System Center Tech Blog - Michiel Wouters - SCOM, SCCM

SCOM: 2012 Wish List

2012-01-13T13:00:00.008+01:00

Last week I was present at the first SCUG (System Center User Group) meeting for this year. It was a great source of information. Two speakers from Microsoft USA were present to tell us about the application monitoring feature (AviCode) and Network Monitoring feature. It looks great and promising!

As SCOM 2012 is going to be released and everyone is wondering what new features it might bring, I would like to share my ideas/wishes for the next SCOM releases. I'm pretty sure these are not available in SCOM 2012.

Remove boundary for sealed en unsealed MP's.
- Microsoft Best Practices for SCOM conflict with available functionality in SCOM.
- Using one management group all self developed MP's are unsealed and their is no way to include objects from those unsealed MP's in a distributed application.
- Currently sealing is the only solution. However sealing breaks MP's in which MP templates are used. Yeeh!
Light-weight Operator Console for better performance
Scale down Authoring in Operator Console, move functionality to Authoring Console.
Increase usability
Decrease complexity
Create intuitive GUI layer on top of current console.
Ease up using the Authoring Console as it was easy to create MP's in MOM 2005 with the adminstrator console.
Possibility to use templates in the Authoring Console.
Allow role 'Author' to make use of the Management Pack templates. Currently only a SCOM Administrator is allowed to make use of them.
Dynamic component groups for DA's from the GUI to avoid XML usage.
Log file monitoring for circular log files
Out of the box better alert message possibities (read property bag definition from script, alert message templates)
Possibility to use XPath expressions in alert suppression or a GUI layer for xpath dummies, like $Data/Context/Params[Contains(Param[1],"Fatal"). This can be handy when monitoring error events in logfile
Review the current class model. There so much classes now. Is this really necessary? The new Network Monitoring features add classes for each component and each brand. Why not using multiple discoveries for 1 class?

If you have other good ideas/wishes, let me know!

SCCM: Get Drivers From Driver Packages (WQL)

2011-08-16T17:30:00.004+02:00

I was searching for a way to list Driver Packages which contain Drivers. Why? I want to use Driver Packages without importing the drivers in SCCM.
Why? You can read about that here: http://hayesjupe.wordpress.com/sccm-osd-driver-best-practices/

I found an interesting script of Christjan which can detect differences in drivers between Driver Packages. The script contained the necessary WQL statements that I needed.

Here's the link to his script:
http://pr3m.pri.ee/blog/?p=653

Example WQL query for displaying the PackageID and Name of Driver Packages that contain drivers:

SELECT DPKG.Name,DPKG.PackageID FROM SMS_PackageToContent AS PTC

JOIN SMS_CIToContent AS CITC ON PTC.ContentUniqueID=CITC.ContentUniqueID

JOIN SMS_Driver AS DRV ON CITC.CI_ID=DRV.CI_ID

JOIN SMS_DriverPackage AS DPKG ON PTC.PackageID = DPKG.PackageID

SCCM: Task Sequence Import Fails with APPCRASH

2011-08-09T17:30:00.004+02:00

Currently I'm working on automating the provisioning of SCCM environments.
One of the things that came along was exporting and importing Task Sequences between SCCM environments.
After automatically dealing with the package references I was ready to import them in the target SCCM deployment with my script.

Sadly, this didn't work. Even with the ConfigMgr Console it didn't work. As I was not presented with some kind of error, I searched the Event Viewer.

There I found multiple APPCRASH events (eventid 1000) on wmiprvse.exe.
So there had to be something in the Task Sequence export files that causes WMI to crash.

Many times WMI crashes because of bad queries or non-existing WMI classes, or ..... yep memory issues.

After (manually :'( ) comparing the two SCCM deployments, I found out I was missing the Microsoft Deployment Toolkit 2010 Task Sequence steps on the target SCCM deployment. After installing that, all issues were gone.

It would be nice though if the ConfigMgr console could present me with a simple error, stating that MDT was missing. Arghh.....

SCOM: Dynamic Group MaxDepth

2011-06-21T21:06:00.003+02:00

This blog shows a trick to retrieve the right query depth when using contains/contained expressions in group membership rules.

If you don't know how these expressions work: Raphael Burri has an excellent blog about Dynamic Group Population: http://rburri.wordpress.com/2009/01/14/dynamic-group-membership-authoring-and-performance-impact-on-rms/

Whenever you use Contains or Contained (or their compliments NotContains or NotContained), you should use the attribute MaxDepth to save I/O on the RMS.

But how do you know what the MaxDepth is???

You could find this info in the Service Model from the Management Pack Guide. But not every MP Guide is equiped with a Service Model.
To overcome this, you can use the Group membership rule wizard (Query Builder) in the Operations Console.

In this example I want to group all IIS 7.0 Application Pools which are hosted on computers with a specific Computer Description. In most cases MaxDepth 1 will do, but not in this case.

For the Computer Description attribute I created an extended class based on Windows Computer. The attribute is filled with the value of a registry key found locally on the agent.

Let's see.....

Start the Create Group Wizard and go the the Dynamic Members tab:

Click Create/Edit rules and select IIS 7.0 Application Pool class and click Add:

Select the property drop down list and go to the last entry, which shows the host class. This shows that the IIS 7.0 Application Pool Class is hosted by the IIS 7.0 Web Server class.

In the next steps select the parent classes until you reach the host class Windows Computer. For every host step, maxDepth is incremented.

So now you know that you'll have to use maxDepth="3" in Contains/Contained expressions on the Windows Computer class (or in my case a class which derives from this class).
The membership rule would look like this:


  $MPElement[Name="Windows1!Microsoft.Windows.InternetInformationServices.2008.ApplicationPool"]$
  $MPElement[Name="MicrosoftSystemCenterInstanceGroupLibrary6172210!Microsoft.SystemCenter.InstanceGroupContainsEntities"]$
  
 
   $MPElement[Name="MyExtLib!MyExtLib.Windows.Computer.Extended"]$
   
  
    
   $MPElement[Name="MyExtLib!MyExtLib.Windows.Computer.Extended"]/Description$
    
    ContainsSubstring
    Web Server LOB1

Of course you can create groups based on the host properties, but sadly this doesn't work on derived classes.
If you do can work with the host properties, the membership rule can look like this:


  $MPElement[Name="Windows1!Microsoft.Windows.InternetInformationServices.2008.ApplicationPool"]$
  $MPElement[Name="MicrosoftSystemCenterInstanceGroupLibrary6172210!Microsoft.SystemCenter.InstanceGroupContainsEntities"]$
  
 
   
  
    $MPElement[Name="MicrosoftWindowsLibrary6172210!Microsoft.Windows.Computer"]$
    $MPElement[Name="MicrosoftWindowsLibrary6172210!Microsoft.Windows.Computer"]/OrganizationalUnit$
  
   
   ContainsSubstring
   Web Servers

SCOM: Reserved Custom Attributes?

2011-06-08T16:28:00.008+02:00

Today I came accross a post of Daniele Grandini in which he writes that the Exchange 2010 MP uses the Custom Attributes of alerts for it's internal Alert Correlation engine.

Why is this important to know? Custom Attributes can be used for notification purposes to send extra information.

I realised I know more Management Packs which also use these Custom Attributes. So here's a short list of the MP's:

Microsoft Biztalk Server MP 6.0.6703.0: Custom Field 1

Microsoft Group Policy 2003 MP (Converted): Custom Field 6

Microsoft SCCM MP 6.0.6000.2: Custom Field 1 and 6

nWorks VMware VEM MP 5.0.3.248: Custom Field 1 to 6 and 9, 10

This is what I came accross. It's possible these MP's use more custom attributes. Let me know when you want to add something to this list.

You can check this quickly by creating an alert view (MyWorkspace also possible), and show all alerts with a filter on custom attribute 1 to 10 with text '%'.

SCOM: Small edit for SCC Logical Disk Extension Management Pack

2011-05-25T20:00:00.003+02:00

This blog post is about the SCC Logical Disk Extension Management Pack.

This MP is a real nice example of a combined forces from the System Center community. It contains some extra Logical Disk collection rules and two Logical Disk reports.

Using the MP is pretty simple, but i noticed two small things.
The parameter list to select a Computer Group is not sorted. Finding the right group between more that 300 groups can be a hassle. And after generating a report the Computer Group name is shown. But as many groups are created through the Operations Console, a Display Name would be nicer.

To change this I modified the RDL file directly and notified the creators of this MP. Remember that this is not the standard method for editing SCOM reports.

For sorting the computer groups...

I changed:

SELECT FullName, DisplayName
FROM OperationsManagerDW.dbo.vManagedEntity with (nolock) where Path is null and FullName not like '%:%' and DisplayName like '%Computer%'

To:

SELECT FullName, DisplayName
FROM OperationsManagerDW.dbo.vManagedEntity with (nolock) where Path is null and FullName not like '%:%' and DisplayName like '%Computer%'
ORDER BY DisplayName

And for the table footer...

I changed:

<value>=Parameters!Group.Value</value></textbox>

To:

<value>=Parameters!Group.Label</value></textbox>

I you want, you can download the RDL file here: https://sites.google.com/site/systemcentertechblogresources/scripts/Windows.LogicalDrives.FreeSpace.Report_MichielWouters_1.0.rdl?attredirects=0&d=1

SCOM: Get Overrides from Management Pack

2011-05-25T15:29:00.003+02:00

Here's an example of how to retrieve all overrides from a specific management pack and get additional information about the overriden rule and override context.

Get-ManagementPack  where {$_.DisplayName -match "Your Management Pack"}  Get-Override  % {Get-Rule -Id $_.Rule.Id  Select DisplayName
; Get-MonitoringClass -Id $_.Context.Id; Write-Host $_.Parameter: $_.Value}

To manage all your overrides you could use a tool like OverrideExplorer.

