Using an "OR" for monitoring multiple possible event entries

Hi, I am doing a rule to monitor if people are added or removed from the domain admins, built in groups or enterprise admins on Windows 2008 DC's.
This looks like it would be from events 4728, 4729, 4732, 4733, 4755 and 4756.
I could write 6 rules but would prefer just one. I have been looking at "expressions" -
http://support.microsoft.com/kb/2702651/en-gb
but cant really get this going. I have tried 4278 | 4729 for instance as an OR but it dosent work..
Any ideas?
thanks

Hi
refer below link for how to create an event id rule
http://blogs.technet.com/b/kevinholman/archive/2009/02/25/authoring-rules-for-windows-2008-events-and-how-to-cheat.aspx
for AD
http://opsmgrsolutions.wordpress.com/2010/05/17/scom-security-event-monitoring/
https://blogs.technet.com/b/klince/archive/2011/05/18/how-to-configure-scom-to-monitor-for-changes-to-the-domain-admins-group.aspx
Authoring
Regards
sridhar v

Similar Messages

Using central Solution Manager for monitoring multiple customers

Hello,
We are working on monitoring SAP systems of several customers. For every customer we have configured central monitoring on Solution Manager system of that customer. All satellite systems are added to RZ21 and CCMS agents are configured correctly. On the Solution Manager, in RZ20 we have created a rule based monitor specific to the needs of customer, and that monitor is used for the whole landscape of every customer.
But now I need to configure our central Solution Manager system which will collect CCMS data from all satellite systems of all customers on one place in RZ20. That central Solution Manager system should have direct connection only to customer Solution Manager systems and not to their satellite systems. Is this possible? If yes, can you please explain me how to do it or point me to documentation? I was unable to find solution.
To make this more clear I made a picture of desired configuration:
https://picasaweb.google.com/108686894540363563900/SAP#slideshow/5571983242527848482
Edited by: Dejan Terzic on Feb 10, 2011 10:04 AM

Hi Dejan,
as far as I know this is not possible.
we had similar issues, every time we migrated a new customer to or datacenter. Our solution was, to register the CCMS agents to two systems for a period of migration.
Sometime ago, I found a question for that an SDN:
Using another CEN for Solution Manager
I know, that this is not your question exactly, but it is the right direction...
Kind regards

