SCOM 2012 basic setup ?

Ok I know nothing about SCOM so bear with me...

I followed various articles to set up and install scom 2012.  I was able to add agents to 3 client machines (1 dhcp and 2 plain servers).

I set up notifications and I get emails regarding scom itself but nothing about the clients.   I tried shutting down the clients, and still nothing.  I know that rules have to be authored but shouldn't a reboot or shutdown be a default alert?  I assume I'm missing a step?
Who is Participating?

[Product update] Infrastructure Analysis Tool is now available with Business Accounts.Learn More

I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

Dan McFaddenSystems EngineerCommented:
No, a reboot and/or shutdown is not a default alert unless it causes an error (real or not)... for example reboot a domain controller and you will probably generate an error or 2 as well as a few warnings plus the standard information message.

If you are in the SCOM console, you can search thru the "information" messages and will find a message stating that server X was restarted.

You don't have to author rules to get alerts, you have to setup the following:

1. channel = how the alert message will arrive [what protocol to use, typically SMTP]
2. subscribers = these are the users (or distribution lists) that are available in SCOM to be sent alerts
3. subscriptions = these are the events that you want alerts for.  here you define the event, tell the subscription to whom the alert should be sent and on what channel it is to be sent on.

You could probably create a subscription that throws an alert message into email for every server restart detected.  But I would caution against using it in an organization with a large Microsoft infrastructure.  It could cause an awful lot of noisy emails over what may be trivial alerts.  And I would absolutely not recommend alerting on every workstation reboot.

If you want an alert from SCOM in your example, stop the DHCP service, if you setup of Notifications correctly, you should get an email that the DHCP service stopped.  There should also be an error message in the SCOM console, under monitoring and Active Alerts.

billFmurrayAuthor Commented:
Thanks!  Makes sense.

I can't stop the dhcp service unfortunately, at least not until the next maintenance.  I tried shutting down a whole bunch of services on another generic server but didn't get any notifications.

If I wanted to do the reboot one, I assume I'd want to create a subscription?  Would I find Restart as an option!
billFmurrayAuthor Commented:
Dan McFaddenSystems EngineerCommented:
Randomly restarting service is not a great test for this situation.  Let me ask, what additional management packs have you installed?  There are various, non-default MPs that monitor services that a default SCOM install doesn't.

Here is a link to the latest MPs from MS:

Most of these MPs add additional functionality this is not present in the default SCOM install.  So go thru the list and look for services that you want to monitor, download/install the MP and you'll get a wider view into your deployed systems.

Also, check out your server hardware providers (Dell, HP, IBM, etc) they typically provide MPs for their respective hardware platform.  Look at your network hardware providers as well.

To create a reboot alert, you will want to look at the info alert that is generated when a monitored device is restarted, look into the monitor/rule that generated that info alert, then create a subscription to that object.  Unfortunately, their is no blatant reboot object because there are reboot/restart monitors for various objects in SCOM.  There are multiple SQL restarts, multiple IIS restarts, OS restarts (based on their OS flavor).  Its somewhat of a circus.

SCOM is kind of a beast.  Its the monster in the closet and it always makes scary noises.


Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Network Operations

From novice to tech pro — start learning today.