Searching for Management Pack authoring

2011-04-21T10:39:00.004+02:00

Today I came accross a blog post of Brian Wren from Microsoft.
They're working on a better search solution for finding information focussed on System Center technologies.

Now information and examples are scattered around the internet on forums, blogs, technet, community sites and you name it.

The solution Microsoft is working on is called 'System Center Cloud Search'. It's using the Bing search engine with selected data sources to search in.

For now, the beta is focussed on Management Pack Authoring.

See the whole story here: http://blogs.technet.com/b/mpauthor/archive/2011/04/15/cloud-search-for-management-pack-authoring.aspx

Give it a shot to see if this works for you and help making it better!

SCOM: CU4 and Microsoft.SystemCenter.Library.mp 6.1.7221.61

2011-02-25T17:18:00.014+01:00

This blog post is for those who updated SCOM with CU4 and have issues with the Authoring Console and Microsoft.SystemCenter.Library.mp version 6.1.7221.61.
-----------------------------
** Update: 08/09/2011 **
Microsoft published a KB-article which resolves this problem:
http://support.microsoft.com/kb/2590414
-----------------------------

After applying CU4, Microsoft.SystemCenter.Library management pack is updated.
When using the Authoring Console on MP's created in a CU4 Management Group, you are prompted for Microsoft.SystemCenter.Library.mp 6.1.7221.61.

But, the MP file is not available from the CU4 installation sources.

The management pack is updated trough the sql batch on the OperationsManager database, CU4_Database.sql.

DECLARE @ver nvarchar(25)

DECLARE @compare int

SET @ver = (SELECT Mpversion FROM ManagementPack WHERE MPName = 'Microsoft.SystemCenter.Library')

-- Update Microsoft.SystemCenter.Libarary MP directly via SQL

A thread about this is going on at the Microsoft forums: http://social.technet.microsoft.com/Forums/en-US/operationsmanagermgmtpacks/thread/45d6bac1-4b10-4f36-86de-2efea895fc94

There is an easy workaround mentioned on the forum by dbabob56:
After exporting you can change the version number.

FROM


      

        Microsoft.SystemCenter.Library

        6.1.7221.61

        31bf3856ad364e35


      

        Microsoft.SystemCenter.Library

        6.1.7221.0

        31bf3856ad364e35

SCOM: Account specified in the Run As Profile cannot be resolved - Troubleshooting using SSID

2011-02-17T22:38:00.014+01:00

Some management packs require configuration of Run As Profiles.
This means that you configure associations between classes/objects and Run As Accounts. Whenever a workflow from a management pack is instructed to use a Run As Profile it will only work when the targeted class or object of the workflow is associated with an account. And last but not least, the Run As Account should be distributed to the servers on which that class exists.

This blogs shows you some tips on how to troubleshoot alerts associated with these kind of things.

When you misconfigure the Run As Profile, the following alert can popup in your console:
Account specified in the Run As Profile ">RunasAccountProfile<" cannot be resolved.

With some extra info:

Management Group: ###
Run As Profile: Company.Product.Role.Application.ActionAccountProfile
Account SSID: 0025F224C5251A6F4EEE112ACD9F0EB07D9178AFB500000000000000000000000000000000000000

This alert tells you that you associated the runas account, but the agent that tries to use the account, did not actually receive the account credentials.
So either you add the server to the distribution list, or you reconfigure the runas profile associations with beter classes/objects.

But he! I can't find the specified Run As Profile 'Company.Product.Role.Application.ActionAccountProfile'. That's right. That's the Name property shown in the description. If you want to find the Run As Profile as it's showed in the Operations Console, you will need the DisplayName. For that we could use the Operations Manager Shell:

Get-RunAsProfile ... oh, that cmdlet does not exist :(

What more does the alert message say? This is interesting:
Note: you may use the command shell to get the Run As Account display name by its SSID"

We could use the SSID from the alert message. The Ops Mgr Shell does have a cmdlet for showing the Run As Accounts.
The only problem we have here, is that the SSID mentioned in the alert description is a string type value. Cmdlet Get-RunAsAccount shows us that the SSID is stored as a byte array in the property SecureStorageId. So we can't compare these types.

For that i've created this script. It gets all Run As Account, formats the byte array SecureStorageId property to a readable string, and show the Run As Account DisplayName with it's SSID.

Get-RunAsAccount | Sort Name | % {$string = $null;$_.SecureStorageId | % { 
 $string = $string + "{0:X2}" -f $_}
 $_.Name;"  $string"
}

PowerShell does not have built-in functions for formatting numbers, therefore you can use the .Net formatting methods.

With this in mind you could add a string comparison to only show a match when the Alert Message SSID correspands with the SecureStorageId string ($string).
If you need help with that, leave a message.

SCOM: Find Notification Subscriptions for Subscriber

2011-02-07T11:33:00.006+01:00

What to do when you want to delete a subscriber in SCOM, but you can't because get an error like this:

The notification recipient is subscribed to at least one notification subscription.
Please remove it from all notification subscriptions before deleting it.
.....cannot be deleted as its currently in use.

To solve this you would have to browse manually through all your notification subscriptions. But how much time would that take.
With this PowerShell script it takes 2 seconds!

Get-NotificationSubscription | foreach {
 $ns = $_.DisplayName
 $_.ToRecipients | foreach { 
  If ($_.Name -match "John") {
   Write-Host $ns
  }
 }
}

SCOM: Find Specific Members in User Roles (PowerShell)

2010-12-09T21:00:00.000+01:00

Last week I was doing some User Role testing with a test account of mine. Normally I always use Active Directory groups for adding and removing members of a user role.
But for quick testing with some views I added my test account directly to several user roles.

I wanted to know in which user roles my test account was added.
Beneath is a PowerShell script to find members of a user role which name contains the given search criteria. The name is usually a (AD) User Account or Group, like Admin1234@domain.local or DOMAIN\Admin123.

#Find member of userrole which contains a specific text
#The search criteria is case-sensitive

$searchtext = "Admin"
Get-Userrole | Sort DisplayName | % { $userrole = $_.DisplayName;$_.Users | % { If($_.Contains("$searchtext")){ Write-Host -foregroundcolor yellow $userrole;Write-Host "  $_"} }}

SCOM: Get Nested Group Members (Powershell)

2010-12-08T08:30:00.008+01:00

When you create nested groups in SCOM you have to use workarounds to view the actual group members of a specific type, e.g. Windows Computer. Using 'View Members' only returns the nested groups and not the contained objects.

One of the ways to view the actual members of a group, is to create a 'State View'.
As a "filter" you then change the class type to show the data related to the type you want to see and then you select the group for scoping the returned data.

So in short terms, to view the nested group members
- Create a state view
- Change "Show data related to" to a class like 'Windows Computer'
- Change "Show data contained in a specific group" to the group of which you want the members.

But, there's quicker way to achieve this. Using Powershell you can retrieve the members of a nested group in a couple of seconds. I found out about 'Recursive' using the SCOM SDK.

$group = Get-MonitoringObject | Where { $_.DisplayName -eq "YourGroupName"}
$MonitoringClass = Get-MonitoringClass -Name "Microsoft.Windows.Computer"
$group.GetRelatedMonitoringObjects($MonitoringClass,"Recursive") | Select DisplayName

SCOM 2007 R2 Core MP Update & Guide Inconsistency

2010-11-30T20:45:00.006+01:00

Last week Microsoft published a new version of the Core MP for SCOM 2007 R2, version 6.1.7695.0, see Kevin Holman's blog.

The MP Guide showed 3 new rules that where added with this version as a substitution for two monitors which you could enable and disable, respectively.

However after loading the MP in my test environment, it showed that the new rules are already enabled and the substituted monitors disabled.

Quote:

Manual Reset MonitorsThe Operations Manager Management Pack contains two monitors that require manual reset of health state, which are listed below. In version 6.1.7695.0 of the management pack, rules have been included that you can ??? enable in place of those monitors. The rules generate alerts for the same conditions as the monitors.

You can disable Alert Subscription Configuration Monitor and in its place, enable the following
rules:
Alert Subscription Configuration Critical Notification Rule, which generates a critical alert on the same critical conditions as the monitor.
Alert Subscription Configuration Warning Notification Rule, which generates a warning alert on the same warning conditions as the monitor.
You can disable the Alert Subscription Available monitor, and in its place, enable Alert Subscription Availability Critical Notification Rule, which generates a critical alert on the
same critical conditions as the monitor.

Just wanted to let you know.

SCOM: Deliver Reports to Sharepoint

2010-11-19T15:04:00.005+01:00

Today I focussed on delivering SCOM reports to a Sharepoint document library with the File Share and e-mail delivery methods.

Most teams and departments have used file shares and network mappings to store their documents. These days more and more companies are using portal products for that purpose, like Microsoft Sharepoint.

In this blog I'll show you how you can deliver a report to a Sharepoint 2007 library. Although this is not difficult to setup, there are some things you need to know to get it working. In this setup SQL SRS 2005 and Sharepoint 2007 are used.

Note: SQL Reporting Services 2008 supports publishing reports directly in Sharepoint libraries, but SCOM 2007 does not support that. Atleast as far as I know. :)

Operations Manager supports two kinds of delivery, file and e-mail.
Both flavours can work, but it fully depends on how your Sharepoint implementation is setup.
There's a third but that's the Null Delivery Provider to cache reports.

E-mail delivery
For Operations Manager Reporting to deliver e-mail to a library the following has to be in place and configured.

Configure SQL Reporting Services

Use the Reporting Services Configuration Manager
Make sure the the Windows Service identity is configured with a domain user account and not with a local account (Data Warehouse Reader account).
Configure the E-mail Setttings
Make sure your SMTP server allows you to send e-mail

Configure you Sharepoint document library

Make sure you have administrative rights on the document library
Configure incoming e-mail settings on the library in which you want to deliver your reports
Unfortunately you cannot change the name of the file SQL Reporting Services sends along with the e-mail message.
As i want to archive all reports, I don't want them to be overwritten. In this case Sharepoint will create unique numbers as a postfix in the file name.
If you don't want everyone to be able to send documents in to your library restrict access to specific users. In this case configure the SCOM Reporting Windows Service account to be allowed to send e-mail (Data Warehouse Reader account).
Group items on the e-mail subject. This is the only configurable item when you schedule a SCOM report.