Semantic Logging Custom sink logs multiple times Event entry

using System;
using System.Collections.Generic;
using System.Linq;
using System.Text;
using System.Threading.Tasks;
using Microsoft.Practices.EnterpriseLibrary.SemanticLogging;
using Microsoft.Practices.EnterpriseLibrary.SemanticLogging.Formatters;
using Microsoft.WindowsAzure;
using Microsoft.WindowsAzure.Storage;
using Microsoft.WindowsAzure.Storage.Blob;
using System.Globalization;
using System.IO;
using Microsoft.Practices.EnterpriseLibrary.TransientFaultHandling;
using Microsoft.WindowsAzure.Storage.RetryPolicies;
namespace SemanticLogging.CustomSink
public class AzureBlobSink : IObserver<EventEntry>
private readonly IEventTextFormatter _formatter;
private string ConnectionString { get; set; }
private string ContainerName { get; set; }
private string BlobName { get; set; }
public AzureBlobSink() : base()
System.Net.WebRequest.DefaultWebProxy.Credentials = System.Net.CredentialCache.DefaultNetworkCredentials;
public AzureBlobSink(string connectionString, string containerName, string blobname) : base()
this.ConnectionString = connectionString;
this.ContainerName = containerName;
this.BlobName = blobname;
_formatter = new EventTextFormatter();
public void OnCompleted()
//throw new NotImplementedException();
public void OnError(Exception error)
//throw new NotImplementedException();
SemanticLoggingEventSource.Log.CustomSinkUnhandledFault("Exception: " + error.Message + Environment.NewLine + "Stack trace:" + error.StackTrace + Environment.NewLine + "Inner Exception" + error.InnerException + Environment.NewLine);
public void OnNext(EventEntry value)
if (value != null)
using (var writer = new StringWriter())
_formatter.WriteEvent(value, writer);
Postdata(Convert.ToString(writer), BlobName);
/// <summary>
/// create container and upsert block blob content
/// </summary>
/// <param name="content"></param>
private void Postdata(string content, string blobname)
List<string> blockIds = new List<string>();
var bytesToUpload = Encoding.UTF8.GetBytes(content);
//to set default proxy
System.Net.WebRequest.DefaultWebProxy.Credentials = System.Net.CredentialCache.DefaultNetworkCredentials;
try
using (MemoryStream stream = new MemoryStream(Encoding.UTF8.GetBytes(content),false))
CloudStorageAccount account = CloudStorageAccount.Parse(ConnectionString);
CloudBlobClient blobClient = account.CreateCloudBlobClient();
//linear Retry Policy create a blob container 10 times. The backoff duration is 2 seconds
IRetryPolicy linearRetryPolicy = new LinearRetry(TimeSpan.FromSeconds(2), 10);
//exponential Retry Policy which retries the code to create a blob container 10 times.
IRetryPolicy exponentialRetryPolicy = new ExponentialRetry(TimeSpan.FromSeconds(2), 10);
blobClient.RetryPolicy = linearRetryPolicy;
CloudBlobContainer container = blobClient.GetContainerReference(ContainerName);
container.CreateIfNotExists();
CloudBlockBlob blob = container.GetBlockBlobReference(blobname + System.DateTime.UtcNow.ToString("MMddyyyy") + ".log");
//stream.Seek(0, SeekOrigin.Begin);
if (!blob.Exists())
using (var insertempty = new MemoryStream(Encoding.UTF8.GetBytes("")))
blob.UploadFromStream(insertempty);
blockIds.AddRange(blob.DownloadBlockList(BlockListingFilter.Committed).Select(b => b.Name));
var newId = Convert.ToBase64String(Encoding.UTF8.GetBytes(blockIds.Count.ToString(CultureInfo.InvariantCulture).PadLeft(64, '0')), Base64FormattingOptions.None);
//var newId = Convert.ToBase64String(Encoding.Default.GetBytes(blockIds.Count.ToString()));
blob.PutBlock(newId, new MemoryStream(bytesToUpload), null);
blockIds.Add(newId);
blob.PutBlockList(blockIds);
catch (Exception ex)
SemanticLoggingEventSource.Log.CustomSinkUnhandledFault("Exception: " + ex.Message + Environment.NewLine + "Stack trace:" + ex.StackTrace + Environment.NewLine + "Inner Exception" + ex.InnerException + Environment.NewLine);
I have created custom sink for logging into azure blob.
The code below were giving issue.
when i execute this method,
First time it write log one time in to blob
second time it write log two time.
n-th time it writes n entry to blob.
Actually, the below code executed n time.
public void OnNext(EventEntry value)
if (value != null)
using (var writer = new StringWriter())
_formatter.WriteEvent(value, writer);
Postdata(Convert.ToString(writer), BlobName);
Help me!
Thanks, SaravanaBharathi.A

Hi Saravanabharathi,
Thank you for posting in here.
We are looking into this and will get back to you at earliest. Your patience is greatly appreciated.
Regards,
Manu Rekhar

Can I use IDSM-2 to monitor in inline-mode multiple pair of vlans?

my customer wants to have IDSM-2 in inline mode for monitoring VLANs that are routed through the PIX firewalls.
These VLANs are defined on the Cat 6500 switch where the IDSM-2 resides.
They want to have one external vlan to be paired with 4 internal vlans.
As far as I know the inline VLAN pairs configuration only support one to one vlan pairing.
What's the best of doing this?

Yes, you can very well use the IDSM for monitoring multiple VLANs.
Refer to the configuration guide of the IDSM for more information
http://www.cisco.com/en/US/products/hw/vpndevc/ps4077/products_configuration_guide_chapter09186a008055df92.html

HT204053 How does my spouse get the benefits of using my iCloud for contacts and calanders but not messages, etc?

How does my spouse get the benefits of using my iCloud for contacts and calanders but not messages, etc?

iCloud is designed for personal use and not for managing multiple access. If you gives your password to someone else, this person can benefit everything including access to purchase with your account, email, etc.
You should rather consider having each one an iCloud account and then, create and share a calendar. As for contact, you can send them to your spouse to be save in her account but they cannot be shared nor synced.

