New Job

I would like to thank you all for great emails about this blog.

You have probably noticed my slackness here, however this is only due to my acceptance of a new job as an I.T. Architect at LogicaCMG here is Sydney, Australia.

This has unfortunatly pulled me away from the frontline of working with SCOM and other applications. I am now, bound to a keyboard typing proposals and designing new systems for potential customers in many inductries like Energy and Utilities, Financial and Governement.

 I do still get call from my colleagues about SCOM and as I help them and come across any issues I will be sure to post them here.

Do feel free to comtinue to email and post comments and I will get back to them as soon as I can.

Regards,

Jonathan Hambrook

System Center Operations Manager Tools

Below are a list of tools that all SCOM Admins should have:

3rd Party Tools

Override Explorer – List all overrides in SCOM
Proxy Settings – Shows all servers and their ‘Act as Proxy Agent’ setting.
MP2XMLDumper – Shows what a Management Pack exported to XML looks like.
Proxycfg – Clive Eastwood (MSFT) has writen a neat command line utility to configure/view agent proxying.
AgentMM – Clive Eastwood (MSFT) has writen this command line tool to place OpsMgr agents into Maintenance mode

Microsoft Tools 

Sample Vista Gadget – A Vista Gadget that enables you to view the active alerts and health states for a specified set of objects from a computer running Windows Vista.
Operations Manager Inventory – A command-line utility that captures the configuration of your Operations Manager 2007 Management Servers and stores it in a .cab file that can be sent to Microsoft support to assist in problem analysis.
Operations Manager Cleanup Tool – A command-line utility that enables you to remove any or all of the components of Operations Manager from a local computer in cases where the normal method of uninstallation has failed.
AEM Validation – A command line utility that will allow you to perform end-to-end validation of Agent-less Exception Monitoring to verify that AEM is properly configured and operational.
AEM Management Pack – A Management Pack that enables you to identify generic errors sent by Windows Error Reporting (WER) clients to Management Servers that are AEM-enabled. Without this mapping function these errors appear in Operations Manager as “unknown application” and “unknown version”.
Active Directory Integration Sample Script – A sample script that enables you to extract a list of computer names from your custom SQL Server database and add them to an Active Directory security group. The security group can then be referenced in the Agent Assignment and Failover Wizard to automate agent assignments to Management Servers.
Effective Configuration Viewer – A tool that displays the set of rules and monitors that are running on a computer, distributed application, or any other managed entity after any configured overrides have been applied.
Action Account Tool – A PowerShell script that allows you to set the action account on groups of computers.

Monitoring VMWare ESX using a SCOM

Monitoring VMWare ESX with SCOM isn’t a hard thing, however getting correct and relivent information in a clean and easy way can be. This guide I have compiled with VMWare should provide the mechanics of setting up monitoring between VMWare ESX and SCOM.

— UPDATE : If you have trouble with the link its due my limit being reached. I will add a secondary site ASAP. Wasn’t prepared for the responce —
Download Here:
Mirror 1
Mirror 2

MS SCOM Management Pack Updates

Microsoft have release 4 new Management Packs. All of them require the OpsMgr 2007 MOM 2005 Backward Compatibility MP Update) 6.0.5000.12 (or higher):

1. Internet Security and Acceleration (ISA) Server 2004, and 2006

2. Windows Distributed Transaction Coordinator (MSDTC) 2000, 2003

3. Windows Internet Naming Service (WINS) 2000, 2003

4. Windows Routing and Remote Access Service (RRAS) 2003

Options for adding more detials to SNMP Alerts

As many of you who use SNMP may be finding that all the Alerts come in with the IP Address. In a large environment this can be an issue and as this is the mechanism in which they are added to the SCOM Database there is no way around this directly. However…

You have 2 options to make this a little easier.

1st you can enter the DeviceName in the Alert Description:

$Target/Property[Type=”MicrosoftSystemCenterNetworkDeviceLibrary6050000!Microsoft.SystemCenter.NetworkDevice”]/Name$

2nd you can use the custom fields if you have the option. Alert Generated Rule will allow for Custom Field editing.

Again add: $Target/Property[Type=”MicrosoftSystemCenterNetworkDeviceLibrary6050000!Microsoft.SystemCenter.NetworkDevice”]/Name$ to the particular Custom Field.

Of course this is provided you have setup the SNMP setting on the device with the correct name you refer to that device.

This is what you will see in your Alerts: (I have blanked out the detail due to confidentiality)

Alert View:

Alert Description:

 Custom Field:

Hope this makes your life a little easier 🙂

Cannot save report subscription in SCOM

You get the following error after you fill in the Reports Scheduler Wizard.