Schedule your reports

Choose a naming convention for delivering your reports.
Use that in naming your e-mail subjects, so they are neatly grouped in your Sharepoint library.
Choose the right document format, e.g. PDF.

And the deliver!

Windows File Share (Sharepoint Library UNC path)

The other option is deliver the reports in to a file share. This is rather easy to setup when you're using ordinary File Shares, but as I sead earlier, more and more companies are using centralised documentation solutions like Sharepoint.
What I like about this delivery method is the possibility to give your reports a more understandable name. And more, SQL Reporting Services auto increments the new files which is more readable than the generated unique numbers when using incoming email on the Sharepoint library.

What you need:

A domain account for authentication on the Sharepoint library. You could use "RDA" in the account name, as for Report Delivery Account.
Configure the account to have enought privileges to add new items to that library
Write down the Network UNC path of that library

Configure your Report Server

On Windows Server 2003: Make sure the Web Client service is running and is started automatically. You need this to connect to a Sharepoint library with UNC.
On Windows Server 2008: There's no Web Client in Windows Server 2008. For the UNC path to work you need to install a feature called, Desktop Experience. You can add this feature with the Server Manager > Features > Add Feature > Desktop Experience. Notice that you'll need to reboot the Reporting Server after the installation.
Test the UNC path of the library from your Report Server

Schedule your report

Select the File Delivery Method
Choose a naming convention for delivering your reports.
Use that in naming your report files (remember that file names of new items are autoincremented)
Fill-in the UNC path of the library that you wrote down earlier
Use the domain account with the necessary privileges (a.k.a. Report Delivery Account)

And then you can deliver your report.

SCOM: Recipient address not valid - Find with PowerShell

2010-09-29T10:49:00.011+02:00

One of the benefits of Operations Manager 2007 is the capability for users to create and maintain their own subscription notifications.

When a user adds a notification device to there recipient configuration, it's easy to make a small mistake. Whenever the Notifcation Server on the RMS trying to send a notification to a misconfigured address an alert is triggered, "Recipient address <address> is not valid."

The alert description shows in which subscription this address is used, but it's more important to know in which recipient this address can be found.

For that you can use this PowerShell script:

$searchcriteria = "yourtext"
Get-NotificationRecipient | foreach {
 $addresses = $null;
 $subname = $null;
 $subname = $_.Name;
 $addresses = $_.Devices | Where {
  $_.Address -match $searchcriteria
 }
 if ($addresses -ne $null) {
  Write-Host '***' $subname '***'; $addresses
 }
}

As a one-liner:

$searchcriteria = "yourtext";Get-NotificationRecipient | foreach {$addresses = $null;$subname=$null;$subname = $_.Name;$addresses = $_.Devices | Where {$_.Address -match $searchcriteria }; if ($addresses -ne $null) { Write-Host '***' $subname '***'; $addresses}}

SCOM: Average Events Per Day keeps the doctor away

2010-09-27T13:56:00.008+02:00

First of all, because I'm very busy with actually working on SCOM projects I can't spend the time blogging about SCOM as much as I would like.

But today I found some time to blog about a simple, but handy, SQL query I used to determine the average number of events stored in the Data Warehouse database per day.

At the base I used a query from Jonathan Almquist. Then I used that query as derative to count and calculate the average number of events per day. You can adjust the number of days, if you want.

select Count(Date) as 'Number Of Days', Avg(Events) As 'Average Number of Events'
From (
SELECT CONVERT(VARCHAR(10), DateTime, 101) AS Date, Count(*) AS Events
FROM Event.vEvent
WHERE (DateTime BETWEEN DATEADD(day, - 6, GETDATE()) AND GETDATE())
GROUP BY CONVERT(VARCHAR(10), DateTime, 101)
) x

So, what can you do with this?
Well, how do you know if your Management Servers can cache the event data collected by your agents when your Data Warehouse is down for a couple of hours.
Running these type of queries can help you understand how much data is stored in the Data Warehouse over time.

Tools like dwdatarp are also very helpfull to understand the data storage of the DWH.

SCOM: Operations Manager 2007 R2 Documentation

2010-07-30T23:03:00.008+02:00

As I was browsing the Microsoft Technet site (most recent downloads) I came across a renewed documentation package for Operations Manager 2007 R2.

In this package you'll find everything you need for administering and authoring your OpsMgr environment, including XPlat! Also an easy way to complete your documentation library if it's not already up-to-date.

Here's a list with the contents:

Linked.Reporting.MP.xml
OM2007_AuthGuideXplat.exe
OM2007_ReportAuthoringGuide.docx
OM2007R2_CrossPlatformMPAuthoringGuide.docx
OM2007R2_CrossPlatformMPAuthoringGuide_Samples.zip
OM2007R2_DeploymentGuide.docx
OM2007R2_DesignGuide.docx
OM2007R2_MigrationGuide.docx
OM2007R2_MPAuthoringGuide.docx
OM2007R2_MPModuleReference.docx
OM2007R2_OperationsAdministratorsGuide.docx
OM2007R2_OperationsUsersGuide.docx
OM2007R2_SecurityGuide.docx
OM2007R2_UpgradeGuide.docx

If you want it all, just use the last download link

System Center Operations Manager 2007 R2 Documentation.zip

Microsoft's technet site: http://www.microsoft.com/downloads/details.aspx?FamilyID=19BD0EB5-7CA0-41BE-8C0F-2D95FE7EC636&displaylang=en

Even for the more experienced people there's a change already known documents are updated since the last time they were used in the field. So check it out.

SCOM: Find those heavy group discoveries

2010-07-01T11:11:00.008+02:00

Two days ago on the 'The Operations Manager Support Team Blog' a blog was posted about editing Groups and the slow Operation Manager Console. They advise to consolidate the number of membershiprules and expressions in regular expression.

But how do you know which groups are eligable for a consolidation? Well, for that I created this script.
It retrieves groups that comply with the given user input for the 'DisplayName'. For every group the Discovery information is retrieved. If the Discovery Configuration matches the prededined thresholds for the number of MembershipRules and/or Expressions, the output will be in red. Otherwise it will be in green. The threshold can be changed at will.

Download: ShowGroupDiscoveryDatasourceConfiguration.ps1

#User-input only works from within a script!
$strGroup = Read-Host "Enter a group discovery name (wildcard) string";

$intMembershipRuleThreshold = 3;
$intMembershipRuleExpressionThreshold = 5;
$intMembershipRuleCount = 0;
$intMembershipRuleExpressionCount = 0;

#These Id's are the base Id's which are usually used when creating groups
$strInstanceGroupBaseClassId = "4ce499f1-0298-83fe-7740-7a0fbc8e2449" #Instance group
$strComputerGroupBaseClassId = "0c363342-717b-5471-3aa5-9de3df073f2a" #Computer group

Write-Host "Retrieving class that match:" $strGroup;
$colGroups = Get-MonitoringClass | where {$_.DisplayName -match "$strGroup" -and $_.Base -ne $null} | Sort-Object -Property DisplayName

if ($colGroups -ne $null) {
 $colGroups | foreach {
  If (($_.Base.Id.ToString() -eq $strInstanceGroupBaseClassId) -Or ($_.Base.Id.ToString() -eq $strComputerGroupBaseClassId)){
   Write-Host "Class:" $_.DisplayName;
   $colDiscoveries = $_.GetMonitoringDiscoveries();
   #check if discoveries exist
   If ($colDiscoveries.Count -ne 0) {
    $colDiscoveries | foreach {
     Write-Host "  Discovery:";
     $config = [xml] ("" + $_.DataSource.Configuration + "");
     #check wether Discovery uses membership rules
     $intMembershipRuleCount = $config.GetElementsByTagName("MembershipRule").Count;
     If($intMembershipRuleCount -gt 0){
      If ($intMembershipRuleCount -ge $intMembershipRuleThreshold){
       Write-Host "    MembershipRules:" $intMembershipRuleCount -ForeGroundColor red;
      } else {
       Write-Host "    MembershipRules:" $intMembershipRuleCount -ForeGroundColor green;
      }
      $intIndex = 0;
      $config.config.MembershipRules.MembershipRule | %{
       $intIndex++;
       $intMembershipRuleExpressionCount = $_.GetElementsByTagName("Expression").Count;
       If ($intMembershipRuleExpressionCount -gt 0) { 
        Write-Host "      Membership Rule #$intIndex";
        If ($intMembershipRuleExpressionCount -ge $intMembershipRuleExpressionThreshold){
         Write-Host "        Expression count:" $intMembershipRuleExpressionCount -ForeGroundColor red;
        } else {
         Write-Host "        Expression count:" $intMembershipRuleExpressionCount -ForeGroundColor green;
        }
       }
       $intMembershipRuleExpressionCount = 0;
      }
     }
     $config = $null;
      $intMembershipRuleCount = 0;
    }
   }
  }
 }
}

(ps. Save it as a script to use interactive User Input.)

SCOM: Agent Queue Size Script

2010-06-29T16:36:00.008+02:00

A while ago I needed a script to adjust the SCOM Agent Queue size to make sure no auditing events were lost in case of a link failure between DC's and OpsMgr MS's.
So I created this script to do this for me.

If supports launching it from a Agent Task . The script gives a return code and quits before restarting the Health Service with a scheduled job, using 'at'.

Option Explicit
SetLocale("en-us")

Dim blnForceRestart
Dim lngValue
Dim strComputer
Dim strManagementGroup

Const HKEY_LOCAL_MACHINE = &H80000002
blnForceRestart = False
strComputer = "."


