SCOM DFS Backlog count is giving FALSE alert

Question

Hi  ;
I've created a backlog count monitor using a 2 state monitor ( which I got from http://arbappy.blogspot.hk/2012/04/create-scom-2007-r2-monitor-to-alert-on.html )
It is used to monitor 70 of our DFS servers.
The monitor should be working under this rule :-
1) if backlog count is greater or equal to 5000 files , status become unhealthy(critical) and alert is generated.
2) if backlog is less than 5000 , status is healthy and no alert is generated.
I have configured the subscription only to send critical alerts.
Problem is that I do get alert for healthy status and it happens only to some servers.On top, it is random. Today could be X server , tomorrow could be Y . Both are healthy ( which meant having less than 5000 files.) . It seems the rule is not working really
well. Any help is much appreciated.
Cheers
megat

Answer 1

1. About the different time stamp, I think because the server is located on a different time zone from the RMS. The server is 2 hours earlier .
2. Backlogcountfile is property of replicationconnection ? I guess so. Nevertheless could you advise to confirm that.
3. Below is the XML which I managed to export.
<ManagementPack ContentReadable="true" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsl="http://www.w3.org/1999/XSL/Transform">
  <Manifest>
    <Identity>
      <ID>RWDFSBACKLOGMONITORINGSCRIPTSMMO</ID>
      <Version>1.0.0.0</Version>
    </Identity>
    <Name>RW_DFS_BACKLOG_MONITORING_SCRIPTS_MMO</Name>
    <References>
      <Reference Alias="MicrosoftWindowsDfsReplication6063210">
        <ID>Microsoft.Windows.DfsReplication</ID>
        <Version>6.0.6321.0</Version>
        <PublicKeyToken>31bf3856ad364e35</PublicKeyToken>
      </Reference>
      <Reference Alias="MicrosoftWindowsLibrary6172210">
        <ID>Microsoft.Windows.Library</ID>
        <Version>6.1.7221.0</Version>
        <PublicKeyToken>31bf3856ad364e35</PublicKeyToken>
      </Reference>
      <Reference Alias="SystemLibrary6172210">
        <ID>System.Library</ID>
        <Version>6.1.7221.0</Version>
        <PublicKeyToken>31bf3856ad364e35</PublicKeyToken>
      </Reference>
      <Reference Alias="SystemCenter">
        <ID>Microsoft.SystemCenter.Library</ID>
        <Version>6.1.7221.61</Version>
        <PublicKeyToken>31bf3856ad364e35</PublicKeyToken>
      </Reference>
      <Reference Alias="Health">
        <ID>System.Health.Library</ID>
        <Version>6.1.7221.0</Version>
        <PublicKeyToken>31bf3856ad364e35</PublicKeyToken>
      </Reference>
    </References>
  </Manifest>
  <Monitoring>
    <Monitors>
      <UnitMonitor ID="UIGeneratedMonitor61be896a832e4ffa8868c1e10c6711cc" Accessibility="Public" Enabled="false" Target="MicrosoftWindowsDfsReplication6063210!Microsoft.Windows.DfsReplication.ReplicationConnection" ParentMonitorID="Health!System.Health.AvailabilityState"
Remotable="true" Priority="Normal" TypeID="MicrosoftWindowsLibrary6172210!Microsoft.Windows.TimedScript.ThreeStateMonitorType" ConfirmDelivery="false">
        <Category>Custom</Category>
        <AlertSettings AlertMessage="UIGeneratedMonitor61be896a832e4ffa8868c1e10c6711cc_AlertMessageResourceID">
          <AlertOnState>Error</AlertOnState>
          <AutoResolve>true</AutoResolve>
          <AlertPriority>High</AlertPriority>
          <AlertSeverity>Error</AlertSeverity>
          <AlertParameters>
            <AlertParameter1>$Target/Property[Type="MicrosoftWindowsDfsReplication6063210!Microsoft.Windows.DfsReplication.ReplicationConnection"]/ReplicationGroupName$</AlertParameter1>
