Share via


Key monitoring scenarios

 

The Microsoft Forefront Server Protection Management Pack for Microsoft System Center Operations Manager 2007 (Operations Manager 2007) proactively monitors the "health" of your Forefront agent-managed systems by looking at events. Events are logged when transitions occur from one state to another. Health is indicated by a color code:

  • Green (healthy) – everything is functioning properly and performing well. Green events do not trigger alerts. The symbol is a green check mark within a circle.

  • Yellow (warning) – performance is poor or a problem is impairing non-critical functionality. Yellow events trigger warning alerts. The symbol is a "!" within a yellow triangle.

  • Red (unhealthy) – critical functionality has been lost. Red events trigger error alerts. The symbol is a white "x" within a red circle.

Problem types

These are the various types of problems that the Microsoft Forefront Server Protection Management Pack keeps track of.

Engines

These are the monitored engine conditions.

Monitored Event

Success (green)

Warning (yellow)

Error (red)

Antimalware Engines Update Enabled

The engines selected to be used for the scan jobs are enabled for updating.

The engines selected to be used for the scan jobs are not all enabled for updating.

Not applicable.

Antimalware Engines Update Success Rate

All engines enabled for updating were successfully updated.

At least half of the engines enabled for updating were successfully updated.

Less than half of the engines enabled for updating were successfully updated.

Antimalware Engines Last Update Time

All engines enabled for updating were successfully updated within the last five days.

Some of the engines enabled for updating were not updated within the last five days.

None of the engines enabled for updating were updated within the last five days.

Last antispam definition update

Content filter definitions have been updated in the last hour.

Content filter definitions were last updated in the past 1-12 hours.

The last content filter definition update was over 12 hours ago.

Workload Integration

These are the monitored workload integration conditions.

Monitored Event

Success (green)

Warning (yellow)

Error (red)

Exchange Transport Hook State

The Microsoft Exchange Transport service is running and the Forefront agent is registered.

Not applicable.

The agent failed to register or is not enabled. This prevents the Microsoft Exchange Transport service from starting.

Forefront Agent State

The Microsoft Exchange Transport service is running and the Forefront agent is registered.

Not applicable.

The Microsoft Exchange Transport service is running, but the Forefront Agent is not registered.

VSAPI registration

The Microsoft Exchange Information Store is running and the Forefront VSAPI library is registered.

Not applicable.

The Microsoft Exchange Information Store is running, but the Forefront VSAPI library is not registered.

Scan Jobs

These are the monitored scan job conditions. There are separate events for realtime and scheduled scans.

Monitored Event

Success (green)

Warning (yellow)

Error (red)

Scan job enabled (for transport and realtime scans)

The scan job is enabled properly.

The scan job was disabled or bypassed.

Scan engines have been initialized (for transport, realtime, and scheduled scans)

The engines selected for the scan job have been initialized.

Not applicable.

The selected scanning engines were not initialized with the scan job.

Scan filter engine loaded (for transport, realtime, and scheduled scans)

The engine that handles filtering loaded correctly.

Not applicable.

The engine that handles filtering did not load correctly.

Scan process state (for transport and realtime scans)

The scanning processes are running.

Some processes did not restart after a timeout or exception.

No scanning processes restarted after a timeout or exception.

Scheduled scan termination

The scheduled scan executed within the allowed time.

Not applicable.

The scheduled scan exceeded the allowed time limit.

Transport Scanning Deliverable State

All messages have been scanned and delivered.

Not applicable.

A message scan could not be completed. The message was placed in the Undeliverable Archive folder for further review.

Services

These are the monitored services conditions.

Monitored Event

Success (green)

Warning (yellow)

Error (red)

FSCController service

The FSCController service is running.

Not applicable.

The FSCController service has stopped.

Eventing service

The Eventing service is running.

Not applicable.

The Eventing service has stopped.

FSEMailPickup service

The FSEMailPickup service is running.

Not applicable.

The FSEMailPickup service has stopped.

FSCMonitor service

The FSCMonitor service is running.

Not applicable.

The FSCMonitor service is inactive.

Cluster servers

These are the monitored cluster server conditions.

Monitored Event

Success (green)

Warning (yellow)

Error (red)

CCR cluster engine replication

Engine replication across the CCR cluster succeeded.

Not applicable

Engine replication across the CCR cluster failed.

CCR cluster file synchronization

File synchronization succeeded.

Not applicable

File synchronization failed.

Active node lookup

FPE successfully found the active node.

Not applicable

FPE could not find the active node

Passive node transition

The transition to the passive state succeeded.

Not applicable

An error occurred while transitioning to the passive state

CCR cluster change notifications

The CCR replication service cluster state monitoring is able to receive cluster change notifications.

Cluster change notifications cannot be received.

Not applicable.

License

These are the monitored license conditions.

Monitored Event

Success (green)

Warning (yellow)

Error (red)

License state

The Forefront Protection 2010 for Exchange Server is licensed.

The Forefront Protection 2010 for Exchange Server license will expire soon.

The Forefront Protection 2010 for Exchange Server license has expired.