Operations Manager 2007 R2 Installation and Configuration (Step by Step) – Part 12 “Configure Audit Collection Service”

In this post series I went through step by step into System Center Operations Manager 2007 R2 starting from “Pre-Build”, then I continued with “Installing Operations Manager Database”, followed by another post “Installing Root Management Server”, then “Configure GPO for SCOM”, then followed by “Configuring SQL Reporting Service”, then followed by “Installing Data Warehouse Database”, then followed by “Installing Audit Collection Service”, then followed by “Download and Import Management Pack”, then followed by “Discover Windows and Deploy SCOM Agents”, then followed by “Discover Linux/Unix and Deploy Agents”, and lately followed by “Configure Notification”.

In this post I will go through basic configuration in System Center Operations Manager 2007 R2, and the focus in this post will be on Configure Audit Collection Service,

Steps are as the following:

1. Change the ACS Default Retention Period:

Step Description Screenshot
  User local administrator privileges to log on to the SCOM 2007 R2 Root Management Server (SCOM) [Member of “OpsMgrAdmins” Group]. This account must also has right on ACS Database  
1. Open the SQL Server Management Studio tool and connect to the database engine clip_image002[7]
2. Expand the Databases folder, and select the OperationsManagerAC database clip_image004[7]
3. Right-click to open the context menu and select New Query clip_image006[7]
4. In the Query pane, type the following:

USE OperationsManagerAC UPDATE dtConfig SET Value = <number of days to retain data + 1> WHERE Id = 6

Then click Execute on the toolbar. This runs the query and then opens the Messages pane, which should read “(1 row(s) affected).”

5. To view the new setting, delete the previous query text from the Query pane and type then execute SELECT * FROM dtConfig. This opens the Results pane below the Query pane, Look at the value in the sixth row; it should now equal the value you entered for <number of days to retain data + 1>. clip_image010[7]
6. Restart the Operations Manager Audit Collection Service for this to take effect  

2. Configure Audit Collection Server & Import ACS Reports:

Step Description Screenshot
  User local administrator privileges to log on to the SCOM 2007 R2 Root Management Server (SCOM) [Member of “OpsMgrAdmins” Group]. This account must also has right on ACS Database  
1. On the System Center Operations Manager console, Select Monitoring, Operations Manager, Agent, Agent Health State clip_image002[9]
2. Select all the servers in the Agent State panel (right side) that you plan to enable as Audit Forwarder, then from Menu Select Action, Health Service Tasks, Enable Audit Collection clip_image004[9]
3. Now it is time to import Audit Reports to Operations Manager (below steps will be run on ACS Database Server): Create a C:ACS folder on the server that is hosting Audit Reporting. Refer to the server as %COMPUTERNAME%.  
4. Copy uploadauditreports.cmd, the Models and Reports folders from the System Center Operations Manager 2007 R2 CD (located at ReportModelsACS) and copy the reportingconfig.exe from the SCOM 2007 R2 CD (under the Support Tools folder) to the same folder that you created above. clip_image006[9]
5. On the server, open a CMD prompt, change to the “c:toolsaudit reportsacs” directory and run the following command:

UploadAuditReports “%COMPUTERNAME%” “http://%COMPUTERNAME%/reportserver” “c:acs”

(Where “%COMPUTERNAME%” is ACS SQL DB Server Name)

And Click OK on any dialog you receive. This creates a new data source called Db Audit, uploads the reporting models Audit.smdl and Audit5.smdl and uploads all reports in the ACSREPORTS directory

6. When Command Complete, open Internet Explorer and enter the following address to view the SQL Reporting Services Home page. http://localhost/Reports clip_image010[9]
7. Click Audit Reports in the body of the page and then click Show Details in the upper right part of the page clip_image012[9]
8. Open Operations Manager Console, on Operations Manager Console, under Reporting, you should see Audit Reports clip_image014[9]
9. Audit logs will now start being collected; this can take a considerable period of time depending on the number of logs and the size of each log.  

Now you can plan, deploy and configure System Center Operations Manager 2007 R2, whish you good luck.

Related Posts: