SCOM: 2012 Wish List

Last week I was present at the first SCUG (System Center User Group) meeting for this year. It was a great source of information. Two speakers from Microsoft USA were present to tell us about the application monitoring feature (AviCode) and Network Monitoring feature. It looks great and promising!

As SCOM 2012 is going to be released and everyone is wondering what new features it might bring, I would like to share my ideas/wishes for the next SCOM releases. I'm pretty sure these are not available in SCOM 2012.

• Remove boundary for sealed en unsealed MP's.
  • Microsoft Best Practices for SCOM conflict with available functionality in SCOM.
    
  • Using one management group all self developed MP's are unsealed and their is no way to include objects from those unsealed MP's in a distributed application.
  • Currently sealing is the only solution. However sealing breaks MP's in which MP templates are used. Yeeh!
    
• Light-weight Operator Console for better performance
  
• Scale down Authoring in Operator Console, move functionality to Authoring Console.
  
• Increase usability
• Decrease complexity
• Create intuitive GUI layer on top of current console.
• Ease up using the Authoring Console as it was easy to create MP's in MOM 2005 with the adminstrator console.
• Possibility to use templates in the Authoring Console.
• Allow role 'Author' to make use of the Management Pack templates. Currently only a SCOM Administrator is allowed to make use of them.
  
• Dynamic component groups for DA's from the GUI to avoid XML usage.
• Log file monitoring for circular log files
• Out of the box better alert message possibities (read property bag definition from script, alert message templates)
• Possibility to use XPath expressions in alert suppression or a GUI layer for xpath dummies, like $Data/Context/Params[Contains(Param[1],"Fatal"). This can be handy when monitoring error events in logfile
• Review the current class model. There so much classes now. Is this really necessary? The new Network Monitoring features add classes for each component and each brand. Why not using multiple discoveries for 1 class?

If you have other good ideas/wishes, let me know!

SCCM: Get Drivers From Driver Packages (WQL)

I was searching for a way to list Driver Packages which contain Drivers. Why? I want to use Driver Packages without importing the drivers in SCCM.
Why? You can read about that here: http://hayesjupe.wordpress.com/sccm-osd-driver-best-practices/

I found an interesting script of Christjan which can detect differences in drivers between Driver Packages. The script contained the necessary WQL statements that I needed.

Here's the link to his script:
http://pr3m.pri.ee/blog/?p=653

Example WQL query for displaying the PackageID and Name of Driver Packages that contain drivers:

SELECT DPKG.Name,DPKG.PackageID FROM SMS_PackageToContent AS PTC

JOIN SMS_CIToContent AS CITC ON PTC.ContentUniqueID=CITC.ContentUniqueID

JOIN SMS_Driver AS DRV ON CITC.CI_ID=DRV.CI_ID

JOIN SMS_DriverPackage AS DPKG ON PTC.PackageID = DPKG.PackageID

SCCM: Task Sequence Import Fails with APPCRASH

Currently I'm working on automating the provisioning of SCCM environments.
One of the things that came along was exporting and importing Task Sequences between SCCM environments.
After automatically dealing with the package references I was ready to import them in the target SCCM deployment with my script.

Sadly, this didn't work. Even with the ConfigMgr Console it didn't work. As I was not presented with some kind of error, I searched the Event Viewer.

There I found multiple APPCRASH events (eventid 1000) on wmiprvse.exe.
So there had to be something in the Task Sequence export files that causes WMI to crash.

Many times WMI crashes because of bad queries or non-existing WMI classes, or ..... yep memory issues.

After (manually :'( ) comparing the two SCCM deployments, I found out I was missing the Microsoft Deployment Toolkit 2010 Task Sequence steps on the target SCCM deployment. After installing that, all issues were gone.

It would be nice though if the ConfigMgr console could present me with a simple error, stating that MDT was missing. Arghh.....

SCOM: Dynamic Group MaxDepth

This blog shows a trick to retrieve the right query depth when using contains/contained expressions in group membership rules.

If you don't know how these expressions work: Raphael Burri has an excellent blog about Dynamic Group Population: http://rburri.wordpress.com/2009/01/14/dynamic-group-membership-authoring-and-performance-impact-on-rms/

Whenever you use Contains or Contained (or their compliments NotContains or NotContained), you should use the attribute MaxDepth to save I/O on the RMS.

But how do you know what the MaxDepth is???

You could find this info in the Service Model from the Management Pack Guide. But not every MP Guide is equiped with a Service Model.
To overcome this, you can use the Group membership rule wizard (Query Builder) in the Operations Console.

In this example I want to group all IIS 7.0 Application Pools which are hosted on computers with a specific Computer Description. In most cases MaxDepth 1 will do, but not in this case.

For the Computer Description attribute I created an extended class based on Windows Computer. The attribute is filled with the value of a registry key found locally on the agent.

Let's see.....

Start the Create Group Wizard and go the the Dynamic Members tab:

Click Create/Edit rules and select IIS 7.0 Application Pool class and click Add:

Select the property drop down list and go to the last entry, which shows the host class. This shows that the IIS 7.0 Application Pool Class is hosted by the IIS 7.0 Web Server class.





