Call Main


Sub Main()

 Call GetParams()
 WScript.Echo "Executing " & WScript.ScriptName
 Call RegChange()

End Sub



Sub RegChange()
 Dim objReg
 Dim lngCurrentValue
 Dim strKeyPath
 Dim strValueName
  
 Set objReg = GetObject("winmgmts:\\" & strComputer &"\root\default:StdRegProv")
 strKeyPath = "SYSTEM\CurrentControlSet\Services\HealthService\Parameters\Management Groups\" & strManagementGroup
 strValueName = "MaximumQueueSizeKb"
 
 objReg.GetDWORDValue HKEY_LOCAL_MACHINE, strKeyPath, strValueName, lngCurrentValue
 
 If IsNull(lngCurrentValue) Then
  WScript.Echo "An error occured while reading registry key."
  WScript.Quit 201
 End If
 
 If CLng(lngCurrentValue) <> lngValue Then
  objReg.SetDWORDValue HKEY_LOCAL_MACHINE, strKeyPath, strValueName, lngValue
  WScript.Echo strValueName & ": " & lngCurrentValue & " changed to " & lngValue
  Call ScheduleRestartHealthService()
 Else
  WScript.Echo "Current value '" & lngCurrentValue & "' matches parameter value: " & lngValue
  If blnForceRestart Then
   WScript.Echo "Restart of HealthService forced."
   Call ScheduleRestartHealthService()
  End If
 End If
End Sub



Sub ScheduleRestartHealthService()
 Dim dtmTime
 Dim dtmScheduleTime
 Dim objShell
 Dim intMinutesDelay
 Dim intReturn
 
 Set objShell = CreateObject("Wscript.Shell")
 dtmTime = Now()
 If Second(dtmTime) < 50 Then
  intMinutesDelay = 1
 Else
   intMinutesDelay = 2
 End If
 dtmScheduleTime = FormatDateTime(DateAdd("n",intMinutesDelay,dtmTime),4)
 WScript.Echo "Scheduling a HealthService restart for " & dtmScheduleTime
 intReturn = objShell.Run("at " & dtmScheduleTime & " cmd /c " & Chr(34) &_
   "net stop healthservice && net start healthservice",0,False)
 If intReturn > 0 Then WScript.Quit Clng(intReturn + 500)
End Sub

Sub GetParams()
 If Wscript.Arguments.Named("mgmtgrp") <> "" Then
  strManagementGroup = Wscript.Arguments.Named("mgmtgrp")
 Else
  WScript.Echo "Missing 'mgmtgrp' argument"
  WScript.Quit 101
 End If
 
 If WScript.Arguments.Named("sizekb") <> "" Then
  lngValue = CLng(WScript.Arguments.Named("sizekb"))
 Else
  lngValue = 15360 'Default value
  WScript.Echo "Using default Queue Size, " & lngValue & " kB."
 End If
 
 If WScript.Arguments.Named.Exists("forcerestart") Then
  blnForceRestart = True
 End If
End Sub

SCOM: System Center Operations Manager R2 Unleashed - Review - A GREAT Supplement

2010-06-24T13:31:00.003+02:00

A few weeks ago I got my copy of the supplement to the book 'System Center Operations Manager 2007 Unleashed', called 'System Center Operations Manager 2007 R2 Unleashed'.

I love the 'Unleashed' books for SCCM and SCOM and couldn't wait to get my hands on this one. As I blogged a while ago, this book contains a lot of updates compared to the first book. This blogpost is a my personal review about the contents and as far as I know my first public book review.

This book is writen by the same authors as it's big brother. Along with many other SCOM specialists they managed to create a very useful and practical technical add-on. It's really loaded with in-depth information.

Why I think you should get this book:

A lot of best practices & examples
A convenient and clear summary of updates/changes on SCOM since its introduction
A great chapter about X-plat/Cross-platform monitoring, including a walkthrough and examples with 3rd party management packs!
All you need to know about Windows 2008 and System Center Operations Manager R2, it's there
Nice writing about upgrading SQL 2005 to SQL 2008
Everything you need/wanted to know about the OpsMgr PowerShell Extensions
Including: practical documentation, examples and performance enhancements
A virtualization update about managing virtual infrastructures
Nice chapter about MP Authoring. I think this can help a lot of SCOM admins with creating management packs.

Pros:

Many best-practices SCOM admins can find on the web are finally grabbed together in this "fat pocket guide"
Nice examples (SQL queries & Powershell)
Cross-platform in a nutshell
It's clearly visible the authors worked together with the known MVP's and other specialists. The MP cook down practices are a great example of this.
The book has answers to most of the questions that can arise with managing SCOM, like performance, scaling, backup & recovery.
Nice appendix with more up-to-date MP tuning tips (compilation of ops-mgr.spaces.live.com which moved to http://systemcentercentral.com/byexample)

Small ;) Cons:

VMM promo. The virtualization chapter takes the reader along the features of VMM integration with OpsMgr. It's a nice promo & walkthrough, but it would be nice to also see more of Bridgeway's of Veeam's MP. I must say the authors did a great job showing some features of the VMM MP, of which you could benefit when you use VMware virtualization technology without vCenter. (I think this could be an item of the pros list ;) )
The pages could use some chapter - paragraph header info. Because of the information load, it's nice to know where you're at :D (like the original book)
I think adding extra in-depth information about creating and using Reports is the last item that's missing for a SCOM admin to be fully equiped. This book contains a paragraph about the R2 enhancements and using a linked report in the Authoring Console. It would be nice to add some best-practices/guides about getting more from the Reporting feature like they did in the chapter about the PowerShell Extensions chapter. More examples like in the previous book would be nice!
On page 13 it states the R2 version of the Windows Service Management Pack template enables wildcard entry to select multiple, similarly named services. I'm still searching for this, but haven't been able to use wildcards with this template besides using the WmiProviderWithClassSnapshotDataMapper.

Book 'Rollup': Very Healthy

Great book for every SCOM admin and author. I think this is a piece of equipment every SCOM admin should have in his/her toolbox. Along with the 'System Center Operations 2007 Unleashed' book of course.

Syntax Highlighting Feature

2010-06-02T12:14:00.013+02:00

I'm running this blog for 1,5 years now, and I thought it was time to add a little bling feature.


$message = "So, for better readability,"

Dim strMessage="from now on all my code examples..."

are presented with syntax highlighting"

syntax highlighing for a lot of different code types: see here

code view

code copy

code printing

See SyntaxHighlighter for more information.

Powershell Example:

# SCOM Shell Script
#Returns all User Roles matching given DisplayName and show the User Role members
Get-UserRole | Where {$_.DisplayName -match "Operator Team X"} | Sort-Object DisplayName | foreach { Write-Host "Role:" $_.DisplayName ; $_.Users | foreach { Write-Host "   $_"}}

To view all code items use #Code label.

SCOM: Get-UserRole Group Scope (PowerShell)

2010-05-31T17:51:00.019+02:00

Recently I wanted to document all the User Roles from a specific Management Group with their Group Scope and Views. Because their is no UI to see this quickly, besides scrolling through a list of disabled and enabled groups, I created this script.

SCOM PowerShell script for listing a User Role with it's Group Scope.
It returns all non-system* User Roles with a (sorted) list of groups from the Group Scope.
Stay tuned because i'm working on the 'Views' part.

Get-UserRole | Sort-Object DisplayName | foreach {If($_.IsSystem -ne $true){Write-Host "--" $_.DisplayName "--";If($_.Scope.MonitoringClasses -ne $null){$_.Scope.MonitoringClasses | foreach {Get-MonitoringClass -Id $_} | Sort-Object DisplayName | foreach {Write-Host "  "$_.displayName}}else{$_.Scope.MonitoringObjects | foreach {Get-MonitoringObject -Id $_} | Sort-Object DisplayName | foreach {Write-Host "  "$_.displayName}}}}

For better readability:


Get-UserRole | Sort-Object DisplayName | foreach { 
  If($_.IsSystem -ne $true)
  {
    Write-Host "--" $_.DisplayName "--"
    If($_.Scope.MonitoringClasses -ne $null){
      $_.Scope.MonitoringClasses | foreach {Get-MonitoringClass -Id $_} | Sort-Object DisplayName | foreach {Write-Host "  "$_.displayName}
    } else {
      $_.Scope.MonitoringObjects | foreach {Get-MonitoringObject -Id $_} | Sort-Object DisplayName | foreach {Write-Host "  "$_.displayName}
    }
  }
}

* = These roles are specified as System Roles:
Operations Manager Administrators
Operations Manager Advanced Operators
Operations Manager Authors
Operations Manager Operators
Operations Manager Read-Only Operators
Operations Manager Report Security Administrators

For exporting and importing complete user roles, see http://blogs.msdn.com/b/rslaten/archive/2008/11/03/exporting-and-importing-user-roles.aspx

SCCM: Configuration Manager vNext Beta released!

2010-05-31T15:32:00.006+02:00

Microsoft released the beta for ConfigMgr vNext last week!

If you want to take a tour to see what's new in the next generation of Configuration Manager, join the beta program:
MVP Jannis Alink, visited MMS2010 and blogged about some new features

There are 3 main pilars:

User centric application management - Empowering Administrators to define intent, and end users flexible access to the right application at the right time

Allow the administrator to think users first
Application management model to capture admin intent
End user self-service software portal

Infrastructure simplification – Simplify management infrastructure, processes and administrative overhead

Unified management across PCs and devices
New role based administration and end-user experiences
Automated content distribution and troubleshooting
Redesigned core infrastructure and improved scalability

Simplify Client Management – Daily tasks, model based configuration management and improvements over existing capabilities

Automated compliance remediation
Client health and auto remediation
Remote control enhancements
Offline servicing of OS images

SCCM: Configuration Manager R3 Beta available (Microsoft Connect)

2010-05-31T09:50:00.001+02:00

For those, who for some reason, mist out on last months SCCM news. Since a few weeks SCCM R3 Beta has been released.
It's available through the Open Beta program. If you are a member of the Configuration Manager 2007 R3 Open Beta program you can download it at: https://connect.microsoft.com/site16 | https://connect.microsoft.com/site16/content/content.aspx?ContentID=16938

(It's an evaluation version and can only be used on previous eval versions or fresh installs, not on live SCCM R2 systems)

Want to see what's new in R3, use the link!

