Managing Event Alerts in Your Reports - An SBS Monitoring Feature Enhancement

[Today's post comes to us courtesy of Damian Leibaschoff and Justin Crosby from Commercial Technical Support]

One of the most requested features for the SBS Monitoring component of Windows SBS 2008 and Windows SBS 2011 Standard is the ability to control and filter unwanted errors from the event logs section of the reports.

There are a number of known events that can be safely ignored. Also depending on the particular environment you might have your own list of events you want to ignore. You cannot accomplish this with the built-in, out-of-box, functionality.

This, as-is solution, was built by engineers from the SBS support team and is aimed at improving the functionality and effectiveness of the SBS Monitoring reports.

The relevant portion of a detailed report from SBS 2011 standard before installing the new functionality:

clip_image002

The same report with the feature installed using the default exclusions:

clip_image004

Notice how the critical event count went from 12 to 5, and unimportant DCOM and WinRM events have been hidden.

How it works

This solution configures a database table with a number of source:event combinations (known as exclusions) that need not be collected from the event logs, for example: DCOM 10016. Upon installing the solution a default set of exclusions are added depending on the version of SBS and the existing instances that have already been collected are removed. The same is true when a new exclusion is added manually, existing source:events instances will be deleted.

Upon removing an exclusion or uninstalling the solution, the process of collecting all events will resume and only after the event is experienced again it will then be collected and will appear on the report.

Installation and Usage

  1. Download and extract the SBSAlertsCleanup package which is hosted on the SBS Support Team’s SkyDrive.
  2. Open the location of the extracted files and then the properties of SBSAlertsCleanup.ps1 file .
  3. Unblock the file if the option is shown. Note: you do not need to do this to the .sql files.
  4. Launch an elevated PowerShell prompt.
  5. From PowerShell, browse to the folder where you extracted the files.
  6. From PowerShell, run:
    .\SBSAlertsCleanup.ps1 –Action install [enter]

You will see “Changed database context to ‘SBSMonitoring’

Listing current Exclusions

.\SBSAlertsCleanup.ps1 –Action ListExclusions

ID Event Source
-- ----- ------
1 129 WinRM
2 142 WinRM
3 4107 Microsoft-Windows-CAPI2
4 10016 DCOM
5 10009 DCOM
6 5586 SharePoint Foundation
7 6772 SharePoint Foundation
8 6398 SharePoint Foundation
9 8 MSExchange CmdletLogs
10 6 MSExchange CmdletLogs

Removing an Exclusion

This is a 2 part process, first you have to list the current exclusions, and then we can pick which one to remove.

.\SBSAlertsCleanup.ps1 –Action ListExclusions

ID Event Source
-- ----- ------
1 129 WinRM
2 142 WinRM
3 4107 Microsoft-Windows-CAPI2
4 10016 DCOM
5 10009 DCOM
6 5586 SharePoint Foundation
7 6772 SharePoint Foundation
8 6398 SharePoint Foundation
9 8 MSExchange CmdletLogs
10 6 MSExchange CmdletLogs

.\SBSAlertsCleanup.ps1 –Action RemoveExclusion –ID 1
Removing Exclusion for Source: WinRM, EventID: 129

To confirm:

.\SBSAlertsCleanup.ps1 –Action ListExclusions

ID Event Source
-- ----- ------
2 142 WinRM
3 4107 Microsoft-Windows-CAPI2
4 10016 DCOM
5 10009 DCOM
6 5586 SharePoint Foundation
7 6772 SharePoint Foundation
8 6398 SharePoint Foundation
9 8 MSExchange CmdletLogs
10 6 MSExchange CmdletLogs

Adding an Exclusion

This is a 2 part process, first you have to list the available instances of events that have already been collected, and then we can pick which one to exclude.

.\SBSAlertsCleanup.ps1 –Action ListEvents

ID Event Source
-- ----- ------
346141 11 Disk
349778 13 Server Infrastructure Licensing
349779 14 Server Infrastructure Licensing
349781 15 Server Infrastructure Licensing
349552 25 WindowsUpdateClient
349832 54 MSExchange OWA
349827 135 WinRM
349795 502 Windows Small Business Server 2011 Standard
349809 1000 Application Error
343153 1016 DhcpServer
342822 2002 ESENT
348341 2007 ESE
342823 2007 ESENT

Let’s say that the administrator was been receiving several events for WindowsUpdateClient 25 on a regular basis. The admin has investigated this event and determined that it is not cause for concern on their network and they would no longer like to be notified about this event. The admin can do the following to exclude this event from the report:

.\SBSAlertsCleanup.ps1 –Action AddExclusion –ID 349552

Adding Exclusion for Source: WindowsUpdateClient, EventID: 25

To confirm:

.\SBSAlertsCleanup.ps1 –Action ListExclusions

ID Event Source
-- ----- ------
2 142 WinRM
3 4107 Microsoft-Windows-CAPI2
4 10016 DCOM
5 10009 DCOM
6 5586 SharePoint Foundation
7 6772 SharePoint Foundation
8 6398 SharePoint Foundation
9 8 MSExchange CmdletLogs
10 6 MSExchange CmdletLogs
11 25 WindowsUpdateClient

Uninstalling

Upon removing an exclusion or uninstalling the product, the process of collecting all events will resume and only after the event is experienced again it will then be collected and will appear on the report.

.\SBSAlertsCleanup.ps1 –Action Uninstall

Default set of exclusions

We install a set of common exclusions for known events that are generally considered as ignorable. This may not be the case for each and every server so you might have to tweak the list of exclusions, removing and adding as needed as to make your reports show relevant errors that could be of interest for someone administering the health of the server.

SBS 2008

  • 10016 DCOM
  • 10009 DCOM

SBS 2011 Standard

  • 129 WinRM
  • 142 WinRM
  • 4107 Microsoft-Windows-CAPI2
  • 10016 DCOM
  • 10009 DCOM
  • 5586 SharePoint Foundation
  • 6772 SharePoint Foundation
  • 6398 SharePoint Foundation
  • 8 MSExchange CmdletLogs
  • 6 MSExchange CmdletLogs

Hopefully, this simple enhancement can help you regain control of the reports and fine tune them to your needs.