| Author |
Message |
Monkey
Guest
|
 Posted:
Wed Oct 19, 2005 4:51 pm Post subject:
Email alerts (alert suppression) |
|
|
I am monitoring event id 1016, mailbox access and we get a lot of these daily.
Keep getting many of these ones:
Severity: Success
Status: New
Source: MSExchangeIS Mailbox Store
Name: Mailbox Access
Description: Windows 2000 User AD\Administrator logged on to
exhangemom@company.co.uk mailbox, and is not the primary Windows 2000 account
on this mailbox.
I believe the admin account is constantly logging onto the MOM Exchange
mailbox account. I looked at the criteria for the Event rule to see if it
could ignore these events and not email. I tried to do this by using Advanced
Critieria - description - not equals - added the description text which is
same for each email. However it still emails me.
I then looked at Alert Suppression but it stops emailing once same person is
detecting logging into mailbox. Shame you cant use Alert Suppression just
daily.
Anyone got a clever idea on how to have emails sent always but ignore the
one above (MOM Exchange mailbox access). |
|
| Back to top |
|
 |
Arie de Haan
Guest
|
| Posted:
Thu Oct 20, 2005 12:51 am Post subject:
Re: Email alerts (alert suppression) |
|
|
In article <268116F8-945D-4E7F-9DCF-978C896D2ED1@microsoft.com>,
Monkey@discussions.microsoft.com says...
| Quote: | I am monitoring event id 1016, mailbox access and we get a lot of these daily.
Keep getting many of these ones:
Severity: Success
Status: New
Source: MSExchangeIS Mailbox Store
Name: Mailbox Access
Description: Windows 2000 User AD\Administrator logged on to
exhangemom@company.co.uk mailbox, and is not the primary Windows 2000 account
on this mailbox.
I believe the admin account is constantly logging onto the MOM Exchange
mailbox account. I looked at the criteria for the Event rule to see if it
could ignore these events and not email. I tried to do this by using Advanced
Critieria - description - not equals - added the description text which is
same for each email. However it still emails me.
I then looked at Alert Suppression but it stops emailing once same person is
detecting logging into mailbox. Shame you cant use Alert Suppression just
daily.
Anyone got a clever idea on how to have emails sent always but ignore the
one above (MOM Exchange mailbox access).
Disable the rule and then create a new rulegroup and copy the disabled |
rule to it. then associate appropriate computer gorup to new created
rulegroup
--
Greetz,
Arie
This posting is provide "AS IS" with no guarantees, warranties, rigths
etc. |
|
| Back to top |
|
|
Monkey
Guest
|
| Posted:
Thu Oct 20, 2005 12:51 pm Post subject:
Re: Email alerts (alert suppression) |
|
|
Thanks for reply
not sure how your suggestion will work though?
will give a go though
"Arie de Haan" wrote:
| Quote: | In article <268116F8-945D-4E7F-9DCF-978C896D2ED1@microsoft.com>,
Monkey@discussions.microsoft.com says...
I am monitoring event id 1016, mailbox access and we get a lot of these daily.
Keep getting many of these ones:
Severity: Success
Status: New
Source: MSExchangeIS Mailbox Store
Name: Mailbox Access
Description: Windows 2000 User AD\Administrator logged on to
exhangemom@company.co.uk mailbox, and is not the primary Windows 2000 account
on this mailbox.
I believe the admin account is constantly logging onto the MOM Exchange
mailbox account. I looked at the criteria for the Event rule to see if it
could ignore these events and not email. I tried to do this by using Advanced
Critieria - description - not equals - added the description text which is
same for each email. However it still emails me.
I then looked at Alert Suppression but it stops emailing once same person is
detecting logging into mailbox. Shame you cant use Alert Suppression just
daily.
Anyone got a clever idea on how to have emails sent always but ignore the
one above (MOM Exchange mailbox access).
Disable the rule and then create a new rulegroup and copy the disabled
rule to it. then associate appropriate computer gorup to new created
rulegroup
--
Greetz,
Arie
This posting is provide "AS IS" with no guarantees, warranties, rigths
etc.
|
|
|
| Back to top |
|
|
Arie de Haan
Guest
|
| Posted:
Fri Oct 21, 2005 12:51 am Post subject:
Re: Email alerts (alert suppression) |
|
|
In article <0AB96261-EE26-4312-97CC-11DA2E21E94E@microsoft.com>,
Monkey@discussions.microsoft.com says...
| Quote: | Thanks for reply
not sure how your suggestion will work though?
will give a go though
Oh, and don't forget to enable the rule you copied.. forgot to put that |
in the post.. sorry
--
Greetz,
Arie
This posting is provide "AS IS" with no guarantees, warranties, rigths
etc. |
|
| Back to top |
|
|
Monkey
Guest
|
| Posted:
Sun Oct 23, 2005 8:50 pm Post subject:
Re: Email alerts (alert suppression) |
|
|
did exactly as suggested but all that has done is created new groups. I am
still being emailed too much for event id 1016.
Need to find way to filter the rule to not run the alert if the description
includes the text:
Severity: Success
Status: New
Source: MSExchangeIS Mailbox Store
Name: Mailbox Access
Description: Windows 2000 User AD\Administrator logged on to
exhangemom@company.co.uk mailbox, and is not the primary Windows 2000 account
on this mailbox.
might try and use alert suppression based on day but not sure if possible.
Maybe only send alerts once per day using alert suppression.
unless anyone got better idea?
"Arie de Haan" wrote:
| Quote: | In article <0AB96261-EE26-4312-97CC-11DA2E21E94E@microsoft.com>,
Monkey@discussions.microsoft.com says...
Thanks for reply
not sure how your suggestion will work though?
will give a go though
Oh, and don't forget to enable the rule you copied.. forgot to put that
in the post.. sorry
--
Greetz,
Arie
This posting is provide "AS IS" with no guarantees, warranties, rigths
etc.
|
|
|
| Back to top |
|
|
Arie de Haan
Guest
|
| Posted:
Tue Oct 25, 2005 12:51 pm Post subject:
Re: Email alerts (alert suppression) |
|
|
In article <1188AA7E-B76D-47CA-9988-0DD6D45308C8@microsoft.com>,
Monkey@discussions.microsoft.com says...
| Quote: | did exactly as suggested but all that has done is created new groups. I am
still being emailed too much for event id 1016.
Need to find way to filter the rule to not run the alert if the description
includes the text:
I'm sorry it didn't help. |
Could you indicate which rule is generating the alerts?
--
Greetz,
Arie
This posting is provide "AS IS" with no guarantees, warranties, rigths
etc. |
|
| Back to top |
|
|
|
|
|
|
FAQ
Memberlist
Register
Profile
Log in to check your private messages
Log in