SCCM: Issue with Preloadpkgonsite.exe (SCCM Toolkit v2)

2010-05-31T09:40:00.001+02:00

In my last blog post I described a list of new functionality coming with the new SCCM Toolkit v2.
John Marcum wrote a blog about using the tool 'Preloadpkgonsite.exe', updated in Toolkit v2.

Using this tool can cause some distribution problems between the source and stored package. If you didn't specify '/UpdateStoredPkgVersion' on the cmdline, then it's possible the stored package version and the source package version are not the same.

Read more on: http://myitforum.com/cs2/blogs/jmarcum/archive/2010/05/19/146968.aspx

SCCM: New ConfigMgr 2007 Toolkit (v2) available

2010-05-04T14:35:00.001+02:00

Last week Microsoft released a new version of the SCCM toolkit. It's been a while since the last release in 2007, but there are some nice tools added to the toolkit. They aren't completely new as they were available earlier with the SMS 2003 Toolkit and updated for this toolkit.
The release also includes an updated Security Configuration Wizard Template for ConfigMgr 2007 SP2 and Windows Server 2008 R2.

Pack Contents:

Client Spy - A tool that helps you troubleshoot issues related to software distribution, inventory, and software metering on Configuration Manager 2007 clients.

Delete Group Class Tool - A tool used to remove inventory group definitions along with history data, tables, views and stored procedures for the group.

New in 2007: In addition to removing the entries in the GroupMap and AtttributeMap tables, Delete Group Class Tool also removes the inventory stored procedures, schema views and tables.

Desired Configuration Management Migration Tool - A tool used to migrate from the DCM Solution for SMS 2003 to DCM in ConfigMgr 2007.

Desired Configuration Management Model Verification Tool - A tool used by desired configuration management content administrators for the validation and testing of configuration items and baselines authored externally from the Configuration Manager console.

Desired Configuration Management Substitution Variable Tool - A tool used by desired configuration management content administrators for authoring desired configuration management configuration items that use chained setting and object discovery.

Management Point Troubleshooter Tool - A tool that checks a computer system before and after a management point installation to ensure that the installation meets the requirements for management points.

New in 2007: MP Troublshooter Tool can detect WebDAV rules and will provide simple automatic fix, which will help admin to correct issues like WebDAV authoring rules. Also supports Native Mode.

Policy Spy - A policy viewer that helps you review and troubleshoot the policy system on Configuration Manager 2007 clients.

Preload Package Tool - A tool used to manually install compressed copies of package source files on Configuration Manager 2007 sites.

New in 2007: Preload Package Tool now supports compressing packages before transferring them across the network. Supported Packages: Software Distribution Package, Virtual Application Package, Boot Image, Operating System Image, Operating System Install Package and Driver Package.

Security Configuration Wizard Template for Configuration Manager 2007 - The Security Configuration Wizard (SCW) is an attack-surface reduction tool for the Microsoft Windows Server 2008 R2 operating system. Security Configuration Wizard determines the minimum functionality required for a server's role or roles, and disables functionality that is not required. The Configuration Manager 2007 Service Pack 2 Security Configuration Wizard template supports new site system definitions and enables the required services and ports.

Send Schedule Tool - A tool used to trigger a schedule on a Client or trigger the evaluation of a specified DCM Baseline. You can trigger a schedule either locally or remotely.

New in 2007: Send Schedule Tool can now trigger DCM Baseline evaluation.
The former VBS file has become a executable.

Trace32 - A log viewer that provides a way to easily view and monitor log files created and updated by Configuration Manager 2007 clients and servers.
I haven't noticed a difference yet between the previous version and this 'new' version, besides an increased version number ;)

More info: http://scug.be/blogs/sccm/archive/2010/04/30/configmgr-2007-toolkit-version-2-is-now-available.aspx

Download: http://www.microsoft.com/downloads/details.aspx?displaylang=en&FamilyID=5a47b972-95d2-46b1-ab14-5d0cbce54eb8
(Link on SCCM Technet site is dead :) http://technet.microsoft.com/en-us/systemcenter/cm/bb892848.aspx)

nWorks VMware Management Pack DONT'S

2010-04-15T10:40:00.008+02:00

Last week i was focussing on optimizing the nWorks VMware Management Pack. (version 5.0.3.248)

Running the query below, showed that this MP is really a data dumper:

SELECT TOP 50 AlertStringName, AlertStringDescription, AlertParams, Name, SUM(1) AS
AlertCount, SUM(RepeatCount+1) AS AlertCountWithRepeatCount
FROM Alertview WITH (NOLOCK)
GROUP BY AlertStringName, AlertParams, Name
ORDER BY AlertCount DESC

You could also use the new report, Data Volume by Management Pack, available through the new SCOM R2 management pack,System Center Core Monitoring, version 6.1.7599.0. (http://www.microsoft.com/downloads/details.aspx?FamilyID=61365290-3c38-4004-b717-e90bb0f6c148&displaylang=en)

I disabled any VM monitoring activities from nWorks, because the VM's were already monitored through a SCOM Agent. This can be configured through the nWorks Management Console. It's just a mather of deselect the checkboxes for VM's. As this screenshot shows:

But still, the nWorks MP was spitting out a lot of alerts coming from Virtual Machines', like CPU and MEM thresholds.

Disabling discoveries for VM's, or not?

Seeing this, i thought disabling the discovery for any VM based object would do the trick.
So i disabled the discovery 'SV100 first stage discovery' for the class 'nWorks Collector' and the class 'VM'.
Hhm yeah right.

After doing this i lost ALL nWorks discovered objects. It apeared this discovery is linked to all discovered objects and not just the VM/Virtual Machine object. :(
So this is really a NO NO. The 'SV100 first stage discovery' discoveres all objects and relationships.

Deleting and Re-importing the nWorks VMware MP

I decided a reimport would be best.
I made a backup of the customizations Management Pack linked to the nWorks VMware MP and deleted it.
Then i deleted the nWorks VMware MP itself.

And then. Nothing.... Nothing?? Well, deleting this specific Management Pack deletes all MP related objects from the database. This resulted in locking the OperationsManagerDB for 40 minutes.
So beware of this.

After this i gave the OperationsManagerDB the necessary days to groom itself and then reimported the nWorks VMware MP and the customizations Management Pack.

Why the MP still monitors the VM's, even this is disabled through the nWorks Management Console, that's the question. I will follow up on this one.

Thought this info could be handy for some situations.

SCOM: SecureStorageBackup.exe password failed from command line

2010-03-21T02:18:00.002+01:00

A short (simple/funny) blog about using SecureStorageBackup.exe from the command line.

Tonight i was doing a (lab) restore for a SCOM 2007 R2 environment. After the initial install for that management group i made a backup of the encryption key with SecureStorageBackup.exe. Then, as a well raised IT-guy, i used a strong password with some great non-standard characters.

The restore process...

After restoring my OperationsManager database, i had to restore the encryption key using SecureStorageBackup.exe.

There a 2 modes for using SecureStorageBackup.exe.

GUI, just start the executable from Windows Explorer. A wizard will take you through the steps required.
Command Line, open command prompt and run the executable from there. Use the syntax:

SecureStorageBackup.exe Backup|Restore

I'm a fan of using the command line, so i did just that. But my password wasn't working. First i thought i had the wrong password. But then i remembered that using the command prompt some special characters do NOT work for passwords, like the dollar ($) sign.

So don't give up right away when you're trying to restore your encryption key and it fails. It might be something rather stupid as using special unsupported character in your encryption key password. Just use the GUI mode. click click....

New Core MP for SCOM R2

2010-02-27T23:05:00.000+01:00

Just came across two very interesting and detailed blogs by Marnix Wolf about the core MP update for SCOM R2.
Marnix really did a great job showing all what's new!

Part 1 - Core Monitoring Reports
http://thoughtsonopsmgr.blogspot.com/2010/02/newest-core-mp-for-scom-r2-new-road.html
Part 2 - Agent Management (nice!)
http://thoughtsonopsmgr.blogspot.com/2010/02/newest-core-mp-for-scom-r2-new-road_26.html

Configuring OperationsManagerDW grooming

2010-02-27T22:52:00.001+01:00

Last week i did some maintenance on a Operations Manager 2007 R2 Data Warehouse. Because this piece of OpsMgr maintenance is sometimes 'forgotten', i thought it would be nice to blog about this.

After this initial deployment, there has not been much maintenance. Thanks to the integrated maintenance jobs through the Operations Manager 2007 internal management pack library and having enough disk space, no actual problems did arise.

You should, probably, know that an out-of-the-box deployment of OpsMgr 2007 keeps the collected information in your Operations Manager Datawarehouse for 400 days.

Using the sizing tools from Microsoft and from books like 'Unleashed' you can calculate how much disk space you would need keeping 400 days of historical information.
Also keep in mind the backup method you will need to use, because of the rather large database files. Always consult the Database Administrator for your implementation and maintenance plans.

When a company starts of with OpsMgr 2007 with a number of 500 agents and no known future company aquisitions no problems arise. But when that company begins to expand and more agents are becoming managed by this management group, you should really do some recalculation of the your database growth for your OperationsManagerDW as well as for your OperationsManager DB. There are some pretty handy built-in reports in Operations Manager you can use to see the daily growth. Also use the Operations Console Monitoring views to view the Database Size performance counters.

If you find that the current span of historical data is not right and has to be modified there a multiple ways for doing this.

