Operations Manager - KMS Idle Minutes Monitor Alerts - False Positives As Event ID 12290 Still Being Logged

Question

Hi all,
I am using System Center 2012 R2 Operations Manager with the Key Management Service Management Pack at version 6.0.7234.0, and I keep receiving the following alert in Operations Manager:
"Idle Minutes Monitor Alert:
Key Management Service (KMS) inactivity exceeded threshold
Knowledge:
Summary:
The purpose of this rule is to alert system administrators to a possible KMS or network outage. This rule monitors the end-to-end operation of KMS activation. A notification event is created by KMS if no activation or renewal requests were logged by KMS
(activity event 12290) in the specified time interval. In addition to new activations, periodic renewal requests are expected to occur (default is 7 days). Whether or not this alert is serious depends on the number of machines in the KMS environment, how many
are actually connected, and the configured renewal interval.
Causes:
Any failure or incorrect configuration of the KMS service, other Windows components, firewall, hardware, network or routers can trigger the Idle Minutes Alert. This alert can also result from normal behavior, since it is possible that not enough machines
attempted to activate or renew during the specified time interval.
Resolutions:
The first step is to determine whether there really is a problem. Start with a known good KMS client and run (with elevated privileges) the script slmgr.vbs -ato . If the activation/renewal fails, it will report an error code. You can direct the client to
connect to a specific KMS machine by using the slmgr.vbs -skms option. The request event (12288) and response event (12289) in the Windows Application event log may provide additional information, including the identity of failing KMS machines. If there has
been a failure, check the following:
Software Licensing service (slsvc) is running.
Other KMS machine behavior is normal.
KMS firewall port is open (default is TCP 1688).
Attempt to connect to KMS using telnet to the KMS port(you won’t be able to do anything other than connect)
Use a network monitor (e.g. netmon) to capture and trace network problems.
There is one Idle Minutes Monitor that is used to monitor for activity. It may be desirable to adjust the time threshold, depending on expected KMS activity."
Despite what the alert says, there are activity events with ID 12290 being logged, but they are appearing under the 'Key Management Service' log instead of the general 'Application' log.  I know that my clients are activating with the server without
any problems as I have run slmgr.vbs -ato with success on a number of them, and none are stating that activation is required.  This issue was previously raised here:
http://social.technet.microsoft.com/Forums/systemcenter/en-US/1391acf8-f0be-4a48-9039-8d24e275f1fd/kms-idle-time-monitor-raise-wrong-alerts?forum=operationsmanagermgmtpacks, but  I am running Windows Server 2008 R2 SP1 and the hotfix KB981314 comes
up as 'not applicable to this computer' so I assume it is part of SP1 now.  I have also tried installing KB2692929, as that was cited as being a possible fix here:
http://social.technet.microsoft.com/Forums/systemcenter/en-US/8ec8ae5b-a310-4b0f-9a5f-e0599bceb93a/kms-managementpack?forum=operationsmanagermgmtpacks, however I am still seeing the same alerts.
Would greatly appreciate any further suggestions!
Many thanks

Answer 1

Hi,
I've checked for all the events that are generated by our servers, and there are periods of time where no requests are received for up to 18 hours, so that is no doubt why the alerts are appearing (we then sometimes see five requests in the same minute,
but there we go).  I'll need to adjust the thresholds.
Thank you for your help, Chunky.1, I'll mark your reply as the answer, as it was very helpful in understanding the alert.
For anyone else who needs to check this, create a PowerShell script using the following content, and place your own details into the relevant sections in bold (without the brackets, of course).  This will generate a csv file which will have the server
name in one column and the time that the request event was generated - you can then check the gaps between the requests.  The script is quick and dirty, with no checks along the way, so feel free to embellish it as required.
Out-File "<directory to place file in>\KMS_check_results.csv"
$results = get-eventlog -ComputerName <KMS server hostname> -logname 'Key Management Service'|where{$_.message -match "<String which identifies servers instead of clients>"}
$filteredresults = @()
foreach($event in $results){
    #This splits up the message into sections, separated by commas, and places each section as an element in an array
    $event.Message -split ","|foreach{
        if($_ -match "<server domain suffix - e.g. contoso.com>"){
            $eventserver = $_
    $timegenerated = $event.TimeGenerated
    $filteredresults += New-Object PSObject -Property @{
        Server = $eventserver
        TimeGenerated = $timegenerated
$filteredresults|select-object server,timegenerated|export-csv "<directory to place file in>\KMS_check_results.csv"  -NoTypeInformation