Active Administrator 8.7 - User Guide

Managing Active Directory Health Analyzer alerts

Managing Active Directory Health Analyzer alerts

Active Directory Health Analyzer alerts have two levels of severity: warning and critical. As a situation escalates, a warning alert is generated, indicating that a lower priority threshold has been violated. As the severity of the error increases, a critical alert is generated, indicating that the higher priority threshold has been exceeded.

A number of attributes can be customized for each of these levels, including the threshold value, duration before an alert occurs, duration before an alert clears. If a remediation is attached to the alert, specified actions can run when the alert reaches the critical state. A lightning bolt indicates a remediation is attached to an alert.

There are two ways to view alerts. You can view current alerts for selected forests, domains, sites, and domain controllers while using the Analyzer feature. The Alerts feature displays all the current alerts and alert history. You also can generate an alert history report to send to recipients through email or save the report to a file.

If you know about an upcoming maintenance to the system or some other event that may cause a lot of unnecessary alerts, you can mute the collection of alerts. During the mute period, no alerts are collected into the Active Administrator® database and no alert notifications are sent. If you forget to remove the mute, the mute is cleared automatically after one hour.

 

NOTE: If you have a license for the Active Directory Health module, you can forward the Active Directory Health alerts generated by Active Directory Health Analyzer agents to Microsoft® System Center Operations Manager (SCOM) and SNMP managers. These alerts will appear in the Quest Alert Events view, under the Quest Active Administrator folder in the Operations Manager Monitoring pane and in the SNMP Manager. See Connecting to System Center Operations Manager and Enabling SNMP Notifications and Pushing alerts to System Center Operations Manager and SNMP managers.

Topics 

•	Setting alerts

•	Purging and archiving alert history

•	Viewing alerts and alert history

•	Filtering alert history

•	Generating an alert history report

•	Muting alerts

•	Clearing mutes

•	Viewing mute history

Setting alerts

Setting alerts

You can enable, disable, and edit alerts for a selected monitored domain controller, domain, forest, or site, or for all monitored domain controllers, domains, forests or sites. To see a list of the alerts that you can manage and the corresponding data collector that captures the data for the alert, see the Alerts Appendix.

NOTE: For the alert to appear, the data collector for the specified alert must be enabled. See Managing data collectors and Setting data collectors.

You also can attach a remediation action to an alert. Remediations are actions that run when an alert reaches its critical threshold. There are several built-in remediation actions that you can choose or you can create custom remediations. All remediations are stored in the Remediation Library. See Managing the Remediation Library.

To set alerts

1	Select Active Directory Health | Agents.

2	Open the Monitored Domain Controllers tab, if necessary.

3	Select a domain controller, and select Settings | Domain Controllers, Domain, Forest, or Site.

4	Click Alerts.

5	All the alerts for the selected object are displayed. Disabled alerts are indicated by a gray icon.

▪	To filter the list, start typing in the Filter alerts box. The list filters as you type.

6	Double-click an alert.

7	Modify the alert general settings.

▪	All the alerts are system alerts, so you cannot change the data or the type. You can change the name, description, operator, and threshold values for warning () and critical ().

NOTE: For the Boolean type, you can select only the Equal To or Not Equal To operators. IMPORTANT: For the RODC allowed/denied password alerts, you must set at least one authoritative Read-only domain controller (RODC). See Setting an authoritative RODC.

▪	To reset the alert to the original default settings, click Reset.

8	To attach a remediation, open the Remediation tab.

a	Click Add.

b	Select a remediation, and click OK.

a	The remediation is enabled by default. If at a later time you want to disable the remediation for a period of time, clear the check box.

b	Enter the target computer, if required. Only built-in remediation actions request a target computer.

c	If arguments are required, browse to select and insert arguments. The user who created the custom remediation may have added a description as to which arguments are to be used.

d

Click OK.

e	The remediations run in the order they appear in the list. You can move a selected remediation up or down the list.

IMPORTANT: Any reboot remediation must be last on the list.

9	You can apply the changes to the selected domain controller, domain, forest or site; or to all domain controllers, domains, forests, or sites.