The old way: Using a sql queries and stored procedure http://aquilaweb.com/blog/index.php?itemid=41
The new and easier way: Using a simple tool, dwdatarp.exe http://blogs.technet.com/momteam/archive/2008/05/14/data-warehouse-data-retention-policy-dwdatarp-exe.aspx

I prefer the new and easier way for obvious reasons :). I you don't want to wait for the next groom workflow, run the procedure 'p_partitioningandgrooming' on the SQL database.

Within the next two weeks i'll be performing a OperationsManagerDW relocation. Of course I'll post the details and my experiences with this actions. Note that a complete 'OpsMgr shutdown' is neccesary to do this, so your agents should be configured with enough cache memory to hold on.

SCOM: System Center Operations Manager R2 Unleashed - status update

2010-01-27T21:40:00.000+01:00

The authors of SCOM 2007 Unleashed have posted an update for the release of the book System Center Operations Manager R2 Unleashed.

The 'Unleashed' books have always been a favorite of mine. Let's hope that this upcoming release is as good as its predecessors.

A copy from their Space:

System Center Operations Manager 2007 R2 Unleashed - a supplement to the earlier System Center Operations Manager 2007 Unleashed - is announced for availability mid-March 2010. As a supplement, the R2 ebook includes 9 chapters of new material covering OpsMgr 2007 R2 and additional topics not in the first book. Here's the chapter lineup:

1. Introduction and What's New
2. Unix/Linux Management: Cross Platform Extensions
3. Operations Manager 2007 R2 and Windows Server 2008
4. Using SQL Server 2008 in OpsMgr 2007 R2
5. PowerShell Extensions for Operations Manager 2007
6. Management Solutions for Small and Midsize Business
7. Operations Manager and Virtualization
8. Management Pack Authoring
9. Unleashing Operations Manager 2007

Appendix A. OpsMgr R2 by Example

Appendix B. Reference URLs

Appendix C. Available Online

Chapter 9 includes a "deep dive" into managing distributed environments, high availability, business continuity, the new Visio add-in, going beyond the basics of ACS, network monitoring using distributed applications, and targeting.

SCOM: Cumulative Update 1 for System Center Operations Manager 2007 R2

2010-01-27T21:21:00.001+01:00

Microsoft released Cumulative Update 1 for System Center Operations Manager 2007 R2. Many things have been fixed with this update.

Here the list as posted on the Microsoft website:

The Product Knowledge tab is displayed as the Company Knowledge tab after you import a language pack for System Center Operations Manager 2007 R2.
An agent cannot be removed successfully from a Windows Cluster service node.
The Heathservice.exe process on a Windows Cluster service passive node may have excessive CPU utilization.
The Healthservice.exe process may crash when it uses the OLE DB module.
The workflows that use the OLE DB data source may unload themselves if the underlying provider returns a null string or an empty string.
An instance of the MonitoringHost.exe process may cause a memory leak in nonpaged pool memory.
The notification subscriptions do not work if they are configured to parse a CustomField field or an AlertOwner field.
The Operations console loses the status as the current object that is in focus when a search filter is applied.
The SRSUpdateTool.exe process returns an error that states “Failed while updating registry entry for reporting code MSI component” when you try to upgrade SQL Reporting Services 2005 to SQL Reporting Services 2008.
The Operations Manager UI may crash when the Connector column and the Forwarding Status column are added to an Alert view.
The agents may re-process old Windows event log entries and then incorrectly generate alerts for these events that are not new.
Health state reliability fixes and improvements.
The Operations Manager Audit Collection Service (ADTServer.exe) does not start on an ACS Collector if the operating system is upgraded to Windows Server 2008 R2.
In a performance report that is exported, the list of object instances is not displayed.

Official Microsoft KB: http://support.microsoft.com/kb/974144

Kevin Holman (Microsoft) has done extensive research. See his blog for an upgrade plan & and what other users are experiencing: http://blogs.technet.com/kevinholman/archive/2010/01/17/opsmgr-2007-r2-cu1-rollup-hotfix-ships-and-my-experience-installing-it.aspx

SCOM: Registry discovery on 64 bit OS

2010-01-27T20:35:00.013+01:00

When you're running 32 bit applications on 64 bit servers with a 64 bit SCOM Agent, you really should read this post. Same goes for people who wonder why their discovery does work on 32 bit servers and not on 64 bit servers.

32 bit Application on 64 bit OS

When a 32 bit application is installed on a 32 bit Windows OS, the registry keys are usually writen to :
HKEY_LOCAL_MACHINE\Software\YourVendor\ApplicationName.

This changes when the OS is a 64 bit version.
Then a 32 bit installation sets its registry keys in:
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\YourVendor\AppicationName

Attribute Discovery
This is tricky when you don't know if one or both of these scenarios exists in your environment. There is more than one solution for your attribute discovery. (SCOM 2007 R2 is required for solution #2).

Copy the right child keys from the key HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\ to HKEY_LOCAL_MACHINE\Software\
Add an extra XML element to the Registry Discovery in your MP to make a '32 bit discovery' work on a 64 bit Agent.
Use a VBScript for the discovery in which you have multiple ways of checking for CPU Archicture en reading registry keys

I will show you how to use solution 2. If you also would like to see how to work with solution 3.

Enable the Discovery using the 32 bit part of 64 bit registry

Open your Management Pack with a text editor, e.g. notepad.exe
Go to Discoveries section
Search for the Discovery in which you want to enable 32 bit discovery
Within the section , add the following XML element

<registryview>32bit</registryview>

Save your Management Pack
Done!

In XML it will probably will look like this:

<RegistryAttributeDefinition>
  <AttributeName>AppExists</AttributeName>
  <Path>SOFTWARE\YourVendor\ApplicationName\Value</Path>
  <PathType>1</PathType>
  <AttributeType>1</AttributeType>
  <RegistryView>32bit</RegistryView>
</RegistryAttributeDefinition>

As other users have already noticed: If you make a change to the attribute from the Operations Console or Authoring console, the RegistryView element is deleted. So watch out for that!

See also: http://social.technet.microsoft.com/Forums/en/operationsmanagermgmtpacks/thread/bf566244-1164-4bf7-b08c-558bc7bc2363

SCOM: Creating and Using Dynamic Groups

2010-01-20T21:49:00.001+01:00

Today i stubled upon a, somewhat older, but rather interesting blog post of Raphael Burri. He wrote an extensive article about creating dynamic groups in Operations Manager and what the impact is on the Root Management Server (RMS).

Raphael created some pdf's with examples of how you can create more advanced membership rules for dynamic groups.

When you use the Operations Manager Console for creating groups you may find that you're pretty limited in using more complex constuctions, like using contains/not contains expression in the membership element clauses.

Instance and Computer Groups

When you look closer to the XML code that is created when exporting a MP with a 'OC'-created Group in it, you will notice that those groups are always instanced from the InstanceGroup class.

Taking a peek at all your groups in the OC, shows Computer Groups besides the Instance Groups. What's the difference? The icon :P and the relationship type. A Computer Groups only contains computer whereas an Instance Group can contain all types of objects.
Micrsoft uses both Group type in various management packs, like the IIS and Exchange 2007 MP.

Asking around gives me the impression almost everybody is just using Instance Groups. But DO know that other group types (classes) are available.

Link to Raphael Burri's post: http://rburri.wordpress.com/2009/01/14/dynamic-group-membership-authoring-and-performance-impact-on-rms/

SCOM: Importing a Management Pack fails, Event ID 26319

2009-12-18T23:58:00.005+01:00

In this post I'll explain a case in which an import of a Management Pack fails.
A failure can be caused my numerous things, like dependencies, but in this case the cause is in the MP itself.

Let say, you create a MP with some monitors, and groups in it. (in a Test Management Group or using the Authoring Console). This is MP version 1.0.0.0.
We call it MyAppMP. After finishing your MP, you import it in your SCOM Management Group.

Now you modify the MP file (Test MgmtGrp or Auth.Cons) and delete the groups because you don't need them anymore for some reason.
MP version is now 1.0.0.1.

You would think importing this updated MP wouldn't give any problems. Wrong! Importing this MP shows an error in the OpsMgr Console:

The requested management pack was invalid. See inner exception for details. Parameter name: managementPack

Because of this useless error message in the Console, I searched the Operations Manager Event Log on the RMS. There I found Event ID 26319. This Event ID is used more than once for logging numerous SDK to DB operations. (RMS to SQL db)

The event showed the following


Event Type:     Error
Event Source:   OpsMgr SDK Service
Event Category: None
Event ID:       26319
Date:           
Time:           
User:           N/A
Computer:       RMS Server
Description:
An exception was thrown while processing ImportManagementPack for session id uuid:46c14e53-8440-41c6-8979-77f0cce2b5b3;id=264.
Exception Message: The creator of this fault did not specify a Reason.
Full Exception: System.ServiceModel.FaultException`1[Microsoft.EnterpriseManagement.Common.ManagementPackException]: The creator of this fault did not specify a Reason. (Fault Detail is equal to : ManagementPack Version [1.0.0.1] is not upgrade compatible with older version [1.0.0.0]. Compatibility check failed with 6 errors:
-------------------------------------------------------
Error 1:
: ClassType: [UINameSpace328086d3480e4cf4a8859a3454410533.Group] is not upgrade compatible.
[ClassType]: [UINameSpace328086d3480e4cf4a8859a3454410533.Group] exists in current version [1.0.0.0] of ManagementPack but does not exist in the new version [1.0.0.1].
-------------------------------------------------------
Error 2:
: ClassType: [UINameSpace51b544ce66984f46bf9cd3733b4e07ef.Group] is not upgrade compatible.
[ClassType]: [UINameSpace51b544ce66984f46bf9cd3733b4e07ef.Group] exists in current version [1.0.0.0] of ManagementPack but does not exist in the new version [1.0.0.1].
-------------------------------------------------------
Error 3:
: ClassType: [UINameSpace6730031c44f34a1491ea6f608a3e674c.Group] is not upgrade compatible.
[ClassType]: [UINameSpace6730031c44f34a1491ea6f608a3e674c.Group] exis...).

