Monday, December 28, 2015

Cross Post: ‘How to discover a Windows Computer as a Network Device in SCOM 2012’

Kevin Holman has written an excellent posting about how to modify SCOM 2012x in such a manner that Windows Computers are treated as network devices. In SCOM 2007x this was a ‘no-brainer’ but in SCOM 2012x impossible.

When following Kevin’s posting, SCOM 2012x will be able to discover Windows Computers as network devices.

HOWEVER, be warned in advance as Kevin states in the same posting:
‘…Technically – making this change isn't tested by the product group, and therefore isn't supported.  I am not aware of any issues caused by this, and since we fully allow SNMP monitoring of Linux devices, it makes perfect sense to work with Windows SNMP devices as well…’

Go here for the posting.

SCCM 1511 & SCOM Monitoring

As it turns out, SCCM 1511 is perfectly discovered and monitored by the latest SCCM 2012 MP, version 5.00.7804.1.

Some screenshots from one of my labs:

Hierarchy Diagram:

Servers and Site System Roles:

Site Servers State:

Notice the highlighted Version number in the previous screen dump, which matches with SCCM 1511:

So this is great news for organizations running SCOM 2012x and SCCM 1511. The latest version of the SCCM 2012 MP covers the SCCM 1511 infra as well. Of course, the latest Site System Role (Service Connection Point) with the extension Updates & Servicing isn’t covered yet, since it’s new to SCCM 1511.

But still the latest SCCM 2012 MP covers most critical SCCM 1511 components and infrastructure, so there is NO black box, which is great Smile. I expect an update of the SCCM MP to be published soon, which will cover the newest features of SCCM 1511 as well.

SCCM 1511: Where Is The Revamped Software Center?!

For a customer I implemented a brand new SCCM 1511 environment. This went pretty smooth, with no glitches what so ever. Even though I’ve SCCM 1511 already running in one of my labs, deploying it in production is a different story all together.

As with any other SC deployment, preparation is key here. But when all the preparations are made and all requirements met, the deployment is a rather straight forward process.

However, when the hierarchy was set, the boundaries defined and the Discovery Methods properly configured and enabled, the SCCM Client automatically pushed (as required), a challenge arose. One of the changes in SCCM 1511 is the revamped Software Center. NO MORE Silverlight! Yeah baby!

But when I started Software Center on any SCCM 1511 client, this is what I got:
?! The OLD Software Center? But why?

Time for some investigation. After some time I found this setting under \Administration\Overview\Client Settings, Default Client Settings / Computer Agent / Use New Software Center:

Normally I don’t touch the Default Client Settings. Per group of (User/Device) Settings, I create a new entity and deploy it as required.

This way it’s far more easier to manage those settings and have a better grip on what’s happening and why. But in this case I decided to modify the Default Client Settings so the new Software Center is enabled by default for ALL managed systems:

After a refresh of the machine policy all managed clients run the updated Software Center:
That’s more like it!

Wednesday, December 23, 2015

Merry Christmas & Happy New Year

A few days from now and it will be Christmas.

Therefore I wish all the visitors of my blog a Merry Christmas & a Happy New Year.

Monday, December 21, 2015

New Year: New Events

With just a few days to go, 2015 is almost over. Nothing to be sad about. Simply because Christmas is still ahead of us, as New Years eve! So still many good things ahead.

And even when those special days lay behind us, there are other good things to look forward to, like System Center Universe 2016, SCU 2016!

This event is co-organized by a fellow MVP and much respected friend of mine, Cameron Fuller. To me this man is totally awesome, since he has an awful lot of experience with SCOM, OMS and Azure. So I know, when he co-organizes an event about those technologies, it’s not just a little bit good, it’s the BEST one can get!

So whenever you’re in to SC related technologies, or already in ‘da cloud’ based on Azure powered technologies, SCU 2016 is the place to be.

Want to know more? Here are some good resources about the kick ass event (excuse my french!):

Spread the word!

Tuesday, December 15, 2015

Silence (Please?)

For many years I used Windows Live Writer (WLW) to write my postings, or even better, to DESIGN them. Simply because I use many screendumps and so on. Without WLW blogging becomes much harder or even - when using many screenshots - nearly impossible.

The Blogger web based interface doesn't work nicely at all. It's a challenge to cut & paste screenshots, size and allign them as required.

Sadly WLW stopped working a few days ago when Google (TOTALLY understandably) pulled the plug on an old authorization mechanism. This authorization mechanism is outdated, buggy and therefore very vulnerable for all kinds of exploits and attacks. So I totally understand Google.

