#opsmgr & #dpm: backlogged events can cause unnecessary alert noise

The DPM management pack is one of the better management packs put out by Microsoft. It relies on the DPM eventlog to detect most of the issues should they arise.

However, when a lot of protected resources fail to backup over an extended amount of time, this eventlog tends to grow quite fast.

At this point it is possible that the event-generation of DPM ‘outruns’ the detection-speed of SCOM. When this occurs, this alert is raised:

This essentially means that the monitoring-agent on the DPM-server cannot keep up the pace.

 

A nasty side-effect of this issue is that the agent is ‘time travelling’ in the past, essentially catching and alerting on events that occurred hours, even days before. So in order to prevent this unwanted noise, it is important to give the agent some breathing room.

 

The easiest solution is to verify that no issue is currently ongoing on the DPM-system, and then clear the DPM-eventlog (after backing it up if necessary). This will ‘warp’ the agent back to the present time and allow event-processing to run normally. You can then close all false alerts, and the backlog-alert.

Advertisements
This entry was posted in #scom, #sysctr, Uncategorized. Bookmark the permalink.

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Google+ photo

You are commenting using your Google+ account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s