To apply the changes only to the selected object, click Apply.

-OR-

To apply the changes to all objects, click Apply to All.

10	Click Yes to confirm.

A lightning bolt indicates that a remediation is attached to the alert.

11	Optionally, click Save as Template to save all of the alert settings and data collector settings for this domain controller, domain, forest, or site as a template that can be applied to other Active Directory objects. For more information, see Active Directory Health Templates.

 

Purging and archiving alert history

Purging and archiving alert history

You can choose to purge and/or archive the alerts added to the Active Administrator® database by Active Directory Health. If you choose to purge, records are removed from the database. If you choose to archive, the alerts are also added to the Active Administrator archive database.

To purge and archive Active Directory Health Analyzer alert history

1	Select Active Directory Health | Agents.

2	Open the Monitored Domain Controllers tab, if necessary.

3	Select any domain controller, and select Settings | Purging and Archiving.

4	Select to enable purging and archiving, then choose to either purge or archive.

5	Change the default number of days to keep data, if desired. The default is to keep 30 days of Active Directory Health Analyzer data.

6	You can set a schedule or choose to run the purge or archive now.

To set a schedule

a	Click Schedule.

b	Create the schedule.

c

Click OK.

To purge or archive now

a	Click Run Now.

b	Choose to archive or purge data.

c	Choose a date.

d

Click OK.

7

Click OK.

Viewing alerts and alert history

Viewing alerts and alert history

The Active Directory Health Analyzer Alerts page is divided into two areas. The top pane displays current alerts and the bottom pane displays alert history.

 

NOTE: To manage Active Directory Health Analyzer alerts, the user must have the Active Directory Health and the Active Directory Health Alert Management roles. If you want a user to only view the alerts, the user needs the Active Directory Health and the Active Directory Health Alert Viewer roles. See Defining role-based access. TIP: If you know of a maintenance event or some other known event that may generate unnecessary alerts, you can mute alerts.

To view alerts and alert history

1	Select Active Directory Health | Alerts.

The Current Alerts area displays the current alerts for the monitored domain controllers and domains with the total number of alters indicated next to the Alerts Count in the header. By default, the list of active alerts automatically refreshes every 30 seconds. A lightning bolt indicates a remediation is attached to the alert.

▪	To disable automatic refresh, clear the Auto refresh active alerts check box.

The Alert History area displays the 50 newest current and cleared alerts, filtered by date range for the previous day.

▪	By default, the Alert History displays alerts from the Live Active Administrator database. To view alerts from the Active Administrator® archive database, choose the source of the Alert History.

▪	To load another 50 alerts, click Load 50 More.

▪	To hide the Alert History pane, click . To show the Alert History area, click .

2	Double-click an alert to view details about the alert.

 

Table 50. Alert details menu options

Option	Description
Alert Settings	Edit alert settings. See Setting alerts.
Notifications	View the recipients of the listed notifications.
Copy	Copy a selected alert to the clipboard.

3	Use the menu to manage the list of alerts.

 

Table 51. Alerts menu options

Option	Description
Refresh	Refresh the list of active alerts.
Copy Active Alert	Copy a selected alert to the clipboard.
Copy Alert History	Copy a selected alert history item to the clipboard.
Filter History	Filter the list of alert history. See Filtering alert history.
Alert History Report	Generate an alert history report. See Generating an alert history report.
Notifications	Add, edit, or remove notifications. See Managing alert notifications.
Limiter	Limit the number of notifications. See Limiting alert notifications.
Grouping	Add or remove grouping the alerts by severity, alert name, or object name.

4	Use the shortcut links to manage the list of current alerts.

 

Table 52. Alerts shortcut links options

Option	Description
Details	View the details of the selected alert.
Copy	Copy the selected alert to the clipboard.
Create Notification	Create a notification in which the selected alert should be included. See Creating alert notifications.
Add To Notification	Set the notifications in which the selected alert should be included.

- OR -

Use the shortcut links to manage the list of historical alerts.

 

Table 53. Alerts shortcut links options

Option	Description
Details	View the details of the selected alert.
Copy	Copy the selected alert to the clipboard.