 

Date: 17/07/2007 10:03:33
Application: System Center Operations Manager 2007
Application Version: 6.0.5000.0
Severity: Error
Message: Cannot save report subscription.
System.Web.Services.Protocols.SoapException: The value provided for the report parameter ‘StartDate_BaseValue’ is not valid for its type. —> The value provided for the report parameter ‘StartDate_BaseValue’ is not valid for its type. —> The value provided for the report parameter ‘StartDate_BaseValue’ is not valid for its type.
  at System.Web.Services.Protocols.SoapHttpClientProtocol.ReadResponse(SoapClientMessage message, WebResponse response, Stream responseStream, Boolean asyncCall)
  at System.Web.Services.Protocols.SoapHttpClientProtocol.Invoke(String methodName, Object[] parameters)
  at Microsoft.EnterpriseManagement.Mom.Internal.UI.Reporting.ReportingService.ReportingService2005.CreateSubscription(String Report, ExtensionSettings ExtensionSettings, String Description, String EventType, String MatchData, ParameterValue[] Parameters)
  at Microsoft.EnterpriseManagement.Mom.Internal.UI.Reporting.ManagementGroupReporting.SetSubscription(ManagementGroupReport report, ManagementGroupReportSubscription subscription, String description, String deliveryMethod, IDictionary`2 deliveryOptions, ScheduleDefinition schedule, IDictionary`2 reportParameters)
  at Microsoft.EnterpriseManagement.Mom.Internal.UI.Reporting.ManagementGroupReporting.CreateSubscription(ManagementGroupReport report, String description, String deliveryMethod, IDictionary`2 deliveryOptions, ScheduleDefinition schedule, IDictionary`2 reportParameters)
  at Microsoft.EnterpriseManagement.Mom.Internal.UI.Reporting.Wizards.Schedule.ReportSubscriptionProgressPage.BackgroundWorkerDoWork(Object sender, DoWorkEventArgs e)

FIX:

There is a hotfix release and available from Microsoft, request MS for KB 938507. Its not release for public viewing so you will need to call MS up.

This HF needs to be installed on any machine with the Operations Manager Console on it.

MS SCOM Management Pack updates

Microsoft have release 2 updated Management Packs which everyone should consider updating to as they fix a few known issues:

Operations Manager 2007 Data Warehouse Library
Overview

The Data Warehouse Library Management Pack contains the definitions and workflows required to support the forwarding of data to the Operations Manager Data Warehouse as well as the subsequent maintenance of the data. It also contains rules and monitors to track the ongoing health of the Data Warehouse data flows and processes. This Management Pack ships with the Operations Manager product and is periodically updated with fixes and new functionality.
Feature Bullet Summary:
• Manages the flow of data to the Data Warehouse
• Manages credentials used for the operation and management of the Data Warehouse
• Supports the deployment of reports to the Data Warehouse
• Manages the aggregation of performance data in the Data Warehouse
• Synchronizes alert data in the Data Warehouse with recent alert changes made in the operational database
• Manages the health of Data Warehouse workflows

Operations Manager 2007 Management Pack Update
Overview

The Microsoft System Center Operations Manager Management Pack update is an update to the previously released System Center Operations Manager 2007 Management Pack with System Center Operations Manager 2007 RTM.
The updated file list includes
• Microsoft.SystemCenter.2007.mp (6.0.5000.28)
• Microsoft.SystemCenter.Internal.mp (6.0.5000.28)
• Microsoft.SystemCenter.Library.mp (6.0.5000.28)
• Microsoft.SystemCenter.OperationsManager.200.mp (6.0.5000.28)
• Microsoft.SystemCenter.ServiceDesigner.Library.mp (6.0.5000.28)
• Microsoft.SystemCenter.WebApplication.Library.mp (6.0.5000.28)
• System.Health.Library.mp (6.0.5000.28)

Update to address fixes and enhancements:
• OnDemandDetection for threshold monitors.
• Ability to override Priority / Severity settings.
• Alert rules/monitors added for Batch response.
• Added Knowledge for rules and monitors.
• Fixed Distributed Application health rollup state.
• Top customer impacting bugs found post-RTM

Monitoring VMWare ESX Hardware

UPDATE: To answer the questions of many of you who are looking forward to the release of this document here are some high level details.