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

This tells us that you cannot upgrade a Management Pack when have deleted groups which are in the current active version in your Management Group.

What should you do:

If you have an unsealed MP with overrides/customizations for MyAppMP

Export any customizations/overrides the unsealed MP
Delete the unsealed MP

Delete the old version of the MP, in this case MyAppMP, version 1.0.0.0.
Import the new version of the MP
Import the unsealed MP you backup in the steps before.

Other cases:

http://thoughtsonopsmgr.blogspot.com/2009/09/mps-wont-import-any-more-is-opsmgr.html

SCOM: Operations Console Reporting locks SDK and Config Account

2009-11-15T14:17:00.006+01:00

Update 11-26-2009: Microsoft has documented this problem as a bug but only for internal purposes. Only when more customers are having similar problems, they will give it prority for fixing. But, if you do have this problem you can fix it on your own. Using the descriptive explanation in this blog.

This blog post is about a bug i found in the Operations Console in Operations Manager 2007 R2. This bug can lock your SDK and Config Service Account.

Consider this example. You manage two SCOM environments from one main domain (domain A) and there's a one-way trust between domain A and domain B (2 seperate forests, B trusts A).

When you want to use the Reporting feature from the Operations Manager of your Management Group in Domain B, the console this will show an error because this operation is not allowed by design.

Error message when you try to run a report in System Center Operations 
Manager 2007: "Message: Loading reporting hierarchy failed.” “Access is 
denied. (Exception from HRESULT: 0x80070005 (E_ACCESSDENIED))”

If you want to know more about this, read this blog:
http://blogs.technet.com/operationsmgr/archive/2009/01/27/opsmgr-2007-error-running-report-message-loading-reporting-hierarchy-failed-access-is-denied.aspx

But, there's caveat. If you use the same login name (a.k.a. SAM-Acount-Name) for the SDK and Config Service Account in both domains, the Operations Console (running in domain A but pointing to Management Group in domain B) will lock the SDK and Config Service Account in domain A.
What!!! Yep, eventhough we are working with on our Management Group in domain B, the SDK and Config Service Account in domain A is locked because the login name for this account is the same in both domains. After investigating the audit trail logs the server who locked the SDK and Config Service Account was the RMS server of the Management Group in domain B.
Remember that this only occurs if there´s a one-way trust.

Sent to Microsoft - Official bug
After investigating this problem en finding the cause, I created a case at Microsoft Support. After a few weeks they were able to reproduce this problem. This is now an offical bug. Unfortunately Microsoft can not say when this bug is going to be documented or even will get fixed.

Workaround
Rename the SDK and Config Service Account 'samAccountName' in Domain B. Or use the work around as mentioned in Prakish' post: http://blogs.technet.com/operationsmgr/archive/2009/01/27/opsmgr-2007-error-running-report-message-loading-reporting-hierarchy-failed-access-is-denied.aspx

SCOM: Sealing 'Operations Console-build' Management Packs

2009-11-14T00:14:00.040+01:00

This blog is about the problems you can run into when you seal a management pack which is build from the Operations Console and deploy it in another Management Group.

When you create a management pack from the Operation Console a few standard items are added by default like some references to standard libraries.
If you want to delegate a logical group of computers combined with some views to a group of administrators for monitoring, usually you do the following:

Create new Management Pack
Create a group

For example: My Computer Group

Create dynamic inclusion rules (like "OU matches wildcard "*Web Servers*"

Create a view

State view (for example)

Data related to "Windows Computer"
Data contained within group "My Computer Group"

So now we have a simple management pack with a group and a state view which show the Windows Computer state for 'My Computer Group'.
This will work great in the Management Group the MP is created in, but when you seal this MP and want to use it in another SCOM Management Group, a problem arrises. e.g. Creating a MP in a test SCOM Management Group, sealing the MP and deploying the MP in a production management group.

The problem: Although the group is likely to be populated with objects that comply with the group dynamic inclusion rules, none of the items show up in the State View.

The cause: The State View is targeted at the 'My Computer Group' but under the hood the group's GUID is used instead of it's ID. The GUID is the 'unique?' BaseManagementID within the Management Group. This will only get noticed when you use this MP in another Management Group as a sealed MP. As a unsealed MP the group, frankly, uses the 'same!' GUID and the view will work.

The solution: Edit the MP XML file manually and replace the GUID within the view's target to the ID of 'My Computer Group'. You can find the ID in the 'Language Pack'-section of the MP. Note that you'll find two targets. This concerns the subelement Target and not the attribute from the view element itself.

Example:

Orginal XML

<view id="myview1234" target="systemlib!windows computer">
  <columns>
  ....
  <columns>
  <target>EA99500D-8D52-FC52-B5A5-10DCD1E9D2BD</target>
</view>

New XML

<view id="myview1234" target="systemlib!windows computer">
  <columns>
  ....
  <columns>
  <target>$MPElement[Name="My.Computer.Group.ID"]$</target>
</view>

You might say, "why is this a problem, i'll just won't seal my MP's". Well you could do that, but most people think you should develop a MP in one environment and deliver the MP as a sealed box to the other environment. This way it's not possible for a MP to have a higher version number in e.g. a production environment than the same MP in your test/development environment.

And remember even if you dó choose to work without sealing, and you and your collegues agree nót to add any changes to a MP in your production environment, one day it will happen. And then you release your amazing new version of the MP, following the standard release process, and all changes of your collegue could get lost.

SCOM R2: New OpsMgr R2 MP released (6.1.7553.0)

2009-10-10T14:59:00.000+02:00

Just a few days ago Microsoft released an updated version of the OpsMgr 2007 R2 Management Pack.
If you have SCOM R2 you can benefit from this release right-away. This MP package (Version 6.1.7553.0) is specific to OpsMgr 2007 R2 and will not import on product versions prior to that. You can find it in the MP Catalog.

A similar update for OpsMgr 2007 SP1 will be released in the coming weeks. It will be announced on http://blogs.technet.com/momteam

Some highlights:

Better threshold adjustments which results in less false positives
Updated knowledge base and display strings
Disabled some non-actionable rules & monitors
Extra performance counters

Read the updated MP guide for more information.

These updates are based on Community, Customer, and internal feedback.
See Kevin Holman's blog about SCOM agents continuously rebooting after reaching a memory threshold. This is one of the things fixed in this newly released Management Pack.

SCCM: SCCM R3 announced

2009-09-22T22:57:00.000+02:00

Recently Microsoft announced a new release of System Center Configuration Manager. In this release, R3, the focus is on power management.
Nowadays more and more companies look for solutions to take on power usage of there IT infrastructure. In SCCM R3 there are going to be several functionalities that can help your business to lower power consumption.

Power Management

The goal of this capability is to enable Configuration Manager to further reduce the operational costs of IT by providing basic power management features native to the product. Our approach is based on 3 primary areas:

A. Help the organization plan a power strategy by monitoring current power state and consumption and reporting on machine utilization trends, current power settings and current energy consumption

B. Enable the Administrator to easily create, deploy and enforce specific power settings using the existing ConfigMgr infrastructure.
−Ability to set peak and non-peak schedules
−Ability to remediate settings if changed
−Ability to opt out machines from power policy

C. Provide the business meaningful report formats that are relevant to Power Management

Microsoft is still looking for TAP nominees. If you want to participate, fill in their survey before October 1st, 2009. SCCM R3 TAP Survey

For more information, see the Microsoft System Center website.

SCOM: Monitor vs. Rule

2009-08-24T19:51:00.005+02:00

When you want to monitor specific occurences there are two options in SCOM. You can use a monitor or a rule.

In this blog post i'll will explain why you should use a monitor for a specific occasion and not a rule and vice versa.

Rules

Rules Collect data from sources like EventLog, Text or Log Files and Perfmon. That data is stored
In the Operations Manager database. If you have installed a Data Warehouse database this data is replicated to this database for Reporting purposes.
Rules always target classes. You should not target rules to groups. See the Authoring Guide from Microsoft for best practices. Targeting groups results in targeting the Root Management Server, as this is the host of all groups.

Monitors

Monitors are used to determine the health state of an application component. A monitor is programmed with the intelligence to determine whether a component is healthy.

Monitors exist in two flavours, Two-state and Tree-State. Thus, a monitor can either be in one of two states (green or red) or in one of three states (green, yellow, red).
The state changes when the monitor responses to the monitoring information the monitor is using.

Monitors come in three different types: Unit Monitor, Aggregate Rollup Monitor and Dependency Rollup Monitor

Unit Monitor
A unit monitor is the fundamental monitoring component. Used to monitor specific counters, events, scripts and services. This monitor can generate an alert.

Aggregate Rollup Monitor
An aggregate rollup monitor reflects the state of unit, dependency rollup, or other aggregate rollup monitors. Use an aggregate rollup monitor to group multiple
Monitors intro one monitor. This monitor then is used to set the health state and optionally generate an alert. Each object has at least 4 of this rollup monitors: Availability, Configuration, Performance and Security.

Dependency Rollup Monitor
A depency rollup monitor rolls up health states from objects linked by either a hosting or a containment relationship. Use this monitor type to make the health state of a particular object dependent on the health state of components that are either hosted or contained. For example, the SQL Server 2005 object has an dependency rollup monitor that is related to a health monitor of a SQL Server 2005 Database object. When an application database is offline is doesn't mean the health state of SQL 2005 is critical, but when the master database has problems this has a direct impact on the SQL Server 2005 object.

Differences

Monitor and rules both collect monitoring data, but the collected data is used very differently. Rules collect data that goes into the Operations Manager database and Operations Manager Data Warehouse.
Monitors evaluate data from various sources and only store the state changes and alerts in the Operations Manager database.
Monitor-collected data is never stored in the Operations Manager database and Data Warehouse and thus is not usable for Reporting.

Example
You want to monitor disk usage on a file server and generate an alert when used disk space exceeds 85%. You also want to have the disk usage information available for reporting.
How to implement this?

