Patchlevel discovery of SCOM Agents

When one applies a SCOM hotfix/patch/QFE which is also applicable for the SCOM Agents, one would like to know whether the hotfix has been applied properly.

So the first thing todo is to build a view in SCOM which shows the Agents and their patchlevel:

Making view for Agents and their patchlevel:

• Open SCOM Console, goto Monitoring pane, right click the node monitoring.
• Select 'New' and 'State View'.
• In the namefield enter a name like 'Agents'.
• In the 'Criteria' tab select for 'Show data related to' as entity 'Agent' (button with 3 dots opens 'Select target type' screen where one can select 'Agent'.)
• In the 'Display' tab deselect 'Name' and select 'Patch List' (almost underneath in the list).
• Click 'OK'. Stateview of Agents is being built now.

However, the discovery of the patchlevel only runs every 6 hours. So with an override this time can be lowered to – for example – 5 minutes. This way one will see pretty fast what Agents got the hotfix and what Agents didn’t.

Afterwards this override can be exported (for later usage) and removed since it is not necessary to have the discovery run so often for a long time.

How to make this override? Very easy:

Making override for patchleveldiscovery:

• In the SCOM Console in the menubar go to 'Tools', 'Search', 'Object Discoveries'.
• In the searchbox type 'patch' and hit enter. The object discovery 'Discovers the list of patches installed on Agents' will be found.
• In the details part of the window a hyperlink 'View Knowledge' will be displayed. Click this hyperlink.
• The propertieswindow of this discovery will be opened. Go to the last tab 'Overrides'.
• Click the second button 'Overrride...' and select the first option 'For all objects of type: HealthService'.
• Make an new MP for it!. Give it an easy to recognize name like 'Override PatchLevel Detection'.
• Adjust the parametername 'Interval Seconds' to 300 seconds. Save the override by clicking 'OK'.

When you go back to the view you have built earlier, the patchlevel discovery on the Agents will run every 5 minutes so the Agent State view is updated much more frequently. When one has all the information needed, the MP with this override can be exported for later usage and deleted after a succesful export in order to keep the load on the SCOM environment at an acceptable level.