Wednesday, March 18, 2009

Rules vs. Monitors

From many customers I get questions about rules and monitors. Most of the time they do not know when to use a rule or not. To make it even more confusing for them, certain SCOM tasks can be performed by a rule or a monitor. (like checking whether a certain service is up & running). So how to differentiate between both can be challenging.

However, there is a rule of thumb which makes it much easier to differentiate between rules and monitors:
Rules are used for collecting performance data or to run scripts and Monitors check on the health state of a component.
Of course there is much more to know but it is a good starting point. Lets continue.

Monitors update almost real-time so they show the actual state of a monitored object. When one opens the Health Explorer for a computer, the monitor will show up as well. So it is relatively easy to see whether a monitor 'has arrived' and entered a working state.

Screendump 1.
A newly built monitor (Intersite Messaging Monitor) is in place but not 'on':

Screendump 2.
The newly built monitor entered a running state:

Besides that, monitors work different compared to rules. Monitors collect data from various sources and based on that information decide the health status of the monitored object (red, yellow or green). Therefore monitors are also called 'State Machines'. This latter also tells about the way collected data by monitors is treated. The collected data is never stored in the OpsMgr database, nor the Data Warehouse, only the changes of state and the related alerts are.

Rules on the contrary store their collected data in the Data Warehouse so it can be used for reports later on. Rules collect their performance data from log files, perfmon, event logs and so on. Based on that collected information, rules are also capable of raising Alerts within SCOM.

So when one wants to monitor a device with SCOM but also wants to run reports on it, one has to build a rule for collecting performance data that will show up in reports and a monitor that shows the state of that device in SCOM.


Ricky El-Qasem said...

I work Veeam Software - come from the virtualisation side of the industry and quickly had to learn something about SCOM as one of our products is related... I had a hole in my knowdledge which you filled with this blogg.. thanks so much

Marnix Wolf said...

Hi Ricky.

Thanks for your nice words! This (sharing knowledge & experiences with SCOM) is for me the main reason why I run this blog.

Best regards,

Andy said...

This is very useful.
At the moment I try to read data from a logfile into the data warehouse of the scom and then generate a report.

I create a rule that looks in the Directory C:\ with the Pattern log*. But now I have Problems with the report.

Kan you please descripe how I can get the report?


Marnix Wolf said...

Hi Andy.

Thanks for visiting my blog.

As answer to your question, there are multiple ways to go about it. It is better to check out these websites since they tell so much about MP authoring and running specialized reports, it is too much to put into a comment.



Hope these sites put you on the right track.

Best regards,

Anonymous said...

Hello ,

thanks for describe when use rules and when use monitor. Blogs like this are very useful!


Marnix Wolf said...

Hi Masv.

Thanks for visiting my blog and your nice comment. This is exactly why I do run my blog: helping others out.

Have a nice day!

Best regards,
Marnix Wolf