SCOM: AD MP – Journal Wrap error on SYSVOL Rule

We realized in our SCOM 2012 SP1 environment that the rule “Journal Wrap error on SYSVOL” of the Active Directory Management Pack was not detecting correctly.

I have checked the rule A_journal_wrap_error_has_occurred_on_the_Sysvol_5_Rule in the Microsoft.Windows.Server.AD.2008.Monitoring.xml (Version 6.0.8228.0).

It looked ok, the only thing which could be a problem is the Description search. It uses this expression:


I disabled the rule and created a new one with this Description search:

<XPathQuery Type=”String”>EventDescription</XPathQuery>

Now the event was detected correctly and an alert was created.

So if you recognize the same problem, then I suggest to also create a new custom management pack with this rule and disable the original rule.

You can download my sample MP here.


Published by


* 1974, female, working as a IT Senior System Analyst in a chemical company. Main topics: System Center Operations Manager 2012, System Center Orchestrator 2012, System Center Configuration Manager 2012. Monitoring servers since 2002, started with NetIQ Appmanager. Twitter: @NatasciaHeil

Leave a Reply

Fill in your details below or click an icon to log in: Logo

You are commenting using your account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s