OpsMgr Warning events (Source: HealthService; Event ID: 1207)

Question

Hello,
Literally hundreds of the following Warning messages are being generated per hour on all 5 nodes in one of on of our MSCS 2003 clusters:
 Source: HealthService
 Event ID: 1207
 Description: Rule/Monitor "Microsoft.SystemCenter.ACS.Forwarder.PrivateBytesThreshold" running for remote instance "Microsoft.SystemCenter.ACS.Forwarder" with id:"{D2FF9A37-D5BF-9968-6B7E-EE6D90001DDE}" will be disabled as it is not remotable. Management group "X".
 Source: HealthService
 Event ID: 1207
 Description: Rule/Monitor "Microsoft.SystemCenter.ACS.Forwarder.HandleCountThreshold" running for remote instance "Microsoft.SystemCenter.ACS.Forwarder" with id:"{D2FF9A37-D5BF-9968-6B7E-EE6D90001DDE}" will be disabled as it is not remotable. Management group "X".
The interesting thing is that the “id” cycles through the following set of GUIDs:
- {ABDAAE46-AE0A-C645-FC82-0315D143ED6A}
- {53200CAA-9766-E6BE-689F-D458F569484A}
- {F8826B3C-0FBB-AB87-B543-A1E57BF18380}
- {D2FF9A37-D5BF-9968-6B7E-EE6D90001DDE}
- {19C2878B-B222-7006-363A-135E2C3D94E5}
- {FCF20CB2-1A6A-6812-F024-E7FFFB296373}
Though I’ve managed to find the associated rule in an exported copy of the Microsoft Audit Collection Services Management Pack, the only thing I’ve managed to accomplish is to confirm that the rules are indeed not “remotable”.  Having recently learned this to mean they cannot by run remotely against agentless systems, I believe that it has something to do with the virtual servers found on the node in question.  It is likely that each distinct ID represents a separate instance of the ACS forwarder service.
Also, though we do have another cluster with the Audit Forwarding service running (on both nodes), only one of them is generating the very same warnings.  Consequently, my guess is that this might be a bug related to the Microsoft Audit Collection Services Management Pack.
Is my understanding of the problem correct, and how do I go about resolving this issue?
Thanks,
Larry

Answer 1

Looks like a bug.
The forwarder discovery is targeting Windows Computer.
Cluster virtuals are instances of Windows Computer class.
Therefore - this discovery runs on the node, and the virtual - and if it discovers the forwarder is enabled - it will populate the "Microsoft Audit Collection Services Forwarder" class with cluster virtuals as WELL as the node.
If we would have targeted something like "Agent" or written the discovery to exclude cluster virtuals then this wouldnt be a problem.  You should file this as a bug on connect.microsoft.com.
If you would like to fix it - it is pretty simple.  Just find the discovery:  "Microsoft Audit Collection Services Forwarder Discovery" and then create an override - to disable the discovery, for a Group.  Then create a group of the WINDOWS COMPUTER objects that represent your virtuals.  (Hopefully you have a good naming scheme in place for virtuals).  Then - once this explicit override is in place to disable this discovery - you need to run powershell cmdlet - Remove-DisabledMonitoringObject.
Once you run this with the explicit disable in place - you will see your virtual cluster instances disappear from the Forwarder class - and will no longer try and load these workflows.
At least - I think that will work.  :-)