2003 SBS performance report

DesertDawg
DesertDawg used Ask the Experts™
on
I'm getting large numbers of failed logons in daily reports.  I recall that this alert can be altered to "success" only in Group Policy but it's so long since I used 2003 SBS that I've totally forgotten how to do that correctly.  Can someone remind me?
Comment
Watch Question

Do more with

Expert Office
EXPERT OFFICE® is a registered trademark of EXPERTS EXCHANGE®

Commented:

To modify an existing server performance or usage report

    Open Server Management.
    In the console tree, click Monitoring and Reporting.
    In the details pane, click Change Server Status Report Settings.
    Under Reports, click the report you want to modify, and then click Edit.
    In the Server Status Report Properties dialog box, configure the report using the settings available on each of the tabs.

Understanding the server performance report
http://technet.microsoft.com/en-us/library/cc719895%28WS.10%29.aspx
Report Definitions
http://technet.microsoft.com/en-us/library/cc707971%28WS.10%29.aspx

Understanding the server performance report

The Microsoft® Windows® Small Business Server 2003 server performance report gives you a quick view of the overall health of the server and the issues that need attention. The report contains status information about services that are not running, performance counters data, and critical events that are being logged. It is created automatically based upon choices you make when you run the Monitoring Configuration Wizard.

After running the Monitoring Configuration Wizard, performance data is collected hourly at 15 minutes before the top of the hour and is stored in a database. Whenever the performance report is generated or accessed, the latest information is pulled from the database and displayed in the report.

To enable and configure report preferences or other monitoring features, run the Monitoring Configuration Wizard by clicking Configure Monitoring in the To Do List, or by clicking Set Up Monitoring Reports and Alerts in the Monitoring and Reporting snap-in in Server Management. For more information, see Using the Monitoring Configuration Wizard.

Viewing the report

After completing the Monitoring Configuration Wizard, you can view the server performance report in the following ways:

    Click Monitoring and Reporting in Server Management.
    Click View a server performance report from the Remote Web Workplace.
    Receive the report in e-mail.

Only members of the Domain Admins security group have permission to view the report online. If you select the Receive a daily performance report in e-mail check box on the Reporting Options page of the Monitoring Configuration Wizard, the server performance report will automatically be sent to specified e-mail recipients each day at 07:00 A.M.

Customizing the report

After completing the Monitoring Configuration Wizard, you can make changes to default report settings by clicking Change Server Status Report Settings in the Monitoring and Reporting snap-in in Server Management. After clicking this task and selecting the report you want to modify, you can:

    Specify e-mail recipients for a report.
    Attach log files to a report sent in e-mail.
    Add log files to the list of available logs.
    Change the time that reports are scheduled to be sent to e-mail recipients.
    Immediately send a report to an e-mail recipient.
    Create a new report with a different set of configured options.
    Remove existing reports.

For information about how to attach log files to a server performance or usage report sent in e-mail, or add other log files to the list of available files, see Attach log files to performance or usage reports.

Notes

    Log files can be very large. Take this into consideration when deciding to attach a log file to a server performance or usage report. If the compressed size of log file attachments exceeds 5 megabytes (MB), the attachment will not be sent.
    As a security measure, some e-mail clients such as Outlook Express block receipt of .cab files and other file types by default. If you have configured Windows Small Business Server 2003 to attach log files to server performance or usage reports, but you are unable to open or receive them as expected, see your e-mail client software documentation to determine how to enable receipt of those files.

Information contained in the server performance report
 

Report section
      

Description

ServerName
      

Summary information for:

    The length of time the server has been running since it was last restarted.
    Links to additional details in the body of the report.
    Status of Windows Small Business Server 2003 Backup.
    The number of services configured to start automatically that are not running.
    The number of critical alerts that occurred in the last 24 hours.
    The number of critical event log errors in the last 24 hours.

Server Specifications
      

Specifies the operating system and service pack version; processor type and speed; and the amount of RAM installed on the server.

Performance Summary
      

Lists current values for today and last month and the growth rate percentage for the following performance counters:

    Memory in use
    Free disk space (for each logical disk on the server)
    Busy disk time (for each physical disk on the server)
    CPU use

Top 5 Processes by Memory Usage
      

Lists the names of the five processes that currently consume the majority of server memory. As a reference, this section also includes the percentage of memory consumed by other processes and the total amount of memory installed on the server.

Top 5 Processes by CPU Usage
      

Lists the names of the five processes that currently consume the largest percentage of CPU time.

Backup
      

Indicates the results from the latest run of Windows Small Business Server 2003 Backup.

Auto-started Services Not Running
      

Lists services that have been configured to start automatically, but were not running at the time the report was run.

Critical Alerts
      

Provides detailed information that describes each critical alert that occurred in the last 24 hours.

Critical Errors in Event Logs
      

Lists critical errors that have occurred in the event logs in the last 24 hours. Details include information about the source of the error, the event ID, the time of the last occurrence, the total number of occurrences, and the associated error message, if any.

Author

Commented:
Thanks for your response but the text does not contain any information on how to omit log on failures from the security alert section.  I've done it years ago under group policy but I just cannot recall exactly which section (s) were amended to "success" audit only.
Commented:
Go to gpedit.msc you will find auditing there

Author

Commented:
Got it!  I remember now.

Thanks.

Do more with

Expert Office
Submit tech questions to Ask the Experts™ at any time to receive solutions, advice, and new ideas from leading industry professionals.

Start 7-Day Free Trial