Double Heartbeat Events in OMS Log Analytics


I was testing the new Agent Health solution in OMS and I’ve noticed that I have two Heartbeat events generated at the same time for the same computer but having different values for SCAgentChannel field. At first I thought it was some kind of bug related that this server is connected to SCOM management group and the MG is connected to OMS but also the server has direct connection to Internet.

image

I was wrong. I’ve reached out to my favorite PG (OMS) and I’ve got the reason why there are double events. When an agent is connected to OMS via SCOM Management group some data passes trough the SCOM Management servers other data like performance data, IIS logs and Security logs are being passed directly to the OMS service because of the high velocity of that data. So the two heartbeats are correct and very clever approach because basically you have two channels trough which you are passing data to OMS. Kudos to the OMS team for implementing this and thanks to Satya Vel for explaining me the reason for this behavior.
I hope this tip was useful for you.

Advertisements

7 thoughts on “Double Heartbeat Events in OMS Log Analytics

  1. Nice Article. Thx for sharing. Had a question regarding the ComputerIP field. Am noticing them for all Agents to not be sync with the definitions in on-prem SCOM.

  2. ComputerIP in OMS(Type=HeartBeat) is the IP of the actual Agent or the IP of the SCOM Management Server , the Agent is pointed to ? Am noticing it’s the IP of the SCOM management Server.Is that by design ?

  3. The IP is the public IP from where the traffic from your environment is going to OMS. When SCOM agent is connected to SCOM Management server and that server is connected to OMS the traffic for most solutions goes trough that SCOM server. That is why the events for your scom agents have the same IP. Exception is data for solutions like performance data, IIS logs and security logs. For those the traffic goes directly from the OMS agent to OMS. And that is explained in the blog post why you will have to heartbeat events.

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s