Symantec EV Vault Store partition not monitored by SCOM

This one a very interesting case I have been working on recently. We have implemented the Symantec Enterprise Vault 11 management pack for SCOM to monitor the installation of EV. The management is pretty impressive with most of the objects being discovered and monitored – some by monitors and some by rules.

One complaint I’ve heard a lot was regarding the constant alerts of Vault disks which should not be monitored. My knowledge with Symantec EV so I sat down with the EV admin and learned from him how the system works. You see, every email attachment is saved to a local disk on the Symantec EV server. When the partition comes to maximum capacity, the EV admin has to put the same partition in a ‘Closed’ state and configure a new disk to host the attachment files. This is how it works. Thankfully, SCOM knows about the status of the disks – w/e or not it is closed or open.

So the solution was pretty easy – I’ve created a dynamic group in SCOM that contains the disks that are in status closed and disabled the monitor on them using Overrides. This is done for a disk of type Index in EV.

I then moved to another type of disk which the Store Partition disk. There’s a built-in view that shows all the Vault Store partition disks (Symantec Enterprise Vault -> Enterprise Vault 11 -> Storage -> Vault Store Partition State). The view shows all the discovered Vault Store partitions and their status. On each disk I could information about its total size, used size and etc…

When I looked at the disks Health Explorer I noticed something very strange – the disk used space was not monitored! huh??? immediately I began to investigate and found something some very interesting stuff:

  1. There’s a built-in Dependency monitor that’s called ‘VaultStorePartitionUnhostedDependsOnVaultStorePartitionDiskSpace.Monitor’ that is disabled by default
  2. This monitor depends on Unit monitor called ‘VaultStorePartitionDiskSpace.Monitor’ which is also disabled by default
  3. The unit monitor targets a class called ‘Disk Space’
  4. There are 8 different classes in SCOM (all from the Symantec EV mp) each with the same DisplayName ‘Disk Space’. One of them has a name of ‘Symantec.EnterpriseVault.Latest.VaultStorePartitionDiskSpace’ – That’s the one we are looking for.
  5. There is no discovery enabled for that class. Let me say that again – there is no discovery for that class! what???

I then decided to open the MP xml file and found the following line in the DataSourceModuleType section with the ID ‘Symantec.EnterpriseVault.Latest.VaultStorePartition.Dependencies.DiscoveryDS’:

# $vaultStorePartitionDiskSpace = $discoveryData.CreateClassInstance("$MPElement[Name='Symantec.EnterpriseVault.Latest.VaultStorePartitionDiskSpace']$")

As you can see, the line has the # sign in the beginning which means its remarked.

That means that there is no discovery for the ‘Disk space’ we’re looking for. But why???

I then noticed something else in the xml file, few lines before the one above:

# As part of fix for Track 3347550, not monitoring the disk space...

Symantec have disabled the discovery due to some issue they had with the monitor!

I’m currently investigating why they have disabled the monitor and I should do (if at all) to enable it. Once I have the details I will let you guys know!


Oh btw, sorry this post is without any pics (and no text was copied, all typed by me). The SCOM at hand is in a closed environment…

What do you think about this post?