Jump to content

Sign in to follow this  

SCOM 2012 - Event Log Alerts?!?

Recommended Posts

I am constantly getting the following alerts on all my Server 2012 Hypver-V hosts.


The Windows Event Log Provider is still unable to open the Microsoft-Windows-Hyper-V-Network-Admin


this makes sense as the log doesn't actually exists so why on earth is it checking for it?


Workflow name: Microsoft.Windows.HyperV.2008.VirtualNetwork.PortConnectionMonitor


Why is a 2008 workflow applying to Server 2012? any idea how I mute or stop these alerts?

Share this post

Link to post
Share on other sites



You will have to create an Override for that monitor in reference to the Windows Server 2012 systems.


Take a look at this link: http://kevingreeneitblog.blogspot.ca/2013/02/scom-opsmgr-hyper-v-2008-mp-issue.html


It seems to answer your question in relation to Hyper-V 2008 and 2012. I can't take credit for the answer, but I will post it here for quick/easy reference.


Here's how you resolve the issue:

First up, click on the Authoring button from the wunderbar in the SCOM Operations console as below


Now click on the Monitors view and then select the Scope button up top to scope your search criteria. When the Scope Management Pack Objects window appears, choose the View All Targets option and then type Hyper-V in the Look For field as shown below and then click OK to continue


Back at the now scoped Monitors window, in the Look For field at the top of the screen, typePort Connectivity as shown in the screenshot below and then hit the Find Now button


You should now be presented with the Port Connectivity monitor that forms part of the Microsoft Windows Hyper-V 2008 Monitoring management pack and this is one of the monitors that we need to disable for the Windows Server 2012 Hyper-V servers


If we double click on the Port Connectivity monitor to view its properties, we can see that its management pack is indeed the Microsoft Windows Hyper-V 2008 Monitoring one and that its virtual target is the Hyper-V Virtual Network class.


To confirm that this monitor is attempting to open the Microsoft-Windows-Hyper-V-Network-Admin event log that was mentioned in the original error message, we need to click on the Event Log (Unhealthy Events) tab as shown below. Hit the Close button to go back to the Monitors screen to disable this monitor.


Right-click on the Port Connectivity monitor, choose Overrides, select Disable the Monitor and choose the group or object of class that represents your Windows Server 2012 servers.


In this example, I've selected an Object of Class: Hyper-V Virtual Network and I am presented with all of the virtual networks that SCOM has discovered as shown below.


We can see in the screenshot that there are two entries here for Microsoft Network Adapter Multiplexor Driver - Virtual Switch and these two entries represent the two Windows Server 2012 Hyper-V hosts that I have deployed SCOM agents to. These are also the two servers that I constantly get the warning health state and alert about not being able to access the windows event log.

If I choose one of these entries and then hit OK, I will then be to the Override Properties window with the Enabled option set to False (as I had selected to disable this monitor earlier.) All that's left for me to do now is to add in a description for the override and choose an unsealed management pack to store it in - see below for details on what I've done


Once you've made the override, click on the OK button to close the Override properties window to return to the Monitors screen.

You will need to repeat this process again for one more monitor - this time selecting the Port Disconnectivity one as shown below


Once you have disabled both monitors for all Windows Server 2012 Hyper-V servers in your environment, then this alert will disappear and health states will return to a valid representation of the agents.

Share this post

Link to post
Share on other sites

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.

Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.

Sign in to follow this  

  • Create New...