I’ve been doing some work with System Center Operations Manager (SCOM) 2012 SP1 for a customer lately and was hit by an issue that I couldn’t seem to find an answer on. The environment incorporates both Hyper-V 2008 R2 and Hyper-V 2012 servers and for the latter, the following alert was being fired:
The Windows Event Log Provider is still unable to open the Microsoft-Windows-Hyper-V-Image-Management-Service-Admin event log on computer ‘vs-01.contoso.com’.
The Provider has been unable to open the Microsoft-Windows-Hyper-V-Image-Management-Service-Admin event log for 720 seconds.
Most recent error details: The specified channel could not be found. Check channel configuration.
The same alert was also being generated for Microsoft-Windows-Hyper-V-Network-Admin.
It seems that the MPs for Hyper-V 2008 are incorrectly looking for event logs on 2012 servers which don’t exist in 2012.
To solve this, stop the monitors from targetting the 2012 servers:
Head into the Authoring workspace and then under Management Pack Objects click Monitors. From there, click Scope on the toolbar. Select View all targets then click Clear All at the bottom. Enter “Hyper-V” into the box at the top and then click Select All then OK:
Expand Hyper-V Virtual Hard Disk and Hyper-V Virtual Network:
Click properties on Mounted Drive Read-only, Port Connectivity and Port Disconnectivity and heading to the Event Log tab will show you the Event Log targetted by the monitors which as you’ll see, are the ones we’re having a problem with:
For each of these three montiors, you need to disable them for the 2012 servers. For Mounted Drive Read-only, first right click on the monitor and choose:
You can select the Windows Server 2012 Computer Group for this monitor:
For the Port Connectivity and Port Disconnectivity monitors you’ll need to disable them “For a specific object of class: Hyper-V Virtual Network” and pick the objects that relate to each of your 2012 Hyper-V machines. For some reason, picking a group as above doesn’t work.
Reset the unhealthy monitors and clear the alerts and you should be good to go.
My thanks go to Kevin Greene for his post on half of the issue which led me down the right path to solving both alerts.