Windows Small Business Server 2011 : Creating Custom Alerts - Creating an Alert for a Stopped Service, Custom Alert for Backup Failure

Of course, one size never fits all. You can create a custom alert that adds alert information to reports and enables users to receive email notifications when the specified event occurs. The custom alert provides information about a specific event that has occurred, which will enable a system administrator to quickly correct a problem.

1. Creating an Alert for a Stopped Service

Creating an alert is a multistep process but not at all difficult. In this example, we’ll configure an alert to appear if the Remote Desktop Gateway service stops or fails to start.

1.1. Acquire a GUID

To create a custom alert, you need to first acquire a GUID (globally unique identifier) that will be assigned to the alert. By far the easiest way to get a GUID is to go to http://www.guidgen.com, where a GUID is generated the moment you connect. (See Figure 1.) The GUID is easily copied and pasted into the Notepad file you’re about to create.

Figure 1. The easy way to get GUIDs

To generate a GUID locally, complete these steps:

Select All Programs from the Start menu and then click Windows PowerShell.
At the command prompt, type the following command:
```
[System.Guid]::NewGuid().ToString()
```
Record the GUID that’s returned, as shown in Figure 2.

Figure 2. Acquiring a GUID

1.2. Find Event Information

Next, you must obtain information about the event that will be associated with the custom alert. To acquire the information you need, follow these steps:

Select Event Viewer from the Administrative Tools menu.
Locate the event log where the event is recorded. In this example, we’re creating an alert that will appear when a particular service fails to start.
In the events pane, shown in Figure 3, select the event to associate with the custom alert. For this example, we’re using an event with the ID of 7036. The event ID will be used later in this document, so make note of the number.
Click the Details tab, and select Friendly View. Then expand System.
Make note of the Provider Name and Channel.

Figure 3. Viewing event information

1.3. Create and Save an .xml File

Next, to create an .xml file that contains the elements and attributes to generate the custom alert, follow these steps:

Open NotePad.

Add the following data to the NotePad file:

<?xml version="1.0" encoding="utf-8" ?>
<AlertDefinitions>
  <AlertDefinition ID="GUID"
                   Default="1"
                   Title="Exchange Transport Service"
                   Source="Service Control Manager">
  </AlertDefinition>
</AlertDefinitions>
<Parameters>
  <Path>System</Path>
  <Provider>Service Control Manager</Provider>
  <SetEventID>7011</SetEventID>
  <ClearEventID>7036</ClearEventID>
</Parameters>

Table 1 lists the attributes and parameters for the alert definition.

Table 1. Attributes and parameters for a custom alert
PARAMETER	DESCRIPTION
ID	GUID that uniquely identifies the custom alert. Use the GUID that you obtained earlier.
Default	Defines that the alert is enabled and will be preserved when defaults are restored.
Title	Name for the alert when displayed in the Windows SBS Console.
Source	Application that the alert is monitoring. In this example, it’s the Service Control Manager.
Path	Name of the event log where the alert is recorded. Use the Channel value you recorded.
Provider	Use the Provider name you acquired.
SetEventID	ID number of the event that triggers the alert.
ClearEventID	Optional element that specifies the ID number of the event that clears the alert. If this element is not defined, the alert will be cleared after 30 minutes. If this element is defined, the alert will only be cleared if the specified event occurs.

Save the file as filename.xml.
Copy the .xml file to the %programfiles%\Windows Small Business Server\Data\Monitoring\External Alerts directory on the computer that is running the Windows SBS 2011 operating system. (You will have to create the External Alerts directory.)
Select Services from the Administrative Tools menu.
Right-click Windows SBS Manager Service and select Restart as shown in Figure 4.

Figure 4. Restarting the SBS Manager service

Depending on the source for the alert, you might not see the notification for some time. Windows SBS Console polls for changes every 30 minutes, so if you want to check sooner than that, go to the Reports tab, right-click a report that includes Other Alerts (such as the Detailed Network Report), and select Generate Report.

The resultant report will show whether the custom alert has been activated, as shown in Figure 5.

Figure 5. Report showing an activated custom alert

You can also view the new alert by clicking the Network tab at the top of the SBS Console pane, selecting the server, and then clicking the View Computer Alerts task. (See Figure 6.)

Figure 6. Viewing a custom alert

2. Custom Alert for Backup Failure

Backups are so crucial to the security of your network that when one fails you want to know about it sooner rather than later. This section explains what you need to create an .xml file that will generate an alert.

2.1. Create a New GUID

Make note of the GUID, and follow these steps:

Open NotePad, and add the following data to the NotePad file, substituting the GUID you acquired for GUID:

<?xml version="1.0" encoding="utf-8" ?>

<AlertDefinitions>

<AlertDefinition ID="GUID" Default="1"

Title="Backup Failure" Source="Server">

     <Parameters>

      <Path>Application</Path>

      <Provider>Microsoft-Windows-Backup</Provider>

      <SetEventID>546</SetEventID>

      </Parameters>

</AlertDefinition>

</AlertDefinitions>

Save the file with the .xml extension, shown in Figure 7, and copy it into the %programfiles%\Windows Small Business Server\Data\Monitoring\ExternalAlerts directory on the computer that is running the Windows SBS 2011 operating system.

Figure 7. Backup Failure .xml file
Select Services from the Administrative Tools menu. Right-click the Windows SBS Manager Service, and then click Restart.