How to tell who kicked off an advertisement

[SCCM_Noob]

Hello all,

 

I am new to administering SCCM 2007 R3 and I need a little help if posisble...

 

Recently several advertisements were kicked off all at one time and it overwhelmed our server... I was tasked with the RCA but I cannot seem to find anything that tells me who or what caused numerous advertisements to kick off all at one time... I checked several logs on the server inclduing the Policypv.log but for some reason it only shows about 6 hours worth of data.. This happened on a Fri afternoon and went on into the night I had to bounce the box several times ... after chaning share permissions and disabling all advertisements...Can anyone advise me as to where to look and possibly how to change how long the log files record data.. so in the future I can find the information that is needed...

 

Your help is appreciated..

 

thanx

[Peter33]

You can use this query to see who made changes to your advertisements.

 

select stat.*, ins.*, att1.*, stat.Time from SMS_StatusMessage as stat left join SMS_StatMsgInsStrings as ins on stat.RecordID = ins.RecordID left join SMS_StatMsgAttributes as att1 on stat.RecordID = att1.RecordID where stat.MessageType = 768 and stat.MessageID = 30008 and stat.Time >= ##PRM:SMS_StatusMessage.Time## order by stat.Time desc

[SCCM_Noob]

Thanks for the reply but that showed everything I did after the fact but not before all the advertisements kicked off. Is there another way to find out how all the advertisements suddenly kicked off?