Solved

SBS 2011 Reports / Alerts / Security Critical

Posted on 2016-07-20
12
87 Views
Last Modified: 2016-08-26
Currently, one of the SBS 2011's I look after is experiencing the following >
  • No summary / detailed reports will generate or email on schedule.
  • Summary / Detailed reports will generate and email manually, however.
  • No alerts for actions such as server restarts are generated.
  • The security status for all computers is critical in the SBS console.

What has changed?
Prior to this, the reports had stopped generating so I followed the steps to recreate the SBS Monitoring Database (not for the first time).  This completed without any issues.

What have I done to try and fix the issue?

Recreate the SBS Monitoring DB again (after waiting a few weeks).
Adjust every facet of the reports to try and 'stamp in' the settings again.
Ran the Fix My Network Wizard.
Ran the BPA 2.0 (Clean).
Followed the guidance here > https://technet.microsoft.com/en-us/library/gg680308.aspx > no changes were required.

If you look at that guidance, I think the issue is that the tasks that are supposed to run aren't running, at least not all of them...  The SBSMonitoring.mdf is less than 3MB in size.

Any help you can provide would be appreciated greatly.
0
Comment
Question by:Mdlinnett
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 6
  • 5
12 Comments
 
LVL 22

Expert Comment

by:David Atkin
ID: 41724532
Hello,

Can you give us the procedure you used to rebuild the SBS Monitoring DB please?

Any errors in the event log relating to the SQL (SBSMONITORING) Service?


Dave
0
 
LVL 5

Author Comment

by:Mdlinnett
ID: 41725117
Rebuild procedure > https://blogs.technet.microsoft.com/sbs/2011/08/22/how-to-recreate-the-sbsmonitoring-database/

In the event logs there is only one event that isn't informational, which was generated after a reboot before the DB was ready to accept new client connections.
0
 
LVL 74

Expert Comment

by:Jeffrey Kane - TechSoEasy
ID: 41735333
Can you post the Dataservicecomponents log file in C:\Program Files\Windows Small Business Server\Logs\MonitoringServiceLogs

(if it's quite large, please just post the portion from when you recreated the monitoring database)
0
Why Off-Site Backups Are The Only Way To Go

You are probably backing up your data—but how and where? Ransomware is on the rise and there are variants that specifically target backups. Read on to discover why off-site is the way to go.

 
LVL 5

Author Comment

by:Mdlinnett
ID: 41751037
Hi Jeffrey,

Thank you for your assistance, I apologise for the delay in attaching the necessary file, I've just been on annual leave.

I've attached the log in it's entirety in order to ensure nothing is omitted.

There is an error message relating to the NT AUTHORITY\SYSTEM account not being found, but that happens on other SBS installations we look after which have no issues with the monitoring DB AND there is an article on Small Business Susan's blog indicating that it's a benign SBS issue.

Thank you once again for your time in assisting me.

Matt
DataServiceComponents.log
0
 
LVL 74

Expert Comment

by:Jeffrey Kane - TechSoEasy
ID: 41754996
Sometimes when you recreate the monitoring database the permissions don't get applied right on the folder that contains it.  Please make sure that SYSTEM has full control of this folder:

C:\Program Files\Microsoft SQL Server\MSSQL10_50.SBSMONITORING\MSSQL\DATA

(or whatever folder contains the .mdf file)

SYSTEM should actually have full control of all folders on your server,   If you have other folders which do not have this configured you may want to do an NTFS Permissions reset on your C: drive with this command:

icacls * /t /q /c /reset

(Documentation for DACL reset:  https://technet.microsoft.com/en-us/library/cc753525(WS.10).aspx)
0
 
LVL 5

Author Comment

by:Mdlinnett
ID: 41756028
Hi Jeffrey,

SYSTEM has full control of the folder and the permissions have been inherited by all files in the folder aside from SBSMonitoring.mdf and SBSMonitoring_log.ldf.

SBSMonitoring.mdf permissons
Having checked the other SBS's I look after, the permissions on those 2 files match across them all, however all have had the SBSMonitoring DB recreated at least once.  I need to verify what the permissions are on a vanilla SBS 2011 install.  I'll have to spin up a VM.
0
 
LVL 74

Expert Comment

by:Jeffrey Kane - TechSoEasy
ID: 41756929
Those are the correct permissions.
0
 
LVL 74

Accepted Solution

by:
Jeffrey Kane - TechSoEasy earned 500 total points
ID: 41756967
So I reviewed the logs a bit more and while doing so, I was prompted to remember that the processing of these tasks by SQL combines both Monitoring and SharePoint procedures.  The failing task regarding NT AUTHORITY\SYSTEM is actually during a SharePoint-related task and the cause of this failure is usually because you haven't run PSCONFIG after SharePoint updates have been applied.

This issue has the potential of killing off the monitoring reports as well due to the integration of having SharePoint use the same Database functions as Monitoring.

So please be sure this was run:
https://blogs.technet.microsoft.com/sbs/2011/05/24/you-must-manually-run-psconfig-after-installing-sharepoint-2010-patches/
0
 
LVL 5

Author Comment

by:Mdlinnett
ID: 41760661
Hi Jeffrey,

I like to think I'm pretty thorough when installing updates & making sure that any SharePoint updates are followed up by a PSConfig.

I ran the following command on the Server from the SharePoint 2010 Management Shell and received a return value of False. > (get-spserver $env:computername).NeedsUpgrade
0
 
LVL 74

Expert Comment

by:Jeffrey Kane - TechSoEasy
ID: 41763432
Well, then, I don't know what else I can suggest -- there must be some other error showing up in the event logs which would provide a clue, but without being able to review those, I can't really help any more than I have.
0
 
LVL 5

Author Comment

by:Mdlinnett
ID: 41771374
Hi Jeffrey,

I'm at the customer site today and intended to go through the event logs for any errors that might shed some light on the situation.

Last night I rebooted / applied updates to the Server as I do each month, and the alerts and reports are now being generated and are coming through via email?

Colour me confused, but the issue is now resolved with no known reason.  Thank you very much for your help.
0
 
LVL 5

Author Closing Comment

by:Mdlinnett
ID: 41771383
Not entirely sure what resolved the issue but Jeffrey deserves credit for his assistance and willingness to help me reach a solution.
0

Featured Post

Free learning courses: Active Directory Deep Dive

Get a firm grasp on your IT environment when you learn Active Directory best practices with Veeam! Watch all, or choose any amount, of this three-part webinar series to improve your skills. From the basics to virtualization and backup, we got you covered.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Ever visit a website where you spotted a really cool looking Font, yet couldn't figure out which font family it belonged to, or how to get a copy of it for your own use? This article explains the process of doing exactly that, as well as showing how…
This article shows how to use a free utility called 'Parkdale' to easily test the performance and benchmark any Hard Drive(s) installed in your computer. We also look at RAM Disks and their speed comparisons.
Windows 8 came with a dramatically different user interface known as Metro. Notably missing from that interface was a Start button and Start Menu. Microsoft responded to negative user feedback of the Metro interface, bringing back the Start button a…
There are cases when e.g. an IT administrator wants to have full access and view into selected mailboxes on Exchange server, directly from his own email account in Outlook or Outlook Web Access. This proves useful when for example administrator want…

615 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question