The document I am writing will cover the usage of SysLogs, SNMP for the monitoring of ESX and the Hardware layer. It will be step-by-step with reasoning behind why steps have been performed in this way. Its not a definitive way but its the easiest way to get imediate visablity of your ESX and ESX Hardware. I will not be releaseing the document until its launched at VM World in September but will be available for download on the 13th September 07.

I thank you all for your interest in this and I hope it will help when its released.

————————————————————————————————————

Today I had a very interesting meeting with Mike Bookey from VMWARE (Australia) about monitoring the hardware layer via MOM or SCOM. I am working on these very tidy techniques that he has proposed and will be launching at VM World 2007!I suggest if you are using VM then you should get to VM World 2007 from September 11 – 13 in San Francisco, California USA. Also keep your eyes posted here as I will be providing links to the VM Doco’s once released.To register visit: http://www.vmware.com/vmworld/

New Microsoft Management Packs released

Microsoft have release a few new Management Packs for their products. All of them require OpsMgr 2007 MOM 2005 Backward Compatibility MP Update 6.0.5000.12 (or higher).

Forefront Server Security for Exchange 10.0

Forefront Server Security for SharePoint 10

Identity Integration Server 2003

Microsoft Server Network Load Balancing

Office Project Server 2007

Search SCOM Database for MOMUIGeneratedRule entries

If you are getting MOMUIGeneratedRule descriptions in your reports here is an SQL Query that will list all of them and their descriptions.

select distinct
               r.RuleID,
               r.RuleName,
               lt.ElementName,
               lt.LTValue,
               r.ManagementPackId,
               mp.MPFriendlyName
from rules r
join LocalizedText lt on lt.LTStringID = r.RuleID
join ManagementPack mp on mp.ManagementPackID = r.ManagementPackID
where rulename like ‘MOMUIGeneratedRule%’

Back at work…

So I have been putting in some long hours and even a lot of hard work on my vineyard and the other day passed out at work and ended up in Hospital but I am back. I will however be slowing down a little.

On the other hand I have my new Brown Zune! This is a great day for me as i can finaly pass on my 60Gb iPod Photo which has disapointed me for some time.

For all of you that have posted comment sorry for delay but you should see or have recieved a replay by now. I am always happy to reply to any comments posted.

Want to ‘Design a new report’ in SCOM 2007?

Most have you will have clicked on the ‘Design a new report’ button and found that there were ‘No Data Sources available’.

Here is how you can setup this feature for SCOM 2007.

CREATE A REPORT MODEL

1. Open SQL Server Business Intelligence Development Studio
2. Click File -> New -> Project
3. Select Report Model Project
4. Fill in a Name and Location
5. Click OK

CREATE A DATA SOURCE

1. In Solution Explorer, right-click Data Sources, Click Add New Data Source

2. Click Next on the Welcome Screen
3. Click New
4. Fill in the connection to the SQL Server and Instance (ie: SERVER\INSTANCE) to your SCOM Database
5. Select the Database you want to interact with. (ie: OperationsManagerDW)

6. Click OK
7. Click Finish

You will now see the Data Source under Solution Explorer

CREATE A DATA SOURCE VIEW

1. In Solution Explorer, right-click Data Sources, Click Add New Data Source View
2. Click Next
3. Select the data source from the Relational data souces: panel
4. Click Next
5. This is the part where you need to think, You will need to select the tables and views you want to include in the model. If you not sure and just want to play around you can however I would not suggest it… but you can sellect all the tables, however leave the views out as they can cause issues.
6. Click Next
7. Click Finish

You will now see the Data Source View under Solution Explorer

CREATE A REPORT MODEL

1. In Solution Explorer, right-click Data Sources, Click Add New Report
2. Click Next
3. Select the Data Source and Click Next
4. Select the Model Rules and Language (If unsure, keep the defaults) Click Next
5. Select Update model statistics before generating and Click Next
6. Type in a name Name and Click Run

Note: This may take some time depending on the number of Tables and Views selected when creating the Data Source View.

7. Click Finish
8. Under Solution Explorer Right-Click the new Report Model and selct Deploy

9. Exit SQL Server Business Intelligence Development Studio and Save.

RUN DESIGN A NEW REPORT

1. Open System Center Operations Manager Console
2. In Report Click Design new report
3. Report Builder will launch and you will see a Data Source
4. Highlight it and Select a Report Layout Click OK

HAVE FUN!!!

Issue with changing ‘Default Action Account’ for a Server

ISSUE

If you are looking at changing the ‘Default Action Account’ Rus-As Accounts for a server, even if you use an account with the right access you may find that the server greys out.

