After you have implement Audit Collection Services in your environment you must start monitor the collector. There is a number of performance counters that can help you with this:

• Connected Clients
• Database Queue % Full
• Database Queue Backoff Threshold in %
• Database Queue Disconnect Threshold in %
• Database Queue Length
• DB Loader Event Inserts/sec
• DB Loader Principal Inserts/sec
• DB Loader String Inserts/sec
• DB Principal Cache Hit %
• DB Request Queue Length
• DB String Cache Hit %
• Event time in collector in milliseconds
• Incoming Events/sec
• Interface Audit Insertions/sec
• Interface Queue Length
• Registered Queries

If you want to collect this performance data and review it for analyse and plannig, you can first create a collection rule and then a performance view.

1. Start the console, click Authoring
2. Right-click Rules and choose to create a new rule
3. Rule Type: Choose to create a Collection Rules/Performance Based/Windows Performance. Click Next
4. General: Input a rule name, description and choose “Microsoft Audit Collection Services Collector” as rule target, then click next.
5. Performance Counter: input “ACS Collector” as object. If you want to collect for example number of events inserted in the database per second, select “DB Loader Event Inserts/sec” as counter. Select “Include all instances for the selected counter”. Configure the interval and then click Next
6. Optimized Collection: Choose to use optimization or not, click Create

If you want to view the collected data you can create a performance view, and configure it to show data related to “Microsoft Audit Collection Services Collector”.

In MOM 2005 we could add advanced criterias and for example check if a event description included a special word, “matches wildcard”. In this post I will show you how to get the same feature in Ops Mgr 2007. I want an alert when a event with “unsucessfully” is written in the local event log.

I have create a simple vbscript that writes two events to a local event log. The event ID and source are the same, and the description is almost the same, but one event includes “unsuccessfully” and the other one includes “sucessfully”. Now I want to get an alert only when events with “unsuccessfully” a written in the local event viewer.

1. Start Ops Mgr Console, click Authoring
2. Right-click Rules and choose to create a new Rule, create a Alert Generating Rules/Event Based/NT Event Log (Alert)
3. Rule Type: Choose a suitable management pack to store your new rule, click Next
4. General: Input a name, description and choose a suitable target, click Next
5. Event Log Type: Choose which log, in my example events will be generated in the Application Log. Click next
6. Build Event Expression: in my example
   Event ID. equals. 0
   Event Source. equals. WSH
7. Click Insert and choose then “…” in the new parameter box. In “Select an Event Property” choose “Use parameter name not specified above” and then insert EventDescription , click OK
   setup the last parameter as
   EventDescription. Contains. unsuccessfully  , click Next
8. Configure Alerts: Configure a suitable alert, with some description. If you want the entire event shown in the alert description you can add $Data/EventDescription$. Click Create

You sometimes gets something like this in for example an alert

Affected monitor ID: AE311D41-D0C4-31B3-B2A1-E503E7226F42 Instance ID: 54321668-EFFA-411D-A511-3C6D9E119294 Management Group ID: 17F3B66F-8597-7BB1-35EE-F382AAF6B299

You then want to know the name of the monitor. Unfortunately the built-in advanced search tool in the console dont support searching on Monitor ID.  But you can run this SQL query in your OperationsManager database, it will give you bot monitor name and managementpack

SELECT Monitor.MonitorName, ManagementPack.MPName FROM Monitor INNER JOIN ManagementPack ON Monitor.ManagementPackID = ManagementPAck.ManagementPackID WHERE MonitorID = ‘X’

Replace X with the Monitor ID.

There is a lot of questions regarding ACS and gateway server. Microsoft Audit Connection Service (ACS) is a new function in Ops Mgr that can collect logs from machines. All logs are saved in a special Audit Collection database. You can then run reports against the database to see trends and do security analyzes. You can also for example trace a user activity over many systems. Gateway server is a server service that allow Ops Mgr to monitor machine within non-trusted domains or in workgroups, without lower the security.

I did some tests today about ACS and gateway servers. In my test I had regular Windows Server 2003 domain with Ops Mgr installed, I also had a Windows Server 2008 machine running in another domain that I wanted to monitor. Normal agent installation did not work as there is no firest trust between my domains and the 2008 domain is running Windows Server 2008 Functional Level. Is is no problem installing the agent on a Windows server 2008 machine that are in the same domain as Ops Mgr.I installed a Windows Server 2003 as a gateway (GTW) server and then I manually installed the agent on my Windows server 2008 machine. After that I enable audit collection from operations manager console. During the ACS enable wizard you must do a override and speciy a ACS collector, else the agent will try to forward all events to the gateway server.

 

 

Summary: There is no problem with ACS in a gateway scenario like this. Just remeber to direct your ACS forwarder (the agent) to send its event data to a ACS collector. One of the news in Ops Mgr SP1 is that ACS is now supported on the Management and Gateway server roles.