1. The text that appears in the description of windows event log entries is actually made up of a series of parameters. If you want to filter based on content in the Description field, first you need to determine the parameter number that relates to the text you want to find. To find the parameter number, see the following post:

http://blogs.technet.com/stefan_stranger/archive/2008/05/13/opsmgr-2007-parameters-explained.aspx

2. When using the Windows Event Viewer, it will parse some parameter fields so what you see in the event viewer is not what OperationsManager sees when it reads the event log.

E.g. for security event id 560, under ‘accesses’ field in the description, the windows event viewer could show (amongst other things) WRITE_DAC, but if you try and get Operations Manager to filter against parameter 15 for ‘WRITE_DAC’ it will not work, as that’s not what Operations Manager sees.

To get around this, the following command will create a text file with all events of type 560 that has the content in the same format that Operations Manager sees, if you then search this file for the specific event you are looking at in event viewer, you can match with what SCOM sees and what the event viewer sees to determine what you need to tell Operations Manager to search for:

LogParser.exe -q:ON “SELECT Strings AS Parameters FROM Security WHERE EventID=560″ > 560.txt

Using the above you can determine that in SCOM that you need to filter for ‘Parameter 15 contains 1539′. You can also use this to find the parameter number (parameter number can be counted from the left starting from 1, not 0).

3. PS I haven’t had success in filtering based on the ‘event type’ yet (EventType), including it in the filter stopped scom from picking up the alert.

4. Create a test rule in the management pack you are creating the event log monitoring rule(s), which is basic search for application log, Source “User Event” and then use the logevent (http://support.microsoft.com/kb/315410) application to create a test event, to confirm that your management pack is actively running on the target device.

e.g.

logevent -s I -e 45 “Test Event”

Logevent download at: http://www.petri.co.il/download_free_reskit_tools.htm

5. You can also check the ops mgr windows event log to see it has downloaded your changes, but step 4 will tell you for sure. This will also contain information if ops mgr can’t keep up with the event log and is falling behind in monitoring the event log.

6. Monitors are for monitoring for things that affect the health of an object, rules are where monitoring for things that don’t affect object health.

There are 3 types of monitors for the windows event log, manual health reset, automatic after a set time, and automatic after a specific event has been received.

7. Use trial and error, start with basic filtering criteria, check that receive alerts and make it more specific, at each step checking if you receive an alert, being careful to not create a filter that is so generic that it will result in hundreds of alerts.

8. To avoid possible performance issues during step 7, test against a single device by disabling your rule and specifically overriding it to enabled for a specific device, and removing the override and re-enabling once you know it is working if so required.

9. Too many event log monitors could reduce the system wide performance of the monitored device(s).

10. It is possible to filter based on the entire description field, using a parameter with name EventDescription (howto: http://contoso.se/blog/?p=250), but it is recommended to use parameters instead as searching the entire description will have a greater system wide performance impact on the monitored device(s).

This is most likely to affect you if you have switched off the option under settings (Click on settings at the top right, option ‘In expanded view, mark items as read when you scroll past them.’) so that you can quickly scroll through the items then click mark as read once done reviewing that page of posts (which is more akin to how Newsgator works).

If you want the trends page to show read counts you have to enable the ‘In expanded view, mark items as read when you scroll past them’.

The key requirement for such a solution is one that has the following features:

a) Escalation path
You don’t want an incident to go unchecked because the person the incident notification went to failed to get it for whatever reason. An escalation path ensures that someone is notified by escalating it to other contact methods for that person, or to other people until a receipt acknowledgement is received (typically by pressing a button in the case of voice alert, or replying to a SMS or email message).

b) Date scheduling
If you have staff that work on a shift basis, then you will want the system to be able to be programmed with those shift patterns.

c) Voice Alerting
Ideally, a combination of both SMS Text and Voice alerting capabilities, as voice calls can be heard easier on most devices out of the box than SMS Text messages and allows fallback to contact land based telephones.

