SCOM Audit Collect Services DB Performance

ryanmaves used Ask the Experts™
Windows Server 2012 R2

SCOM 2012 using Audit Collection Services

SQL Server 2012 for the OpsMngr Database Collector

All on the same 64bit box with two processors @ 2.7Ghz and 16GB RAM

I have just set up ACS for the first time and learning about it.

Right now I have three servers with the Audit Collection Forwarding Service Agent installed on each of them. So they all are forwarding security audits to my Collector SQL DB.

My problem is that with only three forwarders sending events to my collector I am still seeing the "DB Backoff Threshold" and "Disconnect Threshold" maxed out. Which is causing one of my three forwarding agents to be dropped every now and again.

If you observe the screen shots I have attached you will notice that this is very odd problem to have with only three forwarding agents. Especially with such low events per second. The most traffic there has been was about 500 events according to the report shown in screenshot (Hourly_Event_Report)

So why am I having this issue when the DB_Queue (screenshot shown) is flat zero! There should be no reason for my thresholds to be maxing out and staying maxed out especially.

Please help!
Watch Question

Do more with

Expert Office
EXPERT OFFICE® is a registered trademark of EXPERTS EXCHANGE®
To answer my own question, it's actually a misunderstanding of how SCOM displays information graphically.

I was confused why my thresholds were maxed out with only one or two forwarding agents sending very little events to be logged.

Turns out these thresholds have a line across whatever the "set" threshold is within the registry. In other words, the line represented in my backoff threshold and disconnect threshold makes it look like my thresholds are being maxed out the entire time but it is actually only representing the value of my max threshold.

Really silly for Microsoft not to make an obvious disclaimer in their book (which I read up and down on ACS chapters about this trying to find an answer).

So the issue with some of my forwarders dropping off is actually not because of SCOM thresholds exceeding but instead because those forwarders are Server2008 and the WMI on Server2008 is very buggy. So my focus has been on SCOM when the problem is with my individual forwarders. 

whew! Hope this helps someone else that is new to SCOM not be so confused by the thresholds.



Wish there was more support for SCOM ACS somewhere on the web. Looks pretty dry out there in the www for this topic unfortunately not a lot of people talking.

Do more with

Expert Office
Submit tech questions to Ask the Experts™ at any time to receive solutions, advice, and new ideas from leading industry professionals.

Start 7-Day Free Trial