Setting Alerts on Forwarded Events

Event forwarding is a feature of SQL Executive that allows SQL Server events to be forwarded to another SQL Server¾called the alerts management server¾for processing, instead of being processed locally. Event forwarding enables central management of alerts and allows the development of alerts neighborhoods, which are groups of servers that share a common alerts management server.

• Some advantages of setting up an alerts management server are the following:
• Centralization. Centralized control and a consolidated view of the events of several SQL Servers is possible from a single server.
• Scalable. Allows a variable number of physical servers to be administered as one logical server.
• Efficient. Configuration time is reduced because you only need to define alerts and operators once, at one server.

Some disadvantages of setting up an alerts management server are the following:

• Increased traffic. Forwarding events to an alerts management server can increase network traffic, although this can be moderated by restricting event forwarding to only higher severity events.
• Single point of failure. The alerts management server is a potential single point of failure.
• Server load. Handling alerts for the forwarded events causes an increased processing load at the alerts management server.

Event forwarding is implemented by using the alert engine fail-safe options described in Setting Alert Engine Options, earlier in this chapter.

    To set up an alerts management server

1. On each server that is to forward events, set up unhandled event forwarding.
   • In the Fail-Safe tab of the Alerts Engine Option dialog box, select a server from the list in the Server to Forward Events to box. This will become the alerts management server.
   • In the same dialog box, select a severity level from the list in the Forward Events for Errors with Severity of or Above box. Unhandled alerts of a level equal to or greater than this severity will be forwarded to the alerts management server.
2. On each server that is to forward events, check that alerts are not defined on the events to be forwarded, or that if alerts are set they are disabled.

   If a locally defined alert is disabled and an event occurs that would have caused the alert to fire, the event will be forwarded to the alerts management server. This allows local overrides¾that is, alerts defined locally that are also defined at the alerts management server¾to be turned off and on as needed.

   Important Only unhandled events will be forwarded, and only those of a severity equal to or greater than the setting in the Fail-Safe tab of the Alerts Engine Option dialog box. An unhandled event is one for which there is no enabled, locally defined alert.

3. On the alerts management server, set alerts on the events that are expected to be forwarded.

When configuring event forwarding, follow these guidelines:

• Avoid running critical or heavily used applications on the alerts management server.
• Avoid configuring large numbers of servers to share the same forward server. If congestion results, reduce the number of servers using a particular alerts management server.

  Note that for each server, the servers that are registered with SQL Enterprise Manager constitute the list of servers available to be configured as its alerts forwarding server.

• Define server-specific alerts on the local server, instead of forwarding them.

  The alerts management server views all the servers forwarding to it as a logical whole. This means that, for example, the alerts management server makes no distinction between a 605 error on server A and a 605 error on server B.

• Failure conditions encountered by the alerts engine¾for example, an inability to send an email notification¾are written to the local Windows NT application log with a source name of SQL Executive. Therefore, after configuring your alert system, you should periodically check the Windows NT application log for SQL Executive events.