Is it possible to use SCOM 2012 R2 with the new Azure Managment Pack to monitor Aure Wadlog Events for azure sdk 2.5

My operations team has been using MOM 2007 and has recently migrated to SCOM 2012 R2.
Till now we are using Monitoring Pack management packs which were released way earlier (https://www.microsoft.com/en-us/download/details.aspx?id=11324),
and had a dependency on diagonstics connection string being present in the cscfg of Azure package.
This pack was allowing us to monitor the wad logs and events generated by applications.
However we plan to move to newer Azure managemen pack (http://www.microsoft.com/en-us/download/details.aspx?id=38414), which allows for discoverability.
I have 2 questions -
Is it possible to monitor Diagonstics Event Log with the new Monitoring Pack released on 10/2014 ? Or will the users still require the earlier pack for monitoring diagnostics installed in parallel ?
Azure SDK 2.5 got rid of diagonstics connection string. Is there any possible way to Monitor of Azure Diagonstics wadlogs using SCOM 2012 R2
Thanks,
Pratush

Hi Pratush,
I would like to suggest you go through the management pack guide to get details. And you should be able to create custom monitor to monitor event logs for Azure.
Hope the below links be helpful for you regarding to monitoring Azure:
How to monitor your Windows Azure application with System Center 2012 (Part 2)
http://blogs.technet.com/b/dcaro/archive/2012/05/03/how-to-monitor-your-windows-azure-application-with-system-center-2012-part-2.aspx
Windows Azure and SCOM 2012
https://social.msdn.microsoft.com/Forums/azure/en-US/ecb409e2-8595-40e8-9a73-757b670b06db/windows-azure-and-scom-2012?forum=windowsazuremanagement
Regards,
Yan Li
Please remember to mark the replies as answers if they help and unmark them if they provide no help. If you have feedback for TechNet Subscriber Support, contact [email protected]

HT1918 Hello! Staff of E4 Group JSC use Apple devices for call, reading email and calendars. When the user open event in calendar of iPhone or iPad, he does not see attachments (picture №1, picture №2). But it is possible on Blackberry (picture №3).

Hello!
Staff of E4 Group JSC use Apple devices for call, reading email and calendars. When the user open event in calendar of iPhone or iPad, he does not see attachments (picture №1, picture №2). But it is possible on Blackberry (picture №3). How user of Apple can see these attachments? Recommend please any apps for it.

Hello!
Staff of E4 Group JSC use Apple devices for call, reading email and calendars. When the user open event in calendar of iPhone or iPad, he does not see attachments (picture №1, picture №2). But it is possible on Blackberry (picture №3). How user of Apple can see these attachments? Recommend please any apps for it.

Use multiple day event in Calendar region

I am using a Calendar region in my application. One issue i have run into is, some of my events are multiple-day events, such as a conference. The calendar application does not seem to be able to deal with multiple-day events. It takes one date as the date. There doesn't seem to be any way of dealing with multiple day events. In my case, I have 2 date fields in my table associated with my calendar - a starting date, and an ending date.
Has anyone found a way to deal with this situation? I don't want to have a separate entry for each date of the event. I'd like to be able to use my start date, and ending date fields.
Thanks,
John

Scott,
I took the SQL you used in your trigger and substituted my table names and fields. I am getting 3 errors. Here is what my code looks like after the substitutions (my table names are 'meetings_tbl' and 'meetings_tbl_cal'):
CREATE OR REPLACE TRIGGER ai_meetings
AFTER UPDATE OR INSERT ON meetings_tbl
FOR EACH ROW
DECLARE
l_date_diff NUMBER;
BEGIN
IF UPDATING THEN
DELETE FROM meetings_tbl_cal WHERE m_id = meetings_tbl.m_id;
END IF;
l_date_diff := meetings_tbl.meeting_end - meetings_tbl.meeting_start;
FOR x IN 0..l_date_diff
LOOP
INSERT INTO meetings_tbl_cal
(m_id, meeting_date)
VALUES
(meetings_tbl.m_id, TO_DATE(meetings_tbl.meeting_start + x));
END LOOP;
END;
I am getting 3 errors:
1) PL/SQL: ORA-00904: "MEETINGS_TBL"."M_ID": invalid identifier
2) PLS-00357: Table,View Or Sequence reference 'MEETINGS_TBL.MEETING_END' not allowed in this context
3) PL/SQL: ORA-00984: column not allowed here
Maybe I'm not supposed to substitute ':NEW' with 'MEETINGS_TBL' ??
Thanks for your help!
John