            <AlertParameter2>$Target/Property[Type="MicrosoftWindowsDfsReplication6063210!Microsoft.Windows.DfsReplication.ReplicationConnection"]/ReplicatedFolderName$</AlertParameter2>
            <AlertParameter3>$Target/Property[Type="MicrosoftWindowsDfsReplication6063210!Microsoft.Windows.DfsReplication.ReplicationConnection"]/SendingMemberName$</AlertParameter3>
            <AlertParameter4>$Target/Property[Type="MicrosoftWindowsDfsReplication6063210!Microsoft.Windows.DfsReplication.ReplicationConnection"]/ReceivingMemberName$</AlertParameter4>
            <AlertParameter5>$Target/Property[Type="MicrosoftWindowsDfsReplication6063210!Microsoft.Windows.DfsReplication.ReplicationConnection"]/BacklogCount$</AlertParameter5>
            <AlertParameter6>$Target/Property[Type="SystemLibrary6172210!System.Entity"]/DisplayName$</AlertParameter6>
          </AlertParameters>
        </AlertSettings>
        <OperationalStates>
          <OperationalState ID="UIGeneratedOpStateId751249f015634144b909f400c3106b84" MonitorTypeStateID="Success" HealthState="Success" />
          <OperationalState ID="UIGeneratedOpStateId7c713b8c8aa44c518dbc05007f38b71e" MonitorTypeStateID="Warning" HealthState="Warning" />
          <OperationalState ID="UIGeneratedOpStateIdcda0005310e9480dba2726cc8fc9e1d3" MonitorTypeStateID="Error" HealthState="Error" />
        </OperationalStates>
        <Configuration>
          <IntervalSeconds>60</IntervalSeconds>
          <SyncTime />
          <ScriptName>RW-DFS-SCRIPT-MMO.vbs</ScriptName>
          <Arguments>$Target/Property[Type="MicrosoftWindowsDfsReplication6063210!Microsoft.Windows.DfsReplication.ReplicationConnection"]/BacklogCount$</Arguments>
          <ScriptBody>Set oArgs = WScript.Arguments
numbers=oArgs(0)
Dim oAPI, oBag
Set oAPI = CreateObject("MOM.ScriptAPI")
Set oBag = OAPI.CreatePropertyBag()
Call oBag.AddValue("BackLogCountFile",numbers)
Call oAPI.Return(oBag)</ScriptBody>
          <TimeoutSeconds>1200</TimeoutSeconds>
          <ErrorExpression>
            <SimpleExpression>
              <ValueExpression>
                <XPathQuery Type="String">Property[@Name='BackLogCountFile']</XPathQuery>
              </ValueExpression>
              <Operator>GreaterEqual</Operator>
              <ValueExpression>
                <Value Type="String">5000</Value>
              </ValueExpression>
            </SimpleExpression>
          </ErrorExpression>
          <WarningExpression>
            <And>
              <Expression>
                <SimpleExpression>
                  <ValueExpression>
                    <XPathQuery Type="String">Property[@Name='BackLogCountFile']</XPathQuery>
                  </ValueExpression>
                  <Operator>GreaterEqual</Operator>
                  <ValueExpression>
                    <Value Type="String">100</Value>
                  </ValueExpression>
                </SimpleExpression>
              </Expression>
              <Expression>
                <SimpleExpression>
                  <ValueExpression>
                    <XPathQuery Type="String">Property[@Name='BackLogCountFile'] </XPathQuery>
                  </ValueExpression>
                  <Operator>Less</Operator>
                  <ValueExpression>
                    <Value Type="String">5000</Value>
                  </ValueExpression>
                </SimpleExpression>
              </Expression>
            </And>
          </WarningExpression>
          <SuccessExpression>
            <And>
              <Expression>
                <SimpleExpression>
                  <ValueExpression>
                    <XPathQuery Type="String">Property[@Name='BackLogCountFile']</XPathQuery>
                  </ValueExpression>
                  <Operator>GreaterEqual</Operator>
