• Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 409
  • Last Modified:

SCOM Audit Collect Services DB Performance

Windows Server 2012 R2

SCOM 2012 using Audit Collection Services

SQL Server 2012 for the OpsMngr Database Collector

All on the same 64bit box with two processors @ 2.7Ghz and 16GB RAM

Scenario
I have just set up ACS for the first time and learning about it.

Right now I have three servers with the Audit Collection Forwarding Service Agent installed on each of them. So they all are forwarding security audits to my Collector SQL DB.

My problem is that with only three forwarders sending events to my collector I am still seeing the "DB Backoff Threshold" and "Disconnect Threshold" maxed out. Which is causing one of my three forwarding agents to be dropped every now and again.

If you observe the screen shots I have attached you will notice that this is very odd problem to have with only three forwarding agents. Especially with such low events per second. The most traffic there has been was about 500 events according to the report shown in screenshot (Hourly_Event_Report)

So why am I having this issue when the DB_Queue (screenshot shown) is flat zero! There should be no reason for my thresholds to be maxing out and staying maxed out especially.

Please help!
Connected-Forwarders.GIF
DB-Backoff-Thresh.GIF
DB-Disconnect-Threshold.GIF
DB-Queue.GIF
Hourly-Event-Report.GIF
Incoming-Events-per-second.GIF
0
ryanmaves
Asked:
ryanmaves
  • 2
1 Solution
 
ryanmavesAuthor Commented:
To answer my own question, it's actually a misunderstanding of how SCOM displays information graphically.

I was confused why my thresholds were maxed out with only one or two forwarding agents sending very little events to be logged.

Turns out these thresholds have a line across whatever the "set" threshold is within the registry. In other words, the line represented in my backoff threshold and disconnect threshold makes it look like my thresholds are being maxed out the entire time but it is actually only representing the value of my max threshold.

Really silly for Microsoft not to make an obvious disclaimer in their book (which I read up and down on ACS chapters about this trying to find an answer).

So the issue with some of my forwarders dropping off is actually not because of SCOM thresholds exceeding but instead because those forwarders are Server2008 and the WMI on Server2008 is very buggy. So my focus has been on SCOM when the problem is with my individual forwarders.

http://support.microsoft.com/kb/2843219 

whew! Hope this helps someone else that is new to SCOM not be so confused by the thresholds.

Thanks!
0
 
ryanmavesAuthor Commented:
Wish there was more support for SCOM ACS somewhere on the web. Looks pretty dry out there in the www for this topic unfortunately not a lot of people talking.
0

Featured Post

Free Tool: ZipGrep

ZipGrep is a utility that can list and search zip (.war, .ear, .jar, etc) archives for text patterns, without the need to extract the archive's contents.

One of a set of tools we're offering as a way to say thank you for being a part of the community.

  • 2
Tackle projects and never again get stuck behind a technical roadblock.
Join Now