Does SCOM tell who restarted a SQL instance on a cluster? We are troubleshooting a mysterious restart and can only tell in the System Log that the cluster service did it....which is not the case. We know someone manually restarted the instance. Trying to find out how to capture this information.... All ideas are appreciated! Thanks, Jen Mitch

Hi No - SCOM does not do this. If you know the event ID that windows writes when this happens then you can create your own rule along the following lines: http://blogs.technet.com/b/kevinholman/archive/2010/04/12/using-opsmgr-for-intrusion-detection-and-security-hardening.aspx Cheers GrahamRegards Graham New System Center 2012 Blog! - http://www.systemcentersolutions.co.uk View OpsMgr tips and tricks at http://systemcentersolutions.wordpress.com/