SCOM Management Server showing warning with "Event ID 1825 - A security package specific error occurred"
- Today when i checked the SCOM management Server it was in Warning state.
- When i open the health explorer i could see only "Failed to access event log" is selected and its in warning state with error in details "A security package specific error occurred".
- When i tried to access the event log from the SCOM management server it failed with the same error.
- so i decided to do a nslookup of the server and found that the reverse lookup is pointing to the alias of the server rather then the actual server name.
- Once it was resolved things got health again.
- So when you have this issue, its usually issue with the DNS entries which needs to be fixed
How to Create Custom Event ID monitoring using SCOM
- Many Times we get request to create new Event ID monitors which are not default available.Today we will create those Event ID monitors to Monitor Custom Event ID.
- First Install the System Center Operations Manager 2007 R2 Authoring Console.This is the Tool that will help you create Custom Monitoring and very effective tool for developing Managements pack
Step by Step:
Once you Install the Tool open it and click on the Icon Below and select New Management Pack and give a name
- Then Click on "Health Model Tab" and right hand side click New-->Alerting-->Windows Event
- This will Open the Windows Event ID Custom Monitoring Pane
- Now give it a Name "Event ID 7040 Monitoring"
- Then Click on Target and Select "Browse All Classes"
- Now Check "List" and Search for "Windows Computers" and Select it
- In Category select "Alerts" and Click Next
- Now in The Log Name Give a Event Log where the event is logged. In our Case we Select "System". Then click Next
- Now Enter the "Event ID" and "Event Source" and Click Next
- Give the Alert the Name you want and click Finish
- Now Save the MP in Top and Import it in your Environment to Monitor this Event ID