Create a collection rule to collect disk usage information for reporting
Collection rules do not generate alerts, so you'll need to create a unit monitor for monitoring the disk usage health. This monitor will generate a health state change and an alert after the disk usage exceeds the threshold of 85%.

Source: SCOM Authoring Guide

SCOM: Upgrading to SCOM 2007 R2

2009-08-19T21:34:00.007+02:00

Last week i was busy upgrading multiple SCOM 2007 SP1 environments to R2.

The upgrade process to R2 is actually very straigt forward. That is, if your environment is also straight forward.

A collegue of my was presented with an upgrade error when he tried to upgrade the Reporting Server and the Data Warehouse Database in the background.

Eventually it was caused because the user account the SCOM Reporting Server upgrade was started with, was configured as a user on the database without SQL roles.

This takes some time to figure out, especially when you have to work with different teams. A team for SCOM, a team for SQL and for example a team for IIS.

That's why here is a R2 upgrade info list for your convenience:

But most important:

SCOM 2007 Upgrade Guide (Notice the Improving Upgrade Performance article)
SCOM 2007 Deployment Scenarios

And remember, always create a backup of your database before installing a upgrade.

SCOM: Implementing ADMP replication monitoring in complex environments

2009-08-09T23:10:00.010+02:00

Installing a management pack in your SCOM environment is a piece of cake. So is implementing ADMP. Things change when your AD forest structure is a bit more challenging than a single domain forest. For example, monitoring 4 different forests without forest trusts.

A feature of ADMP is replication monitoring. The account which will be used for monitoring must have rights on domain controllers in the domains. From a 'lease privilege' point of view, you should only give that account rights to only the objects that are really neccesary for operational monitoring. The ADMP guide luckely describes this in detail.

Doing these steps for multiple domains is kind of a hassle. That's why i wanted to create a ADMP deployment script to help system administrators implement ADMP faster in more complex AD environments.

--- weeks later.......

I must confess that writing a one-for-all implementation script for ADMP is not easy. Eventually after multiple implementations i made my choice. I decided to cancel my journey for the ultimum. Even if i did continue to make such a script, who would use it. Who do you trust enough to automate a Default Domain Controller Policy deployment, in which you delegate some rights for the Replication Monitor account.

My advice:

- Read ADMP implementation guide

- Backup your GPO's

- Know about SDDL's and settings security on EventLog items.

Last but not least

There are some tools to help you deploy the ADMP management pack faster. I gathered all tools and hot links:

ADMP Checlist: http://www.systemcentercentral.com/Downloads/DownloadsDetails/tabid/144/IndexID/7808/Default.aspx

SDDL strings for EventLog security:

Microsoft's article: http://support.microsoft.com/kb/323076

SID tools:

I made some VBscripts for this. I will publish them as soon as possible.

Preparing your SCOM and SCCM exam

2009-04-22T15:12:00.021+02:00

4 Weeks ago i sat for the offical Microsoft exams SCOM and SCCM. If you want to know more about SCOM & SCCM including passing the exams you want to read this post.

You'll probably know that there are two ways of passing Microsoft exams.

Get the exam questions and answers in your head, pass, know nothing and get reveiled occasionally when a client askes an in-depth question.

or, better,

Get a book, do the Virtual Labs from Microsoft, setup your own test environment, practice lab questions and actually know what your doing. Practice some exams and then pass the actual exam.

Important topic areas

SCOM

Know how to configure and maintain SCOM
Configuring Management packs including MOM 2005 MP's
New features in R2

SCCM

Know about the new features compared to SMS 2003, because a lot has been added to Systems Management from MS!
Deployments in different test environments (desktops, offsite notebooks, OSD-deployments) with service windows and baselines.

Materials

Here's a list of the best materials for studying for SCOM exam 70-400 and SCCM exam 70-401.

SCOM

Book: System Center Operations Manager 2007 Unleashed link

I really like the unleashed books. For MOM 2005 I also used the unleased book. Very complete and explained in depth.

Virtual Labs: http://technet.microsoft.com/en-us/virtuallabs/bb499680.aspx

Microsoft info (including practice tests): http://www.microsoft.com/learning/en/us/exams/70-400.mspx

SCCM

Book: System Center Configuration Manager 2007 Unleashed link

Yes, another Unleashed! For SMS 2003 I read a Microsoft Press book. It was OK, but this book for SCCM gives just more in-depth information.

(If you're familiar with other good SCCM books of which you think should be listed here, let me know)

Virtual Labs: http://technet.microsoft.com/en-us/virtuallabs/bb499680.aspx

Or http://technet.microsoft.com/en-us/virtuallabs/bb539977.aspx

Microsoft info (including practice tests): http://www.microsoft.com/learning/en/us/exams/70-401.mspx

Studying

Do theory and practices. Write down things you don't understand. Search the internet for blogs like this one for possible answers. But this is just basically what you always should do when studying techninal areas.

.... oh.... I passed both exams. :)

SCOM: Reporting queries for performance counters

2009-03-27T11:28:00.009+01:00

When you want to start making reports in your SCOM environment, you'd first have to learn how the data is stored in the SCOM DataWarehouse and which tables, views or stored procedure you can use.

I use SQL Server Business Intelligence Development Studio. You can use Report Builder, but it is less featured.
After you create a Shared DataSource and a new report, you can create your query for your Data Set.

Below is a query to get performance data from the aggregated view 'PerfDaily' for a computer from counter name 'Working Set'.

-- BEGIN QUERY
SELECT Perf.vPerfDaily.DateTime, Perf.vPerfDaily.AverageValue, vManagedEntity.Path, vPerformanceRule.ObjectName, vPerformanceRule.CounterName,
vManagedEntity.FullName, vPerformanceRuleInstance.InstanceName
FROM vPerformanceRuleInstance INNER JOIN
Perf.vPerfDaily ON vPerformanceRuleInstance.PerformanceRuleInstanceRowId = Perf.vPerfDaily.PerformanceRuleInstanceRowId INNER JOIN
vManagedEntity ON Perf.vPerfDaily.ManagedEntityRowId = vManagedEntity.ManagedEntityRowId INNER JOIN
vPerformanceRule ON vPerformanceRuleInstance.RuleRowId = vPerformanceRule.RuleRowId
WHERE (vPerformanceRule.CounterName = 'Working Set') AND (vManagedEntity.Path = @ComputerName)
ORDER BY Perf.vPerfDaily.DateTime

--END QUERY

@ComputerName is a parameter which can be entered by a user. Another option is to fill this value with server names based on another query. Like "give me all servers from a specific group".

Such a query could be:

-- BEGIN QUERY
SELECT dbo.vManagedEntity.Name
FROM dbo.vManagedEntity INNER JOIN
dbo.vRelationship On dbo.vManagedEntity.ManagedEntityRowId = dbo.vRelationship.TargetManagedEntityRowId INNER JOIN
dbo.vManagedEntity As CompGroup On dbo.vRelationship.SourcemanagedEntityRowId = CompGroup.ManagedEntityRowId
WHERE CompGroup.DisplayName = 'MyServers'
-- END QUERY

SCOM: Maintenance Mode with PowerShell

2009-03-25T12:10:00.005+01:00

There are situations where you want to set maintenance windows on certain machines within your SCOM infrastructure. This can be accomplised with the Operations Console or Command Shell.
The great advantage for SCOM (in comparison with MOM) is that maintance mode can be set on all monitored classes. So it's possible to set maintance mode for a webapplication, without setting your complete IIS webserver to maintenance mode.

This post is about the Command Shell. When you install the SCOM Command Shell (Powershell is a prequirement), you'll get access to numerous SCOM cmdlets for different managing tasks.

To get all cmdlets concerning 'MaintenanceWindow', type:
>get-operationsmanagercommand where-object { $_.Name -match "MaintenanceWindow"}

Below are some examples...

Create a new maintenance window for a computer

# Ask user for input
$strComputerName = Read-Host "Enter computer name"

$objComputer = Get-Agent | Where-Object {$_.Name -match $strComputerName}
$objComputer.HostComputer | New-MaintenanceWindow -StartTime:"3/25/2009 22:00" -EndTime:"3/25/2009 23:30" -Comment: "Server maintenance"

Create a new maintenance window for a group

# Ask user for input
$strGroupName = Read-Host "Enter group name"

$objGroup = get-monitoringobject | Where-Object {$_.DisplayName -eq $strGroupName}
$objGroupAgents = $objGroup.getrelatedmonitoringobjects()

# Looping throug group object
foreach ($objAgent in $objGroupAgents)
{
New-MaintenanceWindow -startTime::"3/25/2009 22:00" -EndTime:"3/25/2009 23:30"
-monitoringObject:$objComputer -comment:"Server group maintenance"
}

Create a new maintenance window on a Web Application
Below is a script that puts a Web Application in maintenance mode. Using the extra get-monitoringclass cmdlet resulted in a faster script, then only using the cmdlet get-monitoringobject with a where clause.

# Ask user for input
$strWebApp = Read-Host "Enter the Web Application name"

# Get class object
$objMonClass = get-monitoringclass where-object { $_.Name -eq "Microsoft.SystemCenter.WebApplication.Perspective"}

# Connect object and add Maintenance Window
get-monitoringobject -MonitoringClass $objMonClass | Where-Object { $_.DisplayName -match $strWebApp } | New-MaintenanceWindow -StartTime:"3/25/2009 22:00" -EndTime:"3/25/2009 23:30" -Comment: "Server maintenance"

.... more examples to come.

See http://www.systemcenterforum.org/downloads/scom-maintenance-mode-script-20/ for ready made scripts to add computer, groups to maintance mode including the related health service.

Start of a System Center blog

2009-03-25T11:28:00.000+01:00

Today i started my blog about System Center. A product suite of Microsoft for managing and maintaining your complete client/server IT-Infrastructure.

Because of my experience with various products from System Center, i wanted to share my knowledge with others.

Have a greate time!