One of the biggest advantages of SCOM is how easy it is to pick up event from the event log and how flexible this can be. Simply go to Event Viewer, choose between the logs and find the event ID you want to alert upon.
But what about Scheduled Tasks? The status of the tasks is not written to any of the standard logs. So how does one pick them up? There is actually an event log for this; it is just not shown by default. In Event Viewer, right click Create Custom Views and scroll down to Applications and Services logs\Microsoft\Windows\TaskScheduler and tick off Operational.
Ah perfect! We got the Log Name, Source, Event ID etc. Now we can go ahead and create a rule/monitor to pick this up. I name my rule, target it etc., and browse to the Microsoft-Windows-TaskScheduler/Operational log:
On the expression page, I choose:
Event ID – equals – 101
Event Source – equals – TaskScheduler
Simple stuff. I create the rule, wait for event 1201 (new management pack received) on the target server and then I run my task so it fails to get event 101. It’s just… I don’t get any alert. I double check the rule and the log – all fine. No alerts. Strange!
Started Googling this and I found http://social.technet.microsoft.com/Forums/en-US/winservergen/thread/6f830896-2370-49db-924a-6caf87deaf6e/. In this thread the guy asking a question has pasted information about an event entry, where the source is Microsoft-Windows-TaskScheduler. Worth to try, I thought to myself, and I changed my rule in OpsMgr to use Microsoft-Windows-TaskScheduler instead of TaskScheduler as Source.
I fired of my scheduled task, and this time I got an alert! To be frank, that doesn’t really make sense to me. Nevertheless, it works.
So, whenever you need to pick up events from the Task Scheduler, use Microsoft-Windows-TaskScheduler as source.
Note: Yes, I know there is a management pack for Windows Scheduled Tasks, but it seems a little overkill if you just want to check a single task.
Happy picking up entries from the TaskScheduler log!
It does work ! 🙂 use the full name “Microsoft-Windows-TaskScheduler” as source.
Thanks to Michael Skov for publishing the fix
We are not getting that task scheduler operational logs option in select event log drop down Box, will it depend on Server OS as well ?
Michael ,
Thumbs Up For you 🙂
Hi,
hanks for that. One question how do I monitor for a particular scheduled task. I have a number that run but only want to monitor and alert on one.Success always gives the same event id for all so can I use the name of the task. If so what do i use as the parameter name in the filter one or more events dialogue box
Hi
Could you tell me about how to configure this rule in “Rule type” and “General” part ?
Thanks~
Had exact same problem. Thanks for sharing.
Hi,
This is a very useful blog.
But i have one question. I have 2-3 scheduled tasks running on one server.
So will this work for multiple tasks which is scheduled on the same server?