u/EastTamaki2013

SCOM 2019 seems to have stopped detecting Availability Group Failovers in the environment.
All AG's are detected and stay in a Healthy State even when we forced a failover for testing.

Windows Cluster however are still firing the Cluster Alerts during tests.

SCOM 2019: v10.19
SQL MP: v7.6.5.0

SQL Version:
Microsoft SQL Server 2022 (RTM-CU12-GDR) (KB5036343) - 16.0.4120.1 (X64)   Mar 18 2024 12:02:14   Copyright (C) 2022 Microsoft Corporation  Enterprise Edition: Core-based Licensing (64-bit) on Windows Server 2022 Standard 10.0 <X64> (Build 20348: ) (Hypervisor)

Browsing through the SQL MP doc seems like the AG is monitored and will alert by default, unless there is a config that I may have missed somewhere ?

Is this a possible MP mismatch with latest version of SQL on the server?

Anyone come across this scenario or has any ideas what i could check or change?

Any assistance would be appreciated

Have a request come in to monitor RDP logon/off for certain Users on certain Servers.

Have Enable Local RDP Auditing:
Computer Configuration > Windows Settings > Security Settings > Advanced Audit Policy Configuration > System Audit Policies - Local Computer.

Event Logs:

Event Viewer > Applications and Services Logs > Microsoft > Windows > TerminalServices-LocalSessionManager > Operational.

 Event ID 21, 23, 24, 25.

We have a SIEM but it can not get to that level of Windows Events without some added Modules.

I have setup simple Event ID monitoring before and tried to test this scenario out but can not find how to detect and alert on the Info inside the Event like the name of the User.

Anyone have any idea on how to achieve this?

Is there a script that can be used or direct XML editing that can be used?