Create a rule to collect Scheduled Task event log entries in SCOM 2012

 

One of the biggest advantages of SCOM is how easy it is to pick up event from the event log and how flexible this can be. Simply go to Event Viewer, choose between the logs and find the event ID you want to alert upon.

 

But what about Scheduled Tasks? The status of the tasks is not written to any of the standard logs. So how does one pick them up? There is actually an event log for this; it is just not shown by default. In Event Viewer, right click Create Custom Views and scroll down to Applications and Services logs\Microsoft\Windows\TaskScheduler and tick off Operational.

 

clip_image001

clip_image003

 

Ah perfect! We got the Log Name, Source, Event ID etc. Now we can go ahead and create a rule/monitor to pick this up. I name my rule, target it etc., and browse to the Microsoft-Windows-TaskScheduler/Operational log:

 

clip_image004

 

On the expression page, I choose:

Event ID – equals – 101

Event Source – equals – TaskScheduler

 

clip_image005

 

Simple stuff. I create the rule, wait for event 1201 (new management pack received) on the target server and then I run my task so it fails to get event 101. It’s just… I don’t get any alert. I double check the rule and the log – all fine. No alerts. Strange!

 

Started Googling this and I found http://social.technet.microsoft.com/Forums/en-US/winservergen/thread/6f830896-2370-49db-924a-6caf87deaf6e/. In this thread the guy asking a question has pasted information about an event entry, where the source is Microsoft-Windows-TaskScheduler. Worth to try, I thought to myself, and I changed my rule in OpsMgr to use Microsoft-Windows-TaskScheduler instead of TaskScheduler as Source.

 

I fired of my scheduled task, and this time I got an alert! To be frank, that doesn’t really make sense to me. Nevertheless, it works.

 

clip_image007

 

So, whenever you need to pick up events from the Task Scheduler, use Microsoft-Windows-TaskScheduler as source.

 

clip_image008

 

Note: Yes, I know there is a management pack for Windows Scheduled Tasks, but it seems a little overkill if you just want to check a single task.

 

Happy picking up entries from the TaskScheduler log!

By | 2013-04-29T15:44:31+00:00 April 29th, 2013|Operations Manager (SCOM)|6 Comments

About the Author:

Michael Skov
Yet another guy loving the System Center products. My primary focus is on Operations Manager, which i have worked with for some years now - still loving it.Certifications:Microsoft Certified Solution Expert Private Cloud (MCSE)Microsoft Certified Solutions Associate Windows Server 2008 (MCSA)Microsoft Certified Technology Specialist Windows Server 2008 R2, Server Virtualization

6 Comments

  1. GrandChelem May 22, 2013 at 22:51 - Reply

    It does work ! 🙂 use the full name “Microsoft-Windows-TaskScheduler” as source.
    Thanks to Michael Skov for publishing the fix

  2. Srikanth Bellary November 26, 2013 at 12:17 - Reply

    We are not getting that task scheduler operational logs option in select event log drop down Box, will it depend on Server OS as well ?

  3. Chinni February 20, 2015 at 8:57 - Reply

    Michael ,

    Thumbs Up For you 🙂

  4. Sincgar July 16, 2015 at 23:24 - Reply

    Hi,
    hanks for that. One question how do I monitor for a particular scheduled task. I have a number that run but only want to monitor and alert on one.Success always gives the same event id for all so can I use the name of the task. If so what do i use as the parameter name in the filter one or more events dialogue box

  5. Peter May 5, 2016 at 9:55 - Reply

    Hi

    Could you tell me about how to configure this rule in “Rule type” and “General” part ?

    Thanks~

  6. Marijn April 19, 2017 at 11:45 - Reply

    Had exact same problem. Thanks for sharing.

Leave A Comment