My findings have found this is more common on Domain Controllers or Servers in OU with blocked Group Policy (If you are using Group Policies to determine access). Meaning that the account setup when you installed the agent doesnt have the access to make changes to the Health Service setup.

RESOLUTION

Use HSLockdown to add the Action Account to the Health Service. You can do this using the command:

c:\”Program Files\System Center Operations Manager 2007″\
hslockdown “Management Group” /A “DOMAIN\USER NAME”

Note: I put in the exclimation marks (“) just to point out if you use spaces they will be required to run any commands.

OpsMgr 2007 MOM 2005 Backward Compatibility Updated

The MOM 2005 Backwards Compatibility MP has been updated to version 6.0.5000.12 and System Center Internal Library MP updated to verison 6.0.5000.16.

You can download it from: http://www.microsoft.com/downloads/details.aspx?FamilyId=655CDD06-861E-4342-99B2-8A81E09F6546&displaylang=en

Error: Replication Monitoring – Access Denied

So you have followed the Active Directory Management Pack Guide for Operations Manager 2007 to the letter and you get Access Denied errors. You also get the same error in Event Veiwer as seen in the Screen Shot:

Here are some things you will also need to check above an beyound the supplied documentation.

Container Permissions
1. On page 9 of the AD MP Guide it mentions that you need to create the MomLatencyMonitors container. I have found that in a heavely locked down environment you will need to add Read/Write permission to this container. (DC=Domain, DC=com). The permission need to be of the account specified under the ‘Configure an Account for Replication Monitoring’ of Page 9 of the AD MP Guide.

2. Also you may like to check the ForestDNSZones as well. This can be done via ADSI Edit by connecting to DC=ForestDNSZones, DC=Domain, DC=com. You will see MOMLatencyMonitors, right click and select security.

Agent Permissions
If you deployed all your agents using Local as per the following screenshot:

You will also find you will have some issues as the Health Service will start with Local System, which is fine but the Agent Action Account will also be specified as account to do all the processing by that agent. This is fine for all other servers if you require it but you will need do the following on the Domain Controllers

1. Add/Remove Programs
2. Select the System Center Operations Manager Agent and click Change
3. Select Modify
4. Select Modify Management Group
5. Click Next on the next 2 screens until you get to the Ready to Install screen
6. Click Back
7. Specify a Domain Account. (See the deployment Guide page 31 for the permission of the Agent Action Account)
8. Click Next then Install

By doing the above steps, The Service will still start with the Local System Account but will do all its proccessing using the Domain Agent Action Account. You should now be able to restart the Health Service and your permissions issues should go away.

I do however recommend that all Agents be deployed using a domain Agent Action Account.

Issue with creating new Performance Rules and Reporting on them.

ISSUE 

If you recall I blogged on this issue earlier and said I would investigate more. As a recap you can check out the screenshots to see the issue:
 

Basicly, you will see the something like MomUIGeneratedRule with a series of characters after it.

WORKAROUND

This happens when you create a custom performance counter in a Management Pack that is not the “Default Management Pack“.

I have heard that MS are working on this and have been able to replicate the issue, we should see a fix soon so check back as I will be moniroting this one closely.

Monitoring SNMP v1 devices with SCOM

I have seen this posted on other blogs, and have also been waiting for this for some time. Microsoft have got a Hotfix out for SCOM to monitor devices using SNMP v1. The artical/hotfix isnt accessable on Microsoft Public site so you will ring up there support and request KB 989364 with the downloadable about 60Mb.

I am starting my testing on some old NT4 legacy servers as well as some ancient network devices that always seem to be lieing around in a big data centre.

NOTE: I have been told that the KB Article will be unavailable until some more testing have been performed. If you are looking for it, unfortunaly its not quite ready yet… but soon 🙂

Interesting Issue with Reports…

Well today I found an interesting issue with the intedgrated Reports. You can rplicate this by doing the following:
1. Open System Center Operation Manager Console
2. Goto [-] Microsoft Windows Server [+] Windows Server State
3. Select a Server
4. In the Actions panel select one of the Performance History Reports
5. In the Report Details choose a date spanning months. (ie: 20th June to 10th July)

Now at first glance I thought I was missing data but then quickly realised what I was seeing was the correct data, just not in the expected display. Have a look at what I saw:

If you look closely you will see I have asked for a report to start on the 20th June and to run untill the 4th of July.

What I get however is the first 4 days of July before the last 10 days of June… I have posted this to MS and am awaiting a responce, however I would guess there is an issue with date formating issue, as in Australia we use DD/MM/YYYY.