In the United Kingdom: http://www.ringcentral.bt.com/

In the USA: http://www.ringcentral.com/

Features (UK Version):
0800 Numbers
0844 Numbers
Voicemail with Email Delivery
Internet Fax
Auto-Attendant and Extensions
Dial-by-name Directory
In-Queue Music and Messages
Call Diversion with FindMe
Call Management
Time of day Routing and Answering Rules
Call Screening
Desktop Call Controller
Call Logs
RingMe Click-to-Call from the Web
Outlook Integration

The primary topic of conversation was fostering innovation within an organisation and the different maturity levels that exist (from idea box in the canteen through to efficiently managing it through to real solutions).

Innovation was defined not as taking ideas, but as:

1. Creativity is the process by which ideas are generated (the level at which most companies operate)

2. Innovation is having delivered the solution that came from the idea(s).

Although in person discussion remains the best way, there are numerous companies offering online solutions for the ‘next best thing’, each at different levels of completeness of vision:

UserVoice

Dell IdeaStorm – utilises SalesForce Ideas

Ovo Innovation

Spigit

Imaginatik

Bright Idea

Brain Bank

Inkling Markets

Pligg

# Define the problem

# Define the scope

# Know the current situation in detail as it stands today

# avoid making assumptions on what other people think

# involve others in the process to give back a feeling of control, where applicable / relevant / suitable

# Know ALL the stakeholders, and if any are potential ‘wreckers’ to the change

# Know the people (willingness to change, level of skill, level of regard held by others), optionally by knowing their Belbin profile (www.belbin.com)

# Use more than one communication mediums e.g. some people may not be present at the time, which used and how many depending on the type of change

# Define the Vision for each stakeholder e.g. what they want from it, what the benefits will be etc (with input from stakeholder, but not under certain circumstances)

# Target communication & interaction differently for different types of people and different stakeholder requirements

# Some people don’t like any change, most accept some change, some readily accept change and some live for change, try and target the communication so that the change is minimal for the lower group, but advertise that the base simple functionality can be extended with exciting new methods to the groups that like change

# Define the S.M.A.R.T. actions (e.g. by using methods such as forcefield analysis or a have / don’t have table) http://en.wikipedia.org/wiki/SMART_(project_management)

# Monitor and maintain after the change has been made

# Different changes require different amounts of effort, starting with knowledge only, attitude, behavioural (individual), behavioural (group) and organisational culture change (attitude change is critical for any change apart from knowledge only, e.g. skippping attitude change and going straight to behavioural change can cause problems)

# Avoid negatives and turn them into positive messages

# Reward success

# Ensure your communication is sufficient for people not to have to rely on the grapevine to find out information and make up rumours etc.

The above isn’t the complete list of what was covered in the course, and lacks the detail – one of the books used by the trainer (but not in the course), which so happens to be the most popular book on ‘change management’ at Amazon uk, is:

‘Making Sense of Change Management: A Complete Guide to the Models, Tools and Techniques of Organizational Change’, ISBN-13: 978-0749440879

http://www.amazon.co.uk/Making-Sense-Change-Management-Organizational/dp/0749440872/ref=sr_1_1?ie=UTF8&s=books&qid=1220463268&sr=8-1

Full article by International Herald Tribune, ‘Internet squatters faced with eviction’
http://www.iht.com/articles/2008/04/27/business/TYPO.php

In terms of time tracking, something simple like http://www.keeptempo.com/ or http://slimtimer.com/ to allow analysis of the time being spent, and for more advanced projects recording against key tasks to determine if the project is at risk of going behind schedule.

Use something like ACT! or Salesforce to keep track of your relationships and activities associated with those, see the PDF at http://itredux.com/2008/03/29/extreme-productivity-seminar-slides/

Also, ‘Multi-Project Resource Leveling Can Be a Juggling Act’ from the PMI at http://www.pmi.org/eNews/Post/2008_04-25/Multi-ProjectResourceLevelingCanBeAJugglingAct.html