The sqlserver probe will not generate an alarm for agent_job_failure checkpoint in USM or Operator Console under any severity setting.
- Any UIM version
- sqlserver (any version)
Customer decided to use an alternative to alarm on sqlserver agent job failures.
Since SQL job failures write an event ID 208 to the application file, the customer chose to setup the ntevl probe for the applicable devices with the specific criteria/messages for each job they needed to alert on. This is an excellent and very straightforward alternative and you can use the ntevl probe profiles to alarm on individual job failures and their associated alarm messages,.
In some cases, the ntevl Application log may display the expected Windows Event (e.g., job failure) under the Status Tab, yet not generate an alarm in UIM.
Check to see if there is any evidence in the nas tables of such an alarm being generated.
SELECT * from NAS_ALARMS WHERE message LIKE '%<job_name>%'
SELECT * from NAS_TRANSACTION_SUMMARY WHERE message LIKE '%<job_name>%'
SELECT * from NAS_TRANSACTION_LOG WHERE message LIKE '%<job_name>%'
In this one case, the job in question was being excluded as per the ntevl 'Exclude' Tab so therefore there was no alarm generated in UIM nor Spectrum via sync.
Customers may want to double check with the team as to who may have excluded the job and for what reason, and then decide from there whether or not to change it so that the job is no longer excluded.