OpsMgr: Where Are My Events?

Yeah. I know. We’re late to the party. We just got OpsMgr 2012 rolled out. If you want to skip the story time, just go to the TL;DR section.

So, one of the first times I opened the console, I realized there were some events I was looking for that I wasn’t able to find. After carefully combing the console (read: frantically clicking on crap) I came to the realization that no matter which event view I chose, it was restricted to one day.

After talking with one of my engineers, he suggested looking at this article http://www.opsman.co.za/how-to-search-for-more-then-500-objects-in-the-scom-console-group-and-report-add-objects-fields which seems to be referring to searching objects. It did, however, lead to a very useful registry key:

HKEY_CURRENT_USER\Software\Microsoft\Microsoft Operations Manager\3.0\Console\ConsoleUserSettings

I don’t know what most of these settings do and quite frankly don’t want to figure it out. There are, however, two registry values of particular interest:

• AlertViewTimeSpan | 6048000000000
• EventViewTimeSpan | 864000000000

They’re pretty self-explanatory -- at least the function. Out of the box, the in-console alerts display pretty much the whole range of what’s captured.

So far as I can tell and if the internet holds true:

• 10,000,000 ticks in a 1 second
• 86,400 seconds in 1 day

That means the Alert view value translates to 7 days, and the Event view value translates to 1 day. Eureka.

 

[ T L ; D R ]

All you have to do is take the existing QWORD value in the EventViewTimeSpan and multiple it by the number of days that you’re interested in. Keep in mind, this applies to all event views as there is no way to limit the date range for event views (that I know of.)