HOWEVER, WLW is just as old so it uses the very same authentication mechanism in order to sign in to Blogger. Since Google stopped that kind of authentication WLW simply doesn't connect anymore to my Blogger account :(.

GLADLY there is a new fork of WLW, Open Live Writer (OLW) as stated before. However, the current release (0.5) doesn't work with the new authentication mechanism Google uses, OAuth 2.0. BUT the people behind OLW are working hard in order to get this issue solved. For this I am very grateful. Totally awesome that people are working so hard in their own free time to make OLW a worthy successor of WLW.

Until the new version of OLW sees the light, which is expected to support OAuth 2.0, my blog will be a bit silent. Not because I've got nothing to share (DUH!!!!) but simply because writing/designing a new posting without WLW or OLW is like a #$@! in the proverbial backside...

Hope to post soon here. Bye!

Thursday, December 10, 2015

Windows Live Writer Is Open Source Now!

For a long time I use Windows Live Writer 2012 (WLW) as my blogging tool. And as far as I know, many other people use it as well. Simply because it works like a charm. With this tool it’s super easy to write postings for my blog. It’s really a totally awesome WYSIWYG editor.

However, much of the code base is ten years old and something's required attention. Like lacking support of OAuth 2. But there wasn’t any effort to update WLW 2012. Gladly a Microsoft employee (Scott Hanselman) decided to give WLW a new whole new life.

Not as a Microsoft product but as an open source product. Scott got support from many people in order to address many challenges, not only a technological level but also on a legal level since WLW is a 100% Microsoft product.

As time passed, it got more traction and from yesterday on the first version (0.5!) became available for the public to test/use it. This open source product is a fork of WLW and goes by the name Open Live Writer (OLW).

Thanks to Scott Hanselman, Microsoft and many other people OLW is alive and kicking! Many new features will be added soon, like OAuth 2 for instance.

Want to know more? go here for Scott’s posting about OWL and here for the OLW website.

Wednesday, December 9, 2015

VSAE 2015 Is Out!

Visual Studio 2015 is available for some time now. However, System Center Visual Studio Authoring Extensions (VSAE 2015) for it weren’t planned.

Gladly many people voted for it on Visual Studio UserVoice and Microsoft LISTENED! So VSAE 2015 was put back on the agenda. And as of today it’s available for download!

A BIG word of thanks for all the people who voted for VSAE 2015 AND for Microsoft who listened. This for me proves Microsoft takes their UserVoice websites seriously.

Monday, November 30, 2015

New Challenges!

Probably you’ve noticed the silence moments on my blog. Some weeks went by without not too many postings or – even worse – no postings at all. All this has a reason.

The main reason is that life takes it’s directions, whether it’s private or work. And you just got to follow the ‘flow’. Some of these shifts in direction are self initiated, whereas other are more like ‘facts of nature’ and have to be dealt with as well.

As such much of my time – used for blogging – was consumed by many other activities. And when not, I simply didn’t have the right mind setting to write a good posting. That way many drafts were made, but never made it to my blog because they failed the final ‘reader test’.

Gladly, the bumpiest parts of this ride are over and a new dawn is about to start!

One of the self initiated new directions is my move to another company. Tomorrow - December the 1st – I’ll start at another company, Didacticum, in the role of senior consultant. I am looking forward to meet my new colleagues and to start this new career tomorrow.

I want to say thanks to Insight24 for the time we spent together and everything I’ve learned. I also wish them the best. And I am sure we’ll meet again since it’s a small world after all.

The moment I’ve found my new balance my blog will be back on track again. So stay tuned for many new postings to come out soon!

Friday, November 20, 2015

System Center 2016 TP & Nano Server Monitoring

One of the new many new items launched by Microsoft is Nano Server. This is a very small server with many capabilities. However, monitoring it with System Center 2016 TP might be a challenge.

So it’s good news that Microsoft has published a TechNet article, all about monitoring Nano Server with System Center 2016 TP, titled: Monitoring Nano Server.

OMS In Full Swing: The Return Of BlueStripe!

Microsoft means business with OMS and is pushing it’s development BIG time. This picture I got from a tweet from Stefan Stanger (@sstranger) which tells it all:

As you can see I’ve highlighted APP DISCOVERY & MAPPING. To me this sounds like BlueStripe FactFinder which Microsoft acquired a few months back.

So OMS is getting bigger & better. Can’t wait to see all the new features in OMS. Awesome!