In the next steps select the parent classes until you reach the host class Windows Computer. For every host step, maxDepth is incremented.






So now you know that you'll have to use maxDepth="3" in Contains/Contained expressions on the Windows Computer class (or in my case a class which derives from this class).
The membership rule would look like this:

  $MPElement[Name="Windows1!Microsoft.Windows.InternetInformationServices.2008.ApplicationPool"]$
  $MPElement[Name="MicrosoftSystemCenterInstanceGroupLibrary6172210!Microsoft.SystemCenter.InstanceGroupContainsEntities"]$
  
 
   $MPElement[Name="MyExtLib!MyExtLib.Windows.Computer.Extended"]$
   
  
    
   $MPElement[Name="MyExtLib!MyExtLib.Windows.Computer.Extended"]/Description$
    
    ContainsSubstring
    Web Server LOB1
  
   
 
  

Of course you can create groups based on the host properties, but sadly this doesn't work on derived classes.
If you do can work with the host properties, the membership rule can look like this:

  $MPElement[Name="Windows1!Microsoft.Windows.InternetInformationServices.2008.ApplicationPool"]$
  $MPElement[Name="MicrosoftSystemCenterInstanceGroupLibrary6172210!Microsoft.SystemCenter.InstanceGroupContainsEntities"]$
  
 
   
  
    $MPElement[Name="MicrosoftWindowsLibrary6172210!Microsoft.Windows.Computer"]$
    $MPElement[Name="MicrosoftWindowsLibrary6172210!Microsoft.Windows.Computer"]/OrganizationalUnit$
  
   
   ContainsSubstring
   Web Servers
 
  

SCOM: Reserved Custom Attributes?

Today I came accross a post of Daniele Grandini in which he writes that the Exchange 2010 MP uses the Custom Attributes of alerts for it's internal Alert Correlation engine.

Why is this important to know? Custom Attributes can be used for notification purposes to send extra information.

I realised I know more Management Packs which also use these Custom Attributes. So here's a short list of the MP's:

• Microsoft Biztalk Server MP 6.0.6703.0: Custom Field 1


• Microsoft Group Policy 2003 MP (Converted): Custom Field 6


• Microsoft SCCM MP 6.0.6000.2: Custom Field 1 and 6


• nWorks VMware VEM MP 5.0.3.248: Custom Field 1 to 6 and 9, 10

This is what I came accross. It's possible these MP's use more custom attributes. Let me know when you want to add something to this list.

You can check this quickly by creating an alert view (MyWorkspace also possible), and show all alerts with a filter on custom attribute 1 to 10 with text '%'.

SCOM: Small edit for SCC Logical Disk Extension Management Pack

This blog post is about the SCC Logical Disk Extension Management Pack.

This MP is a real nice example of a combined forces from the System Center community. It contains some extra Logical Disk collection rules and two Logical Disk reports.

Using the MP is pretty simple, but i noticed two small things.
The parameter list to select a Computer Group is not sorted. Finding the right group between more that 300 groups can be a hassle. And after generating a report the Computer Group name is shown. But as many groups are created through the Operations Console, a Display Name would be nicer.

To change this I modified the RDL file directly and notified the creators of this MP. Remember that this is not the standard method for editing SCOM reports.

For sorting the computer groups...

I changed:

SELECT FullName, DisplayName
FROM OperationsManagerDW.dbo.vManagedEntity with (nolock) where Path is null and FullName not like '%:%' and DisplayName like '%Computer%'

To:

SELECT FullName, DisplayName
FROM OperationsManagerDW.dbo.vManagedEntity with (nolock) where Path is null and FullName not like '%:%' and DisplayName like '%Computer%'
ORDER BY DisplayName

And for the table footer...

I changed:

<value>=Parameters!Group.Value</value></textbox>

To:

<value>=Parameters!Group.Label</value></textbox>

I you want, you can download the RDL file here: https://sites.google.com/site/systemcentertechblogresources/scripts/Windows.LogicalDrives.FreeSpace.Report_MichielWouters_1.0.rdl?attredirects=0&d=1

SCOM: Get Overrides from Management Pack

Here's an example of how to retrieve all overrides from a specific management pack and get additional information about the overriden rule and override context.

Get-ManagementPack  where {$_.DisplayName -match "Your Management Pack"}  Get-Override  % {Get-Rule -Id $_.Rule.Id  Select DisplayName
; Get-MonitoringClass -Id $_.Context.Id; Write-Host $_.Parameter: $_.Value}

To manage all your overrides you could use a tool like OverrideExplorer.

Searching for Management Pack authoring

Today I came accross a blog post of Brian Wren from Microsoft.
They're working on a better search solution for finding information focussed on System Center technologies.

Now information and examples are scattered around the internet on forums, blogs, technet, community sites and you name it.

The solution Microsoft is working on is called 'System Center Cloud Search'. It's using the Bing search engine with selected data sources to search in.

For now, the beta is focussed on Management Pack Authoring.

See the whole story here: http://blogs.technet.com/b/mpauthor/archive/2011/04/15/cloud-search-for-management-pack-authoring.aspx

Give it a shot to see if this works for you and help making it better!