UPDATE: MS have been able to replicate this and are working on some re-engineering of the Reports, could be hotfix or part of SP1.

Operations Manager 2007 Backup and Recovery Guide Released

The Operations Manager 2007 Backup and Recovery Guide is now available for download from Microsoft. To get your copy go to http://technet.microsoft.com/en-us/opsmgr/bb498235.aspx you will find all Microsoft documentation there.

Error: Access to the registry key ‘Global’ is denied.

I noticed this Error in a few blogs and thought I would have a crack at it and I was able to recreate it in my lab.

Source Error:

An unhandled exception was generated during the execution of the current web request. Information regarding the origin and location of the exception can be identified using the exception stack trace below.

Stack Trace:

[UnauthorizedAccessException: Access to the registry key 'Global' is denied.] Microsoft.Win32.RegistryKey.Win32Error(Int32 errorCode, String str) +2116595 Microsoft.Win32.RegistryKey.InternalGetValue(String name, Object defaultValue, Boolean doNotExpand, Boolean checkSecurity) +2779509 Microsoft.Win32.RegistryKey.GetValue(String name) +29 System.Diagnostics.PerformanceMonitor.GetData(String item) +96 System.Diagnostics.PerformanceCounterLib.GetPerformanceData(String item) +147 System.Diagnostics.PerformanceCounterLib.get_CategoryTable() +82 System.Diagnostics.PerformanceCounterLib.CategoryExists(String machine, String category) +65 System.Diagnostics.PerformanceCounterCategory.Exists(String categoryName, String machineName) +125 System.Diagnostics.PerformanceCounterCategory.Exists(String categoryName) +9 Microsoft.EnterpriseManagement.OperationsManager.DataAbstractionLayer.Counters.BuildPerformanceCounter(DalCounter counterName, String instanceName) +302 Microsoft.EnterpriseManagement.OperationsManager.DataAbstractionLayer.Counters..ctor() +197 Microsoft.EnterpriseManagement.OperationsManager.DataAbstractionLayer.DataAbstractionFactory..ctor() +24 Microsoft.EnterpriseManagement.OperationsManager.DataAbstractionLayer.DataAbstractionFactory..cctor() +20[TypeInitializationException: The type initializer for 'Microsoft.EnterpriseManagement.OperationsManager.DataAbstractionLayer.DataAbstractionFactory' threw an exception.] Microsoft.EnterpriseManagement.OperationsManager.DataAbstractionLayer.DataAbstractionFactory.GetInstance(IDataAbstractionBuilder builder) +0 Microsoft.EnterpriseManagement.OperationsManager.WebConsole.WebDalWrapper.get_OpsSdkWrapper() +37 BaseWebConsolePage.get_OpsSdkWrapper() +210 login.Page_Unload(Object sender, EventArgs e) +22

You will also get this error in the Event log on the Web Console server (Click to view full size):

This is what I did to create the Issue and further down is the workaround which is a common fix for this issue in some other Blogs and also with other errors Microsoft have in their Knowledge Base that arn’t specific to SCOM.

To set the scene this is what I set out to achive. I wanted to create a New Monitoring Diagram View to display a couple of intranet sites that I want to monitor from all our national offices and unlike the Web Application State view I only wanted to see the Websites status ie: Health or Critical etc.

I order to do this I would have to do the following, create new Groups, new Monitor, new Management Pack, new View and to then restrict access to only show the one new View in the Web Console for a few people.

1. Created the Management Pack

2. Created the Web Application monitor for the sites

3. Created a Group and then added 2 other Groups as Child Groups. (One for each Application and added the appropriate Web Application to each group)

4. Created the new Monitor to report the status of the 2 Child Groups

5. Created the Custom Diagram View showing the Primary Group and the 2 Child Group.

6. Under Adminitriation I created a new Read-Only Operator, New user Role.

7. Added the Domain Users (Same Domain as SCOM is in) that would have access to this group and also specified that all they could see was the 3 new groups I had created and the new view as well as the Web Applications State view. (Now this is where I think I need to look further to see whats happening.)

8. I then accessed the Web Console and got the above error.

9. Applied the resolution: Added all the users from the new ‘User Role’ to the local Performance Monitor Users group on the server that runs the Web Console. (I however didnt add them to the local Users group as this is inherited by the Domain Users group. If this isn’t the case for you then you should make sure those users are also added to this group)

10. Closed all IE browser and Performed an IISReset (run from cmd)

11. Logged back on and EVERYTHING was working great. Here is what I saw for reference.