MOM Reporting: Event Analysis – What gives?
As you are aware I am having some issues with the Exchange SLA Scorecard. I have been trying to use MOM reporting to do Alert and Event analysis for the event id 9539. Alert analysis worked as intended. I ran the Alert analysis report and it returned all instances of that particular alert on our Exchange servers (the ones that the agent picked the event up on).
I then ran the Event Analysis report. You get prompted to select a date range, computer group, event type, event id, provider instance name, source, sort by, and sort order.
The criteria I selected:
Computer group: MOM 2005 Agents
Event type: Informational
Event Id: 9539
Provider instance name: Application
Source: MSExchangeIS Mailbox Store
The results should be all 9539 events right? WRONG. I got 9539, 9523, and 1221 events that all use the same source. Why? I don’t know. I will be bringing this up with MSFT. I asked Marcus Oh for some help, and he looked at the .rdl file to look at the query and he didn’t find any wild cards, so I don’t know why it’s returning more then 9539 events.