Set objShell = CreateObject(“Wscript.Shell”)
objShell.LogEvent EVENT_WARNING, _
 “Service ” & objService.DisplayName & ” is not running. (” & objService.Name & “)”
End If
Next

Remember to test scripts in a test environment first.

As you might have experience Xplatform component discovery takes a long time. The default value to discover components is set to 3600 seconds, but you can override with a lower value. This is suitable in a sandbox where you want to get the monitoring to work as soon as possible so that you can move on with your other tests.

In the authoring workspace, under Object Discoveries, there are a number of rules to override, for example if you are running SUSE Linux Enterprise 10:

Discover SUSE Linux Enterprise Server 10 Logical Disks
Discover SUSE Linux Enterprise Server 10 Physical Disks
Discover SUSE Linux Enterprise Server 10 Processor
Discover SUSE Linux Enterprise Server 10 Network Adpaters
Discover SUSE Linux Enterprise Server 10 Operating System

If you change the Interval value to 60, it will run the discovery every 60 seconds. Of course this value is not suitable in all environment so please be wise when modifying this. You could also override the interal for computer and operatingsystem to discovery system faster.