Ozzy Citrix Noobs

Step 1: Create AGEE Auditing Policy to send Syslog to MOM

1. Go to AGEE configuration tool, root – System – Auditing – Policies – Policies, add new policy.
• In Server IP Address entry, type MOM Management Server IP
• In Port entry, type 514
• In Log Levels, select Emergency, Alert, Critical, Error, Warning, Notice
• Use Log Facility LOCAL1
2. Right click the new policy, and select “Global Bindings…”, tick the checkbox before the new policy. This will make AGEE to send all alerts to MOM.

Step 2: Create a Syslog Port Provider

1. In the left pane of the MOM Administrator console, right-click Providers.
2. On the context menu, click New Provider, specify Application Log as the data provider type, and then click Next.
3. For the provider name, enter Syslog.
4. For the provider log type, select Syslog port, and then click Finish.

Step 3: Create a collection event rule to collect syslog

1. First create a rule group named AGEE rules and associate this rule group with a computer group “Microsoft Operations Manager 2005 Servers”.
2. In the left pane of the MOM Administrator console, expand the rule group, right click Event Rules, and then click New Event Rule.
3. Select Collect Specific Events (Collection), and then click Next.
4. In the list, select the Syslog and then click Next.
5. Enter Collect Syslogs for the name of the rule, ensure that the Enabled check box is selected, and then click Finish.

Step 4: Create an alert event rule

1. In the left pane of the MOM Administrator console, expand the rule group, right click Event Rules, and then click New Event Rule.
2. Select Alert on or Respond to Event (Event), click Next.
3. In the list, select the Syslog and then click Next.
4. In the Criteria Page, click Advanced button, and choose Parameter 1 in field, choose contains substring and enter the Syslog message level (emerg, alert, crit, error, warning, notice, info, and debug ) in value. Click Add to List. (Note, Parameter1 value is the syslog message priority, Parameter2 value is the syslog message text.
5. Click Close and then click next. Check the Generate Alert in the Alert Page and configure the Alert properties.
6. Enter the name AGEE Syslog Emergency for the rule name. Click Finish.
7. Create additional rules for other syslog message level to generate alerts.

Ref:

HOWTO: Configure Microsoft Operation Manager 2000 or 2005 to monitor Unix devices by using Syslog http://support.microsoft.com/kb/555450

Configuring UNIX Computers to Forward Syslog Messages http://msdn.microsoft.com/en-us/library/aa505293.aspx