Re: FTP Log and Alert

GD

unread,

Apr 6, 2009, 11:03:47 AM4/6/09

to

This should help with the parameters:
http://blogs.technet.com/kevinholman/archive/2007/12/12/adding-custom-information-to-alert-descriptions-and-notifications.aspx

Cheers

Graham

"adaniel934" <adani...@discussions.microsoft.com> wrote in message
news:BDA4E519-53C7-4F67...@microsoft.com...
> Mr. Bengtsson,
>
> THank you for your reply; however where do you get the information for
> Parameter Name = Params/Param[1] and how do you know what parameter entity
> matches what entity for FTP logs? Is there a MS website where this is
> located
> or defined as i have searched high and low for this. Please advise.
>
> "Anders Bengtsson [MVP]" wrote:
>
>> Hello adaniel934,
>>
>> Here is a short guide how to setup logfile monitoring
>> http://contoso.se/blog/?p=174
>> Here are some ideas for FTP monitoring http://contoso.se/blog/?p=256
>> and here are some notification scenarios
>>
>> Anders Bengtsson
>> Microsoft MVP - System Center Operations Manager
>> www.contoso.se
>>
>> > Would anyone know how to setup an alert (to email but i think this is
>> > done by notification devices) such that SCOM 2007 checks the FTP logs
>> > on a server (default MS FTP site and log location) and alerts are
>> > generated whenever a specific user (i.e. administrator) tries to
>> > login?
>> >
>>
>>
>>

adaniel934

unread,

Apr 6, 2009, 10:06:01 AM4/6/09

to

adaniel934

unread,

Apr 7, 2009, 12:27:01 PM4/7/09

to

i think i found my issue but dont know the fix. I did install the agent on
the remote box, but whats happening is that the alerts are generated once and
then subsequent testing (to generate the alerts again) are not happening. Is
there a suppression option that i am missing so that an alert is generated
everytime?

"Anders Bengtsson [MVP]" wrote:

> Hello adaniel934,
>
> The agent running the check needs to read the logs, so try have a agent on
> the local FTP Server. Else you will have to share the folder for the agent
> reading the logs.
>
> The link GD posted is where I get info about parameters and variables.

>
> Anders Bengtsson
> Microsoft MVP - System Center Operations Manager
> www.contoso.se
>

> > Ok, so i got the alerts to work such that i am alerted; however i got
> > the alert to work if i created a log file local to the SCOM server. Do
> > need to share out the ftp log folder on the remote server that i need
> > to monitor?

adaniel934

unread,

Apr 7, 2009, 2:46:06 PM4/7/09

to

So, i figured it out. I was doing everything in Monitors, where in reality
(at least in my world) if you wanted repeat alerts/notifications i needed to
set it up in Rules. I was able to configure just about everything i needed to
do in my test environment. Thanks you both for all your help!

adaniel934

unread,

Apr 9, 2009, 2:30:03 PM4/9/09

to

Anders or anyone,

So i got the alerting to work perfectly for the group Windows Computer;
however if i create a group called FTP_Group and put my FTP server in to that
group, create an Alert Generating Rule based of Generic CSV Text Log(Alert),
alerts are not generated based on my criteria. However NT Event Log alert
generating rules do work when i use eventcreate via comman line on the same
server in the same group (FTP_Group). Is there something different i need to
do so that custom groups work with CSV Text Logs?

Also, i thought IIS management pack works with IIS FTP logs and we didnt
have to go through Generic CSV Text Log option or am i wrong to think that?

"Anders Bengtsson [MVP]" wrote:

> Hello adaniel934,
>
> Notification scenarios http://contoso.se/blog/?p=263