FTP Log and Alert

[adaniel934]

Mr. Bengtsson,

THank you for your reply; however where do you get the information for
Parameter Name = Params/Param[1] and how do you know what parameter entity
matches what entity for FTP logs? Is there a MS website where this is located
or defined as i have searched high and low for this. Please advise.

Hello adaniel934,
Here is a short guide how to setup logfile monitoring http://contoso.se/blog/?p=174
Here are some ideas for FTP monitoring http://contoso.se/blog/?p=256
and here are some notification scenarios
Anders Bengtsson
Microsoft MVP - System Center Operations Manager
www.contoso.se

Would anyone know how to setup an alert (to email but i think this is
done by notification devices) such that SCOM 2007 checks the FTP logs
on a server (default MS FTP site and log location) and alerts are
generated whenever a specific user (i.e. administrator) tries to
login?

[GD]

This should help with the parameters:
http://blogs.technet.com/kevinholman/archive/2007/12/12/adding-custom-information-to-alert-descriptions-and-notifications.aspx

Cheers

Graham

Post by adaniel934
Mr. Bengtsson,
THank you for your reply; however where do you get the information for
Parameter Name = Params/Param[1] and how do you know what parameter entity
matches what entity for FTP logs? Is there a MS website where this is located
or defined as i have searched high and low for this. Please advise.

Hello adaniel934,
Here is a short guide how to setup logfile monitoring
http://contoso.se/blog/?p=174
Here are some ideas for FTP monitoring http://contoso.se/blog/?p=256
and here are some notification scenarios
Anders Bengtsson
Microsoft MVP - System Center Operations Manager
www.contoso.se

Would anyone know how to setup an alert (to email but i think this is
done by notification devices) such that SCOM 2007 checks the FTP logs
on a server (default MS FTP site and log location) and alerts are
generated whenever a specific user (i.e. administrator) tries to
login?

[adaniel934]

Ok, so i got the alerts to work such that i am alerted; however i got the
alert to work if i created a log file local to the SCOM server. Do need to
share out the ftp log folder on the remote server that i need to monitor?

Post by adaniel934
Mr. Bengtsson,
THank you for your reply; however where do you get the information for
Parameter Name = Params/Param[1] and how do you know what parameter entity
matches what entity for FTP logs? Is there a MS website where this is located
or defined as i have searched high and low for this. Please advise.

Hello adaniel934,
Here is a short guide how to setup logfile monitoring http://contoso.se/blog/?p=174
Here are some ideas for FTP monitoring http://contoso.se/blog/?p=256
and here are some notification scenarios
Anders Bengtsson
Microsoft MVP - System Center Operations Manager
www.contoso.se

Would anyone know how to setup an alert (to email but i think this is
done by notification devices) such that SCOM 2007 checks the FTP logs
on a server (default MS FTP site and log location) and alerts are
generated whenever a specific user (i.e. administrator) tries to
login?

[adaniel934]

i think i found my issue but dont know the fix. I did install the agent on
the remote box, but whats happening is that the alerts are generated once and
then subsequent testing (to generate the alerts again) are not happening. Is
there a suppression option that i am missing so that an alert is generated
everytime?

Hello adaniel934,
The agent running the check needs to read the logs, so try have a agent on
the local FTP Server. Else you will have to share the folder for the agent
reading the logs.
The link GD posted is where I get info about parameters and variables.
Anders Bengtsson
Microsoft MVP - System Center Operations Manager
www.contoso.se

Post by adaniel934
Ok, so i got the alerts to work such that i am alerted; however i got
the alert to work if i created a log file local to the SCOM server. Do
need to share out the ftp log folder on the remote server that i need
to monitor?

Post by adaniel934
Mr. Bengtsson,
THank you for your reply; however where do you get the information
for Parameter Name = Params/Param[1] and how do you know what
parameter entity matches what entity for FTP logs? Is there a MS
website where this is located or defined as i have searched high and
low for this. Please advise.

Hello adaniel934,
Here is a short guide how to setup logfile monitoring
http://contoso.se/blog/?p=174
Here are some ideas for FTP monitoring http://contoso.se/blog/?p=256
and here are some notification scenarios
Anders Bengtsson
Microsoft MVP - System Center Operations Manager
www.contoso.se

Would anyone know how to setup an alert (to email but i think this
is done by notification devices) such that SCOM 2007 checks the FTP
logs on a server (default MS FTP site and log location) and alerts
are generated whenever a specific user (i.e. administrator) tries
to login?

[adaniel934]

So, i figured it out. I was doing everything in Monitors, where in reality
(at least in my world) if you wanted repeat alerts/notifications i needed to
set it up in Rules. I was able to configure just about everything i needed to
do in my test environment. Thanks you both for all your help!

Post by adaniel934
i think i found my issue but dont know the fix. I did install the agent on
the remote box, but whats happening is that the alerts are generated once and
then subsequent testing (to generate the alerts again) are not happening. Is
there a suppression option that i am missing so that an alert is generated
everytime?

Hello adaniel934,
The agent running the check needs to read the logs, so try have a agent on
the local FTP Server. Else you will have to share the folder for the agent
reading the logs.
The link GD posted is where I get info about parameters and variables.
Anders Bengtsson
Microsoft MVP - System Center Operations Manager
www.contoso.se

Post by adaniel934
Ok, so i got the alerts to work such that i am alerted; however i got
the alert to work if i created a log file local to the SCOM server. Do
need to share out the ftp log folder on the remote server that i need
to monitor?

Post by adaniel934
Mr. Bengtsson,
THank you for your reply; however where do you get the information
for Parameter Name = Params/Param[1] and how do you know what
parameter entity matches what entity for FTP logs? Is there a MS
website where this is located or defined as i have searched high and
low for this. Please advise.

Hello adaniel934,
Here is a short guide how to setup logfile monitoring
http://contoso.se/blog/?p=174
Here are some ideas for FTP monitoring http://contoso.se/blog/?p=256
and here are some notification scenarios
Anders Bengtsson
Microsoft MVP - System Center Operations Manager
www.contoso.se

Would anyone know how to setup an alert (to email but i think this
is done by notification devices) such that SCOM 2007 checks the FTP
logs on a server (default MS FTP site and log location) and alerts
are generated whenever a specific user (i.e. administrator) tries
to login?

[adaniel934]

Anders or anyone,

So i got the alerting to work perfectly for the group Windows Computer;
however if i create a group called FTP_Group and put my FTP server in to that
group, create an Alert Generating Rule based of Generic CSV Text Log(Alert),
alerts are not generated based on my criteria. However NT Event Log alert
generating rules do work when i use eventcreate via comman line on the same
server in the same group (FTP_Group). Is there something different i need to
do so that custom groups work with CSV Text Logs?

Also, i thought IIS management pack works with IIS FTP logs and we didnt
have to go through Generic CSV Text Log option or am i wrong to think that?

Hello adaniel934,
Notification scenarios http://contoso.se/blog/?p=263
Anders Bengtsson
Microsoft MVP - System Center Operations Manager
www.contoso.se

Would anyone know how to setup an alert (to email but i think this is
done by notification devices) such that SCOM 2007 checks the FTP logs
on a server (default MS FTP site and log location) and alerts are
generated whenever a specific user (i.e. administrator) tries to
login?