SCOM Event Collection Rule

Question

Hi team,

SCOM only able to collect 1st two events geneated from scom management server. every 5 minutes 5to 8 events are generating in event viwer, but scom only colleting 2 events, Any limition or this is the common issue with in the scom.

Please do suggest any alternative option.

SCOM Version is 2016.

<Rule ID="Rule.StateChangeAlerts" Enabled="true" Target="SCOMMagementServer.Class" ConfirmDelivery="true" Remotable="true" Priority="Normal" DiscardLevel="100">
<Category>EventCollection</Category>
<DataSources>
<DataSource ID="DS" TypeID="Windows!Microsoft.Windows.EventCollector">
<ComputerName>$Target/Host/Property[Type="Windows!Microsoft.Windows.Computer"]/NetworkName$</ComputerName>
<LogName>TestAPP</LogName>
<AllowProxying>false</AllowProxying>
<Expression>
<And>
<Expression>
<SimpleExpression>
<ValueExpression>
<XPathQuery Type="UnsignedInteger">EventDisplayNumber</XPathQuery>
</ValueExpression>
<Operator>Equal</Operator>
<ValueExpression>
<Value Type="UnsignedInteger">600</Value>
</ValueExpression>
</SimpleExpression>
</Expression>
<Expression>
<SimpleExpression>
<ValueExpression>
<XPathQuery Type="String">PublisherName</XPathQuery>
</ValueExpression>
<Operator>Equal</Operator>
<ValueExpression>
<Value Type="String">APP Test Log Monitoring</Value>
</ValueExpression>
</SimpleExpression>
</Expression>
</And>
</Expression>
</DataSource>
</DataSources>
<WriteActions>
<WriteAction ID="CollectToDB" TypeID="SC!Microsoft.SystemCenter.CollectEvent" />
<WriteAction ID="CollectToDW" TypeID="SCDW!Microsoft.SystemCenter.DataWarehouse.PublishEventData" />
</WriteActions>
</Rule>

Answer 1

Hi,

there isn't a limitation when it comes to the number of events, collected by SCOM. I have recently used a rule, which collected tens of dozens of events per second. Maybe there is some limit there, but it surely you cannot reach it with 8 events. This being said, I have to ask whether the rule you have configured (cannot tell based on the XML config for sure if this is a GUI generated rule or authored one) is created in the console or authored in another way (Silect MP author, Visual Studio, etc.)?

Can you please post some screenshots of the configuration here or the XML code formatted with the "code format" option:

Thanks in advance!
Regards,
Stoyan

-----------------------------------------------------------------------------------------

Please don't forget to "Accept Answer" and upvote if the response helped you.
Stoyan