Windows delayed writes - how to monitor and alert on them.

Tim_Neto

Hello.

 

I have some server reporting "Delayed Writes" failures at times.

 

I need to have Orion report on these errors.

 

I looked through the monitoring templates provided, but I do not see any to target this type of condition.

 

Any suggestions anyone?

 

Thanks.

 

Tim

smargh

I do this with built-in Windows feature & Orion trap alerts.

On the server where the events will be logged:

Configure the SNMP service (properties of the service) in the "Traps" tab to tell the OS where to send the traps. A service restart is sometimes necessary after this (especially on 2003), but often not on 2008 R2. Your experiences may vary.

Start->Run->evntwin.exe

Look in System->Disk. Double-click on event ID 50, then OK, it'll be added to the list. Click "Apply".

The criteria to put in the Orion Trap Viewer alert is:

Traps received where ANY of the following are true
SNMPv2-MIB:snmpTrapOID starts with EVNTAGENT-MIB

AND traps received where ANY of the following are true:
eventText contains delayed write failed

You must check the events which are sent to Orion to verify that it is correctly using the EVNTAGENT-MIB MIB and has the eventText string otherwise the criteria will be wrong. The last time I tried the SolarWinds mibs.cfg file, the EVNTAGENT-MIB information was removed for some reason, so the trap in Orion was filled with lots of OIDs.

The alert message can then use variables to extract the useful information from the trap. ${vbData3} normally contains the actual event text. I use this huge template to figure out which variables to use:

vb1: ${vbName1} ${vbData1}
vb2: ${vbName2} ${vbData2}
vb3: ${vbName3} ${vbData3}
vb4: ${vbName4} ${vbData4}
vb5: ${vbName5} ${vbData5}
vb6: ${vbName6} ${vbData6}
vb7: ${vbName7} ${vbData7}
vb8: ${vbName8} ${vbData8}
vb9: ${vbName9} ${vbData9}
vb10: ${vbName10}  ${vbData10}
vb11: ${vbName11}  ${vbData11}
vb12: ${vbName12}  ${vbData12}
vb13: ${vbName13}  ${vbData13}
vb14: ${vbName14}  ${vbData14}
vb15: ${vbName15}  ${vbData15}
vb16: ${vbName16}  ${vbData16}
...etc

Telling lots of servers which traps to send can be done en masse with evntcmd.exe and either a batch file or Powershell - I use a Powershell script to do bulk updates with a custom .cnf file, selecting the servers to update directly from the Orion database.