tirsdag 25. februar 2014

OpsMgr 2012: Event 26001 is logged regularly on Windows Server 2012 R2 host computers

Microsoft published a KB about this issue recently. You can find it here:

After disabling the two rules I noticed that this event still happend on the Windows Server 2012 R2 host computer. So I did some research.

First I wanted to see where this event came from and executed this PowerShell command against the host:
Invoke-Command -ComputerName host1 -ScriptBlock {get-eventlog Application | where {$_.EventID -eq 26001}|select -First 1}|select Source

Source: Microsoft.SystemCenter.VirtualMachineManager.2012.Report.VPortUsageCollection

Then I wanted to find the Rule, so using Tao Yangs OpsMgr 2012 Self Maintenance Management Pack I was able to back up the sealed management packs to a folder where I got hold of the XML source file for Virtual Machine Manager Management Packs and I assumed it was related to Reports so I opened this: Microsoft.SystemCenter.VirtualMachineManager.2012.Reports.xml

I searched the XML and was able to see that the Source was defined in a DataSource called Microsoft.SystemCenter.VirtualMachineManager.2012.Report.TimedPowerShell.VPortUsagePerformanceProvider wich in turn, when I search for that, was used by the rules Microsoft.SystemCenter.VirtualMachineManager.Network.2012.Vport.BytesReceivedPerSec and Microsoft.SystemCenter.VirtualMachineManager.Network.2012.Vport.BytesSentPerSec

By using PowerShell on the management server I could find the DisplayName and Target for this rule:
Get-SCOMRule -Name Microsoft.SystemCenter.VirtualMachineManager.Network.2012.Vport.*

DisplayName: Virtual port received bytes per second
DisplayName: Virtual port sent Bytes per second
Target: Virtual Port

So, I then disabled the rules in Authoring > Rules > Scope to Virtual Port. After that the event logs stopped.