SCOM Management Server showing warning with Event ID 1825 - A security package specific error occurred

SCOM Management Server showing warning with "Event ID 1825 - A security package specific error occurred"

• Today when i checked the SCOM management Server it was in Warning state.
• When i open the health explorer i could see only "Failed to access event log" is selected and its in warning state with error in details "A security package specific error occurred".
• When i tried to access the event log from the SCOM management server it failed with the same error.
• so i decided to do a nslookup of the server and found that the reverse lookup is pointing to the alias of the server rather then the actual server name.
• Once it was resolved things got health again.
• So when you have this issue, its usually issue with the DNS entries which needs to be fixed

How to Create Custom Event ID monitoring using SCOM 2012 R2 - Step by Step

How to Create Custom Event ID monitoring using SCOM

• Many Times we get request to create new Event ID monitors which are not default available.Today we will create those Event  ID monitors to Monitor Custom Event ID.

• First Install the System Center Operations Manager 2007 R2 Authoring Console.This is the Tool that will help you create Custom Monitoring and very effective tool for developing Managements pack

Step by Step:

Once you Install the Tool open it and click on the Icon Below and select New Management Pack and give a name

• Then Click on "Health Model Tab" and right hand side click New-->Alerting-->Windows Event
• This will Open the Windows Event ID Custom Monitoring Pane

• Now give it a Name "Event ID 7040 Monitoring"

• Then Click on Target and Select "Browse All Classes"
• Now Check "List" and Search for "Windows Computers" and Select it

• In Category select "Alerts" and Click Next
• Now in The Log Name Give a Event Log where the event is logged. In our Case we Select "System". Then click Next

• Now Enter the "Event ID" and "Event Source" and Click Next

• Give the Alert the Name you want and click Finish

• Now Save the MP in Top and Import it in your Environment to Monitor this Event ID

Powershell Script to get Event from Application Event Log

Powershell Script to get particual Event from Application Event Log

.You can use the below script to get Eventlog message using Powershell.

$Server='Your Computer Name"
$Yesterday="From Date in DD/MM/YYYY format"
$Today="To Date in DD/MM/YYYY format"
$Event = "Event ID you are looking for"
Get-EventLog -ComputerName $Server -LogName "Application" -after $Yesterday -before $Today| where {$_.EventID -eq $Event}

Show-Eventlog:How to open Event viewer from Powershell

How to open Event viewer from Powershell

• Manytime you might want to open Eventviewer while working in Powershell.
• There is a way to directly open the event viewer from Powershell.
• The Command is Show-Eventlog

• This will directly open the event viewwer from the Powershell