Job not getting triggered for Multiple Scheduler Events

hi,
I would like a job to be triggered for multiple scheduler events, subscribing to a single event works fine. But, when I set multiple event condition, nothing works.
My objective is to run a job, whenever job starts or restarts or exceeds max run duration.
Note : Is it possible to trigger a job, when a job RESTARTS by subscribing to JOB_START ????????
procedure sniffer_proc(p_message in sys.scheduler$_event_info)
is
--Code
end sniffer_proc
dbms_scheduler.create_program(program_name => 'PROG',
program_action => 'sniffer_proc',
program_type => 'stored_procedure',
number_of_arguments => 1,
enabled => false);
-- Define the meta data on scheduler event to be passed.
dbms_scheduler.define_metadata_argument('PROG',
'event_message',1);
dbms_scheduler.enable('PROG');
dbms_scheduler.create_job
('JOB',
program_name => 'PROG',
* event_condition => 'tab.user_data.event_type = ''JOB_OVER_MAX_DUR''' ||*
*' or tab.user_data.event_type = ''JOB_START''',*
queue_spec => 'sys.scheduler$_event_queue,auagent',
enabled => true);
I tried this too...
dbms_scheduler.create_job
('JOB',
program_name => 'PROG',
* event_condition => 'tab.user_data.event_type = ''JOB_OVER_MAX_DUR''' ||*
*' and tab.user_data.event_type = ''JOB_START''',*
queue_spec => 'sys.scheduler$_event_queue,auagent',
enabled => true);
Need help
Thanks...
Edited by: user602200 on Dec 28, 2009 3:00 AM
Edited by: user602200 on Dec 28, 2009 3:03 AM

Hi,
Here is complete code which I tested on 10.2.0.4 which shows a second job that runs after a first job starts and also when it has exceeded its max run duration. It doesn't have the condition but just runs on every event raised, but the job only raises the 2 events.
Hope this helps,
Ravi.
-- run a job when another starts and exceeds its max_run_duration
set pagesize 200
-- create a user just for this test
drop user test_user cascade;
grant connect, create job, create session, resource,
create table to test_user identified by test_user ;
connect test_user/test_user
-- create a table for output
create table job_output (log_date timestamp with time zone,
        output varchar2(4000));
-- add an event queue subscriber for this user's messages
exec dbms_scheduler.add_event_queue_subscriber('myagent')
-- create the first job and have it raise an event whenever it completes
-- (succeeds, fails or stops)
begin
dbms_scheduler.create_job
   ( 'first_job', job_action =>
     'insert into job_output values(systimestamp, ''first job runs'');'||
     'commit; dbms_lock.sleep(70);',
    job_type => 'plsql_block',
    enabled => false, repeat_interval=>'freq=secondly;interval=90' ) ;
dbms_scheduler.set_attribute ( 'first_job' , 'max_runs' , 2);
dbms_scheduler.set_attribute
    ( 'first_job' , 'raise_events' , dbms_scheduler.job_started);
dbms_scheduler.set_attribute ( 'first_job' , 'max_run_duration' ,
    interval '60' second);
end;
-- create a simple second job that runs when the first starts and after
-- it has exceeded its max_run_duration
begin
dbms_scheduler.create_job('second_job',
                            job_type=>'plsql_block',
                            job_action=>
    'insert into job_output values(systimestamp, ''second job runs'');',
                            event_condition =>
   'tab.user_data.object_name = ''FIRST_JOB''',
                            queue_spec =>'sys.scheduler$_event_queue,myagent',
                            enabled=>true);
end;
-- this allows multiple simultaneous runs of the second job on 11g and up
begin
$IF DBMS_DB_VERSION.VER_LE_10 $THEN
    null;
$ELSE
    dbms_scheduler.set_attribute('second_job', 'parallel_instances',true);
$END
end;
-- enable the first job so it starts running
exec dbms_scheduler.enable('first_job')
-- wait until the first job has run twice
exec dbms_lock.sleep(180)
select * from job_output;

Monitor multiple phone for incoming call

Hello,
I want to monitor multiple phone incoming call (retrieve callerID, ...)
I do that with Tapi, but when you configure TSP, it's only for one phone
I can install TSP several times, but ... for 40 phones ...
Are there other solutions ?
I use CCME

Yes, you can use packet capture to sniff skinny. It works really well, and transparently across CallManager and CallManager Express. You'll need to perform packet decode which is a bit of work, and connect your server to the appropriate SPAN port, of course.

