my personal blog about systemcenter

Data Protection Manager , Audit Recovery Operations with SCOM

 

I recently ran into a task where a customer wanted a simple alerting of all restores that was completed, so this was just a simple alerting rule that would trigger on completed jobs

image

Data Protection Manager logs into the DPM Alerts log on the DPM server all jobs including recovery jobs , so here we have DPM-EM as source and 3112 as Completed

image

In Operations Manager I created a new management pack called auditing and a NT Event Log Alert Generating Rule

image

The rule is target at DPM Seed provided in the Data Protection Management Pack provided by Microsoft , and Rule is disabled per default

image

We need to monitor the DPM Alerts Event Log

image

And event 3112 from DPM-EM , need to see if the event changed if a recovery operations fails but for the purpose this was “enough” to start with

image

Severity created as Informational as this is a permitted operation but just need auditing

image

On the rules tab find the newly created rule

image

And create a override “For a specific object of class : DPM seed”

image

And select the DPM server you want monitored , if all servers needs to be monitored without admin interaction keep the default enabled instead of disabled

image

And override the Enabled to True.

 

image

image

And on the DPM server verify that the Management Pack have been delivered and updated configuration is enabled

image

And on the DPM server select a object to recover

image

 

Recovery Job started

image

And we can verify in the event log that it have completed.

image

And in our Operations Manger Console we can see the alert , we are still missing meta data except destination but that can be looked up in Data Protection Manager

image

And to make the job easier for the Audit we can create a Notification Subscription

image

Give the subscription a name to remember

image

Set a resolution state as New for dependency for the alert so closing alerts wont send off a second mail

image

Select the Auditing mailbox as target for the alert

image

And try a recovery job again and verify that the alerting works