SCOM Audit Collect Services DB Performance

Windows Server 2012 R2

SCOM 2012 using Audit Collection Services

SQL Server 2012 for the OpsMngr Database Collector

All on the same 64bit box with two processors @ 2.7Ghz and 16GB RAM

Scenario
I have just set up ACS for the first time and learning about it.

Right now I have three servers with the Audit Collection Forwarding Service Agent installed on each of them. So they all are forwarding security audits to my Collector SQL DB.

My problem is that with only three forwarders sending events to my collector I am still seeing the "DB Backoff Threshold" and "Disconnect Threshold" maxed out. Which is causing one of my three forwarding agents to be dropped every now and again.

If you observe the screen shots I have attached you will notice that this is very odd problem to have with only three forwarding agents. Especially with such low events per second. The most traffic there has been was about 500 events according to the report shown in screenshot (Hourly_Event_Report)

So why am I having this issue when the DB_Queue (screenshot shown) is flat zero! There should be no reason for my thresholds to be maxing out and staying maxed out especially.

Please help!
Connected-Forwarders.GIF
DB-Backoff-Thresh.GIF
DB-Disconnect-Threshold.GIF
DB-Queue.GIF
Hourly-Event-Report.GIF
Incoming-Events-per-second.GIF
ryanmavesAsked:
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

ryanmavesAuthor Commented:
To answer my own question, it's actually a misunderstanding of how SCOM displays information graphically.

I was confused why my thresholds were maxed out with only one or two forwarding agents sending very little events to be logged.

Turns out these thresholds have a line across whatever the "set" threshold is within the registry. In other words, the line represented in my backoff threshold and disconnect threshold makes it look like my thresholds are being maxed out the entire time but it is actually only representing the value of my max threshold.

Really silly for Microsoft not to make an obvious disclaimer in their book (which I read up and down on ACS chapters about this trying to find an answer).

So the issue with some of my forwarders dropping off is actually not because of SCOM thresholds exceeding but instead because those forwarders are Server2008 and the WMI on Server2008 is very buggy. So my focus has been on SCOM when the problem is with my individual forwarders.

http://support.microsoft.com/kb/2843219 

whew! Hope this helps someone else that is new to SCOM not be so confused by the thresholds.

Thanks!
0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
ryanmavesAuthor Commented:
Wish there was more support for SCOM ACS somewhere on the web. Looks pretty dry out there in the www for this topic unfortunately not a lot of people talking.
0
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Windows Server 2012

From novice to tech pro — start learning today.

Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.