What does the ManagementPack do?
The Win32_NTEventLogFile ManagementPack uses the Windows Management Instrumentation (WMI) class: Win32_EventLogFile to discover what event logs are actively available on each server a healthy SCOM Agent is installed on and is displayed using a state view.
It also includes a dedicated NTEvemtlogFile Report in SRS format
Why was this ManagementPack created?
This ManagementPack was created to support cross Enterprise collection of Event logs. If you have hundreds of Agent machines, within minutes of importing this ManagementPack, you will know what event logs are on every machine and that’s the beauty of this ManagementPack.
Additionally, using the power of SQL Server, a connection string and a SQL Query to glean the information from this table will acquire the data and make it readily available for review. Event logs that either should be or should not be there is typical of what is meant. Once the information is transformed into human readable information, the ManagementPack can be deleted from SCOM and the table it produced will no longer exist.
How Often should it be used?
Because of the way the ManagementPack works, it is strongly recommended to use it once to build an informational foundation and then use it once a month thereafter to determine if any new Event Logs have been added or removed.
After that, once a month, when a new service is added or an old one has been removed are times when this ManagementPack should be considered.
How much time does it save?
In terms of development and testing, about a week.
How long does it take for the data to show up in the operations manager console?
There are a lot of factors that could stop this from happening immediately. Normally, by design, since the discovery is run almost immediately, the data can be viewed just as fast.
Are there any customizations for my environment that I need to add to the management pack?
No, there are no customizations required.
Can I customize the discovery Interval?
Yes, you can. By default, the interval is set to 86,400 seconds or once a day. You can adjust the interval as well as the timeout interval to the desired response and timeout conditions through the SCOM Console.
How often does the data get updated?
When the ManagementPack is installed, the discovery gets run after that it will be based on the frequency set for it to run—which is currently once a day.
How will I know when a new version of the management pack is released?
There are two ways this can happen. Provide us with your E-mail address or come to the site and look for the words “Updated Release” beside the name of this ManagementPack.
Can you supply us with a custom report?
With a great amount of pride and enthusiasm, we certainly can.
Unfortunately, while not problem for us, this may be a SQL Server security issue for you.
So many times it works for us, but doesn’t work for our customers.
If it isn’t an issue, then E-mail us.