                  <ValueExpression>
                    <Value Type="String">0</Value>
                  </ValueExpression>
                </SimpleExpression>
              </Expression>
              <Expression>
                <SimpleExpression>
                  <ValueExpression>
                    <XPathQuery Type="String">Property[@Name='BackLogCountFile']</XPathQuery>
                  </ValueExpression>
                  <Operator>Less</Operator>
                  <ValueExpression>
                    <Value Type="String">100</Value>
                  </ValueExpression>
                </SimpleExpression>
              </Expression>
            </And>
          </SuccessExpression>
        </Configuration>
      </UnitMonitor>
      <UnitMonitor ID="UIGeneratedMonitor73d3c5593c8e43ef8ff223d94c1c1ebc" Accessibility="Public" Enabled="true" Target="MicrosoftWindowsDfsReplication6063210!Microsoft.Windows.DfsReplication.ReplicationConnection" ParentMonitorID="Health!System.Health.AvailabilityState"
Remotable="true" Priority="Normal" TypeID="MicrosoftWindowsLibrary6172210!Microsoft.Windows.TimedScript.TwoStateMonitorType" ConfirmDelivery="false">
        <Category>Custom</Category>
        <AlertSettings AlertMessage="UIGeneratedMonitor73d3c5593c8e43ef8ff223d94c1c1ebc_AlertMessageResourceID">
          <AlertOnState>Error</AlertOnState>
          <AutoResolve>true</AutoResolve>
          <AlertPriority>High</AlertPriority>
          <AlertSeverity>MatchMonitorHealth</AlertSeverity>
          <AlertParameters>
            <AlertParameter1>$Target/Property[Type="MicrosoftWindowsDfsReplication6063210!Microsoft.Windows.DfsReplication.ReplicationConnection"]/ReplicationGroupName$</AlertParameter1>
            <AlertParameter2>$Target/Property[Type="MicrosoftWindowsDfsReplication6063210!Microsoft.Windows.DfsReplication.ReplicationConnection"]/ReplicatedFolderName$</AlertParameter2>
            <AlertParameter3>$Target/Property[Type="MicrosoftWindowsDfsReplication6063210!Microsoft.Windows.DfsReplication.ReplicationConnection"]/SendingMemberName$</AlertParameter3>
            <AlertParameter4>$Target/Property[Type="MicrosoftWindowsDfsReplication6063210!Microsoft.Windows.DfsReplication.ReplicationConnection"]/ReceivingMemberName$</AlertParameter4>
            <AlertParameter5>$Target/Property[Type="MicrosoftWindowsDfsReplication6063210!Microsoft.Windows.DfsReplication.ReplicationConnection"]/BacklogCount$</AlertParameter5>
            <AlertParameter6>$Target/Property[Type="SystemLibrary6172210!System.Entity"]/DisplayName$</AlertParameter6>
          </AlertParameters>
        </AlertSettings>
        <OperationalStates>
          <OperationalState ID="UIGeneratedOpStateIdd2ce36df64964c848bd1a155c2d3d56b" MonitorTypeStateID="Success" HealthState="Success" />
          <OperationalState ID="UIGeneratedOpStateId77f67a08c47d4d4b9677a854aef66cc9" MonitorTypeStateID="Error" HealthState="Error" />
        </OperationalStates>
        <Configuration>
          <IntervalSeconds>86400</IntervalSeconds>
          <SyncTime>07:40</SyncTime>
          <ScriptName>RW_DFS_TwoBasedLine.vbs</ScriptName>
          <Arguments>$Target/Property[Type="MicrosoftWindowsDfsReplication6063210!Microsoft.Windows.DfsReplication.ReplicationConnection"]/BacklogCount$</Arguments>
          <ScriptBody>Set oArgs = WScript.Arguments
numbers=oArgs(0)
Dim oAPI, oBag
Set oAPI = CreateObject("MOM.ScriptAPI")
Set oBag = OAPI.CreatePropertyBag()
Call oBag.AddValue("BackLogCountFile",numbers)
Call oAPI.Return(oBag)</ScriptBody>
          <TimeoutSeconds>3600</TimeoutSeconds>
          <ErrorExpression>
            <SimpleExpression>
              <ValueExpression>
                <XPathQuery Type="String">Property[@Name='BackLogCountFile']</XPathQuery>
              </ValueExpression>
              <Operator>GreaterEqual</Operator>
              <ValueExpression>
                <Value Type="String">5000</Value>
              </ValueExpression>
            </SimpleExpression>
          </ErrorExpression>
          <SuccessExpression>
            <And>
              <Expression>
                <SimpleExpression>
                  <ValueExpression>
                    <XPathQuery Type="String">Property[@Name='BackLogCountFile']</XPathQuery>
                  </ValueExpression>
                  <Operator>GreaterEqual</Operator>
                  <ValueExpression>
                    <Value Type="String">0</Value>
                  </ValueExpression>
                </SimpleExpression>
              </Expression>
              <Expression>
                <SimpleExpression>
                  <ValueExpression>
                    <XPathQuery Type="String">Property[@Name='BackLogCountFile']</XPathQuery>
                  </ValueExpression>
                  <Operator>Less</Operator>
                  <ValueExpression>
                    <Value Type="String">5000</Value>
                  </ValueExpression>
                </SimpleExpression>
              </Expression>
            </And>
          </SuccessExpression>
        </Configuration>
      </UnitMonitor>
    </Monitors>
  </Monitoring>
  <Presentation>
    <Folders>
      <Folder ID="Folder_dcff3c90ef4740ff97397eb40d82225f" Accessibility="Public" ParentFolder="SystemCenter!Microsoft.SystemCenter.Monitoring.ViewFolder.Root" />
    </Folders>
    <StringResources>
      <StringResource ID="UIGeneratedMonitor61be896a832e4ffa8868c1e10c6711cc_AlertMessageResourceID" />
      <StringResource ID="UIGeneratedMonitor73d3c5593c8e43ef8ff223d94c1c1ebc_AlertMessageResourceID" />
    </StringResources>
  </Presentation>
  <LanguagePacks>
    <LanguagePack ID="DAN" IsDefault="false">
      <DisplayStrings>
        <DisplayString ElementID="RWDFSBACKLOGMONITORINGSCRIPTSMMO">
          <Name>RW_DFS_BACKLOG_MONITORING_SCRIPTS_MMO</Name>
        </DisplayString>
        <DisplayString ElementID="Folder_dcff3c90ef4740ff97397eb40d82225f">
          <Name>RW_DFS_BACKLOG_MONITORING_SCRIPTS_MMO</Name>
        </DisplayString>
        <DisplayString ElementID="UIGeneratedMonitor61be896a832e4ffa8868c1e10c6711cc">
          <Name>RW_DFS-R BACKLOG COUNT MONITOR</Name>
        </DisplayString>
        <DisplayString ElementID="UIGeneratedMonitor61be896a832e4ffa8868c1e10c6711cc" SubElementID="UIGeneratedOpStateId751249f015634144b909f400c3106b84">
          <Name>Healthy</Name>
        </DisplayString>
        <DisplayString ElementID="UIGeneratedMonitor61be896a832e4ffa8868c1e10c6711cc" SubElementID="UIGeneratedOpStateIdcda0005310e9480dba2726cc8fc9e1d3">
          <Name>Unhealthy</Name>
        </DisplayString>
        <DisplayString ElementID="UIGeneratedMonitor61be896a832e4ffa8868c1e10c6711cc" SubElementID="UIGeneratedOpStateId7c713b8c8aa44c518dbc05007f38b71e">
          <Name>Degraded</Name>
        </DisplayString>
        <DisplayString ElementID="UIGeneratedMonitor61be896a832e4ffa8868c1e10c6711cc_AlertMessageResourceID">
          <Name>Replication Backlog Alert</Name>
          <Description>Incident Team :- Backlog of DFS Server
Replication Group:
{0}
Replicated Folders:
{1}
Sending member:
{2}
Receiving member:
{3}
Backlog Count:
{4}
Display Name : {5}</Description>
        </DisplayString>
        <DisplayString ElementID="UIGeneratedMonitor73d3c5593c8e43ef8ff223d94c1c1ebc">
          <Name>RW_DFS_Backlog_Count_TwoBasedLine_MMO</Name>
