Home
  •  

The System Center Data Access service is unable to write security audit events.

Microsoft.SystemCenter.SDKService.UnableToGenerateAuditEvents.Alert (Rule)

This rule generates an alert if the System Center Data Access service reports that it is unable to write security audit events to the security event log.

Knowledge Base article:

Summary

The Data Access service is unable to log audit events to the security event log.

Causes

The failure may have happened due to insufficient user rights for the Data Access service account.

Resolutions

Steps to fix this problem: 1) Open the "Local Security Policy" MMC snap-in. 2) Go to Local Policies -> User Rights Assignment. 3) Double-click "Generate Security Audits". 4) Add the Data Access service account to the list of accounts allowed to generate security audits. 5) Restart the Data Access service.

Element properties:

TargetMicrosoft.SystemCenter.CollectionManagementServer
CategoryAlert
EnabledTrue
Event_ID26338
Event SourceOpsMgr SDK Service
Alert GenerateTrue
Alert SeverityError
Alert PriorityHigh
RemotableTrue
Alert Message
The Data Access Service is unable to generate auditing events.
The Data Access service is unable to audit SDK operations because it cannot generate auditing events in the security event log.
Event LogOperations Manager

Member Modules:

ID Module Type TypeId RunAs 
DS DataSource Microsoft.Windows.EventProvider Default
GenerateAlert WriteAction System.Health.GenerateAlert Default

Source Code:

<Rule ID="Microsoft.SystemCenter.SDKService.UnableToGenerateAuditEvents.Alert" Enabled="true" Target="SCLibrary!Microsoft.SystemCenter.CollectionManagementServer" ConfirmDelivery="true" Remotable="true" Priority="Normal" DiscardLevel="100">

  <Category>Alert</Category>

  <DataSources>

    <DataSource ID="DS" TypeID="Windows!Microsoft.Windows.EventProvider">

      <ComputerName>$Target/Host/Property[Type="Windows!Microsoft.Windows.Computer"]/NetworkName$</ComputerName>

      <LogName>Operations Manager</LogName>

      <Expression>

        <And>

          <Expression>

            <SimpleExpression>

              <ValueExpression>

                <XPathQuery Type="String">PublisherName</XPathQuery>

              </ValueExpression>

              <Operator>Equal</Operator>

              <ValueExpression>

                <Value Type="String">OpsMgr SDK Service</Value>

              </ValueExpression>

            </SimpleExpression>

          </Expression>

          <Expression>

            <SimpleExpression>

              <ValueExpression>

                <XPathQuery Type="UnsignedInteger">EventDisplayNumber</XPathQuery>

              </ValueExpression>

              <Operator>Equal</Operator>

              <ValueExpression>

                <Value Type="UnsignedInteger">26338</Value>

              </ValueExpression>

            </SimpleExpression>

          </Expression>

        </And>

      </Expression>

    </DataSource>

  </DataSources>

  <WriteActions>

    <WriteAction ID="GenerateAlert" TypeID="Health!System.Health.GenerateAlert">

      <Priority>2</Priority>

      <Severity>2</Severity>

      <AlertName/>

      <AlertDescription/>

      <AlertMessageId>$MPElement[Name="Microsoft.SystemCenter.SDKService.UnableToGenerateAuditEvents.AlertMessage"]$</AlertMessageId>

      <AlertParameters>

        <AlertParameter1>$Data/EventDescription$</AlertParameter1>

      </AlertParameters>

      <Suppression/>

    </WriteAction>

  </WriteActions>

</Rule>