One of the biggest advantages of SCOM is how easy it is to pick up event from the event log and how flexible this can be. Simply go to Event Viewer, choose between the logs and find the event ID you want to alert upon.
But what about Scheduled Tasks? The status of the tasks is not written to any of the standard logs. So how does one pick them up? There is actually an event log for this; it is just not shown by default. In Event Viewer, right click Create Custom Views and scroll down to Applications and Services logs\Microsoft\Windows\TaskScheduler and tick off Operational.
Ah perfect! We got the Log Name, Source, Event ID etc. Now we can go ahead and create a rule/monitor to pick this up. I name my rule, target it etc., and browse to the Microsoft-Windows-TaskScheduler/Operational log:
On the expression page, I choose:
Event ID – equals – 101
Event Source – equals – TaskScheduler
Simple stuff. I create the rule, wait for event 1201 (new management pack received) on the target server and then I run my task so it fails to get event 101. It’s just… I don’t get any alert. I double check the rule and the log – all fine. No alerts. Strange!
Started Googling this and I found http://social.technet.microsoft.com/Forums/en-US/winservergen/thread/6f830896-2370-49db-924a-6caf87deaf6e/. In this thread the guy asking a question has pasted information about an event entry, where the source is Microsoft-Windows-TaskScheduler. Worth to try, I thought to myself, and I changed my rule in OpsMgr to use Microsoft-Windows-TaskScheduler instead of TaskScheduler as Source.
I fired of my scheduled task, and this time I got an alert! To be frank, that doesn’t really make sense to me. Nevertheless, it works.
So, whenever you need to pick up events from the Task Scheduler, use Microsoft-Windows-TaskScheduler as source.
Note: Yes, I know there is a management pack for Windows Scheduled Tasks, but it seems a little overkill if you just want to check a single task.
Happy picking up entries from the TaskScheduler log!