          <Description>This monitor is for Incident Team</Description>
        </DisplayString>
        <DisplayString ElementID="UIGeneratedMonitor73d3c5593c8e43ef8ff223d94c1c1ebc" SubElementID="UIGeneratedOpStateId77f67a08c47d4d4b9677a854aef66cc9">
          <Name>Unhealthy</Name>
        </DisplayString>
        <DisplayString ElementID="UIGeneratedMonitor73d3c5593c8e43ef8ff223d94c1c1ebc" SubElementID="UIGeneratedOpStateIdd2ce36df64964c848bd1a155c2d3d56b">
          <Name>Healthy</Name>
        </DisplayString>
        <DisplayString ElementID="UIGeneratedMonitor73d3c5593c8e43ef8ff223d94c1c1ebc_AlertMessageResourceID">
          <Name>RW_DFS_Backlog_Count_TwoBasedLine_MMO</Name>
          <Description>Incident Team :- DFS Backlog Files ( run at 0400 daily)
Replication Group:
{0}
Replicated Folders:
{1}
Sending member:
{2}
Receiving member:
{3}
Backlog Count:
{4}
Display Name : {5}</Description>
        </DisplayString>
      </DisplayStrings>
    </LanguagePack>
    <LanguagePack ID="ENU" IsDefault="false">
      <DisplayStrings>
        <DisplayString ElementID="RWDFSBACKLOGMONITORINGSCRIPTSMMO">
          <Name>RW_DFS_BACKLOG_MONITORING_SCRIPTS_MMO</Name>
        </DisplayString>
        <DisplayString ElementID="Folder_dcff3c90ef4740ff97397eb40d82225f">
          <Name>RW_DFS_BACKLOG_MONITORING_SCRIPTS_MMO</Name>
        </DisplayString>
        <DisplayString ElementID="UIGeneratedMonitor61be896a832e4ffa8868c1e10c6711cc">
          <Name>RW_DFS-R BACKLOG COUNT MONITOR</Name>
        </DisplayString>
        <DisplayString ElementID="UIGeneratedMonitor61be896a832e4ffa8868c1e10c6711cc" SubElementID="UIGeneratedOpStateId751249f015634144b909f400c3106b84">
          <Name>Healthy</Name>
        </DisplayString>
        <DisplayString ElementID="UIGeneratedMonitor61be896a832e4ffa8868c1e10c6711cc" SubElementID="UIGeneratedOpStateIdcda0005310e9480dba2726cc8fc9e1d3">
          <Name>Unhealthy</Name>
        </DisplayString>
        <DisplayString ElementID="UIGeneratedMonitor61be896a832e4ffa8868c1e10c6711cc" SubElementID="UIGeneratedOpStateId7c713b8c8aa44c518dbc05007f38b71e">
          <Name>Degraded</Name>
        </DisplayString>
        <DisplayString ElementID="UIGeneratedMonitor61be896a832e4ffa8868c1e10c6711cc_AlertMessageResourceID">
          <Name>RW_DFS-R BACKLOG_COUNT_MONITOR_MMO</Name>
          <Description>This alert is run every one hour to see any back log. Kindly contact
Megat for further details.</Description>
        </DisplayString>
        <DisplayString ElementID="UIGeneratedMonitor73d3c5593c8e43ef8ff223d94c1c1ebc">
          <Name>RW_DFS_Backlog_Count_TwoBasedLine_MMO</Name>
          <Description>This monitor is for Incident Team</Description>
        </DisplayString>
        <DisplayString ElementID="UIGeneratedMonitor73d3c5593c8e43ef8ff223d94c1c1ebc" SubElementID="UIGeneratedOpStateId77f67a08c47d4d4b9677a854aef66cc9">
          <Name>Unhealthy</Name>
        </DisplayString>
        <DisplayString ElementID="UIGeneratedMonitor73d3c5593c8e43ef8ff223d94c1c1ebc" SubElementID="UIGeneratedOpStateIdd2ce36df64964c848bd1a155c2d3d56b">
          <Name>Healthy</Name>
        </DisplayString>
        <DisplayString ElementID="UIGeneratedMonitor73d3c5593c8e43ef8ff223d94c1c1ebc_AlertMessageResourceID">
          <Name>RW_DFS_Backlog_Count_TwoBasedLine_MMO</Name>
          <Description>Incident Team :- Backlog of DFS Server_TwoBasedLine
Replication Group:
{0}
Replicated Folders:
{1}
Sending member:
{2}
Receiving member:
{3}
Backlog Count:
{4}
Display Name : {5}</Description>
        </DisplayString>
      </DisplayStrings>
    </LanguagePack>
  </LanguagePacks>
</ManagementPack>