SCOM Hyper-V 2008 2012 Event Log Issue

I’ve been doing some work with System Center Operations Manager (SCOM) 2012 SP1 for a customer lately and was hit by an issue that I couldn’t seem to find an answer on. The environment incorporates both Hyper-V 2008 R2 and Hyper-V 2012 servers and for the latter, the following alert was being fired:

The Windows Event Log Provider is still unable to open the Microsoft-Windows-Hyper-V-Image-Management-Service-Admin event log on computer ‘vs-01.contoso.com’.
The Provider has been unable to open the Microsoft-Windows-Hyper-V-Image-Management-Service-Admin event log for 720 seconds.

Most recent error details: The specified channel could not be found. Check channel configuration.

SCOM Hyper-V 2008 2012 Alerts

The same alert was also being generated for Microsoft-Windows-Hyper-V-Network-Admin.

Cause

It seems that the MPs for Hyper-V 2008 are incorrectly looking for event logs on 2012 servers which don’t exist in 2012.

Resolution

To solve this, stop the monitors from targetting the 2012 servers:

Head into the Authoring workspace and then under Management Pack Objects click Monitors. From there, click Scope on the toolbar. Select View all targets then click Clear All at the bottom. Enter “Hyper-V” into the box at the top and then click Select All then OK:

SCOM Hyper-V 2008 2012 Scope MPs

Expand Hyper-V Virtual Hard Disk and Hyper-V Virtual Network:

SCOM Hyper-V 2008 2012 Monitors

Click properties on Mounted Drive Read-only, Port Connectivity and Port Disconnectivity and heading to the Event Log tab will show you the Event Log targetted by the monitors which as you’ll see, are the ones we’re having a problem with:

SCOM Hyper-V 2008 2012 Mounted Drive Read-only Properties
SCOM Hyper-V 2008 2012 Port Connectivity Properties
SCOM Hyper-V 2008 2012 Port Disconnectivity Properties

For each of these three montiors, you need to disable them for the 2012 servers. For Mounted Drive Read-only, first right click on the monitor and choose:

SCOM Hyper-V 2008 2012 Override Menu

You can select the Windows Server 2012 Computer Group for this monitor:

SCOM Hyper-V 2008 2012 Group Selection

For the Port Connectivity and Port Disconnectivity monitors you’ll need to disable them “For a specific object of class: Hyper-V Virtual Network” and pick the objects that relate to each of your 2012 Hyper-V machines. For some reason, picking a group as above doesn’t work.

Reset the unhealthy monitors and clear the alerts and you should be good to go.

My thanks go to Kevin Greene for his post on half of the issue which led me down the right path to solving both alerts.

4 thoughts on “SCOM Hyper-V 2008 2012 Event Log Issue

  1. Personally, I found it just easier to create the log on the systems and populate it with a junk message. A quick 4 line script to find all the Hyper-V servers running 2012 did the trick.

  2. We’ve done this yet bizarrely the alert keeps coming back. An overrides summary confirms it is indeed disabled (only difference being we picked our own custom group whose membership is the Windows Server 2012 group – and the server faulting is in there, 100%).

    Wondering if Network-Admin log is now referenced in another monitor – in which case, do you know how we find the appropriate monitor?

  3. good afternoon. I do everything in the article. but the monitor is included, and the rule applies. What else.
    Target Type Inherited From Management Pack Enabled by Default
    Mounted Drive Read-only Manual Reset Hyper-V Virtual Hard disk Microsoft Windows Hyper-V 2008 Monitoring YES

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s