Huntland Services Ltd

Tel: +44 (0)1392-490518
Fax: +44 (0)1392-428003
Enquiries@huntland.co.uk

List Alert Performance(Sp1)

Back

Download The Script

If an Agent has been offline for a while it is not reporting events and alerts.  However it is an illusion to think that when it next connects it will have nothing to report.  Agents queue their information in local buffers (except alerts) and dump this content when the connection resumes.  If the absence is protracted, the capacity of the buffer may be exceeded (By Default 3MB changeable via Mom Configuration settings).  In this case some events will be lost.  However because the NT/Win2k/.Net logs are persistent, the Mom Agent can 'bookmark' the last event it reported.  When it connects again it simply carries on from where it left off.  If the log files are vary active, this could result in the reporting of many thousand of events and their corresponding alerts in a very short space of time.  This could cause the DCAM to choke and take many minutes to eventually clear the backlog.

If you want to see if this is happening you could call up each Alert and check the time interval between when the causal event  first happened, i.e. the event was written to the event log, the time this was detected (could be several days later if the buffer was full), the time it got written to the Database and the time its spent hanging around in its current state.

Or you could just run this script to see the same analysis for all the open alerts for a given agent.  This way you could routinely check to see if there are any latency problems.  Actually there is a standard Mom report for this but does not have the same level of detail.

ListAlertPerformance.vbs

Run from a command prompt, the script takes two parameters, the name of  a (any) Mom DCAM Server and the name of the Agent computer you're interested in.  The script is hard coded to select only those alerts that are not resolved otherwise there might be many thousands.

Cscript.exe ListAlertPerformance.vbs   myDCAMServer   myAgentComputer

Results

Time Of First Event	DB Minutes	To Now Minutes	Current State	Alert Name
12/11/2002 13:54:30	120	360	New	The Domain Controller has been started
12/11/2002 13:52:45	45	245	Level 2	The SQL Server is unavailable (script-detected)
12/11/2002 13:50:16	2	17	Level 1	Script error

Where:

• Time Of First Event - is when the event that caused the alert actually occurred, regardless of when The Agent detected it 
• DB Minutes - is the time taken from the Time Of First Event to the moment it was added to the Database via the DCAM
• To Now Minutes - is the total lapsed time until now, the current system time, from when the event that caused the alert occurred (time of first event)
• Current State - is the state the Alert is now in.  This will be one of the standard or user defined states except 'Resolved'
• Alert Name - the short name of the Alert
  

Custom Task

This script is an ideal candidate to be included in the Mom Admin Console as a Custom Task.  Using a Custom Task you can Right Mouse Click on a Computer Object and have the script run automatically for that computer.   To do this create the Custom Task so that the first parameter is the name of the DCAM and the second parameter is the $computer$ variable extracted from the item that has the current focus.

For information about how to configure WMI scripts as Custom Tasks see Creating A Custom Task. elsewhere on this site.

Please accept this script as is.  Any feedback will be gratefully received at Debug@Huntland.co.uk