FCPX crashes all the time using the Intensity Pro Card for monitor preview wassup?

I have been using FCPX for a few months and I like it somewhat and could really love it for it not crashing on all my projects. If I scrub the timeline or apply a filter it crashes. I'm using the Blackmagic Intensity Pro card for monitor output and the latest drivers that they put out and can't really get through a project because it crashes all the time.I thought that if i get a different display card it would possible help I have the GForce 120 card which only has 256MB ram.Can anybody put some light on the issue?

FCP X currently does not support Intensity Pro cards.
Andy

I want to use my I Pad mini to play videos from my Gopro Hero HD camera and also to use as a monitor if possible?

I want to use my I Pad mini to play videos from my Gopro Hero HD camera and also to use as a monitor if possible? What software would i need to use ? I movie is what i use with my I Mac not sure if this will work on I Pad Mini?

At first I thought that this solved my problem, but alas it didn't. It does appear to add display area for your computer or to suplement it. But it is not a view screen for your Mini. I guess I will just have to live on with my monitor and use my Ipad and the "remote" app to run Itunes.
Once I have the system all set up, I could use the display but I don't know why I would. Thanks for your help.

Multicasting using TCP/IP for Multiple clients

Hello
i have been watching in Find example Vi's in labview there is are UDP multicasting receiver and sender Vi's Is there
any available for TCP/IP for multiple clients. or any other way to broadcast the messages from server to many clients
Regards

madd wrote:
i have been watching in Find example Vi's in labview there is are UDP multicasting receiver and sender Vi's Is there
any available for TCP/IP for multiple clients. or any other way to broadcast the messages from server to many clients
OK, you are possibly confusing things. UDP is part of TCP/IP. Could it be you are trying to multicast using TCP?
This is not possible. TCP is a connection based protocol, meaning any connection is established between exactly two partners, starting out with the three-way handshake, the data transmission and acknowledgments, and the connection tear down. This ensures complete delivery verification of all communications at the expense of the protocol overhead. (similar to a classic phone connection between two people: First you verify the right person picks up, then you talk, then say goodbye)
UDP is a connectionless protocol, meaning any packets are simply placed on the wire and the protocol itself does not ensure any verification of delivery (similar to e.g. a radio broadcast). Any two-way communication needs to be done by the program, e.g. the receiver could send another UDP packet back to notify the sender that a packet was received.
Broadcast and multicast packets must be connectionless. There is no way around it. You can use UDP for broadcasts and TCP for for data at the same time in the same program, but you cannot combine the two into a single connection. They don't mix.
Maybe I misunderstood. If I did, please clarify what you had in mind. More details!
LabVIEW Champion . Do more with less code and in less time .

Possibility to use self created CCMS monitor sets in DSWP

For monitoring we have created a CCMS monitor set in RZ20. To use DSWP
for monitoring, we need to recreate such a set in DSWP; Is it possible
to use the self created CCMS monitor sets in DSWP? Is there f.e. a way
to import sets from RZ20 to DSWP?

Hello Thiago,
There is no possibility of importing Monitoring Sets from RZ20 to DSWP.
Both the transactions are designed in different way and cannot be synchronized via Import / Export.
Infact the way DSWP would display and classify alerts is totally different from RZ20.
I am sorry but there is no way you could acheive this in any Standard SAP Solution Manager System.
Regards
Amit

I am using my Apple ID on multiple devices for other people. How can I make icloud work only for my devices?

I am using my Apple ID on multiple devices for other people in my family and now I am getting a new iphone and want to take only the information on my old iphone to the new one without the information on the other devices using the same account. Is there a way to do that?
Also, for the future can I use multiple addresses and apple IDs for the same credit card information?
Thanks in advance,
Marian

Ok, so you want to remove data (contacts, bookmarks, calendar etc) from other users from your iCloud/Apple ID?
If you want to use your ID for your family because it is the account everybody uses to buy stuff then you only need to ensure that your apple ID is set up in the store (settings-store) and then the users of each device and put their own apple ID in icloud/message/facetime/etc.
To set up your device, in my opinion, it is best to back up to itunes, and then plug your new device into itunes and "set up as ..." and select the backup from your device. This will import all your data/settings and your new device will be set up just like your old one.
I am not certain about using the same payment method for more than one account.

Using an "OR" for monitoring multiple possible event entries

Similar Messages

Maybe you are looking for