Technical Preview 4 System Center 2016 Evaluation VHDs Available

Yesterday Microsoft released Technical Preview 4 for System Center 2016, among them SCOM TP4 as well.

The TP4 VHDs download locations:

Updated MP: Windows Server 2012x DHCP

Yesterday Microsoft released an update for the Windows Server 2012 DHCP MP, version 6.0.7299.0.

This MP contains a bug fix: ‘…In a DHCP server with multiple scopes, if the first scope exceeds the threshold for minimum available addresses, alerts are sent for all scopes on the DHCP server even for the ones that don't violate the threshold. The fix ensures that alerts are sent only for the scope exceeding the threshold…’

MP can be downloaded from here.

Monday, November 16, 2015

Troubleshooting Empty OM12x Reports – Part 1: Exchange Server 2010 Report MP

When I started out to write a blog post about how to troubleshoot empty OM12x Reports, I quickly found myself writing about the not so much appreciated (this is a BIG understatement…) Exchange Server 2010 Reports MP.

So I decided to ditch that posting, start all over again and make it a two part series posting since there is much to tell. So this first posting will be all about the Exchange Server 2010 Reports MP. Simply because this MP is a SNAFU as pure as they can get.

Mind you, I am talking about the REPORTING MP, I know the other part is also SNAFU, but this posting is all about the

Yes, I blogged quite a few times about this MP and the ‘challenges’ it creates. Also wrote some postings about how to fix some issues, like the empty reports. But as it turned out, that fix doesn’t work with OM12x. Hence this posting.

Exchange Server 2010 Reports MP = Empty Reports?
Not ALL the times, but MANY times this MP is the culprit of empty OM12x Reports. The cause is the poorly written SQL queries who must aggregate the data present in the Exchange Server 2010 datasets in the Data Warehouse database.

But because the underlying queries for these aggregations are poorly written, they time out. So OTHER aggregation jobs don’t get the time anymore to run! Resulting in the RAW tables being loaded with tons of information without being aggregated so that data never ever goes into other datasets like HOURLY or DAILY. As a result: EMPTY reports.

Read further about how to solve that issue. Of course, you can rewrite the aggregation query as Daniele Grandini once did, but when you don’t use the Exchange Server 2010 Reports, it’s better to remove that MP and the related datasets.

Hey wait! Exchange Server 2010?! That’s so 2010 man!
I agree totally. But quite a few companies still have Exchange Server 2010 running. Yes, they’re moving away from it, to either Exchange Server 2016 (which became GA first half of October) or a combination with Office 365 in the mix.

But until that time, Exchange Server 2010 is production so monitoring is required.

Remove those Exchange Server 2010 datasets
Like stated before, the Exchange Server 2010 Reports MP creates a bunch of new datasets in the Data Warehouse database. In order to see all the datasets, run this query against the Data Warehouse database:

Use OperationsManagerDW
SELECT DataSetDefaultName,
FROM StandardDatasetAggregation sda
INNER JOIN dataset ds on ds.datasetid = sda.datasetid
ORDER BY DataSetDefaultName

Now you’ll see all the datasets in your Data Warehouse database. Except for ONE Exchange Server 2010 dataset (Microsoft.Exchange.2010.Dataset.AlertImpact) you can remove them all. The earlier mentioned dataset is created by the Exchange Server 2010 MP, not the Exchange Server 2010 Reports MP.

Okay, since we have now a full view of the Exchange Server 2010 datasets to be removed, it’s time to continue.

Please make a BACKUP of BOTH SCOM databases (OperationsManager & OperationsManagerDW). This way there is always a way back when things turn sour.

Also good to know:
When you continue from here, be aware all the steps are UNSUPPORTED by Microsoft. So you’re on your own!

Now follow these steps:

  1. Have you made a verified backup of BOTH SCOM databases?
  2. You KNOW that what you’re about to do is UNSUPPORTED & that you can’t blame me either?
  3. Remove the Exchange Server 2010 Reports MP ( from SCOM, like you always do through the Console. Mind you, this is SUPPORTED by Microsoft Smile;
  4. Start SQL Server Management Studio with an account that has sufficient permissions to modify the OperationsManagerDW database;
  5. Run the second query of this blog posting in order to remove the related Exchange Server 2010 Reports MP data sets, one by one;
  6. Don’t touch the Microsoft.Exchange.2010.Dataset.AlertImpact, see previous explanation;
  7. When you’ve removed ALL Exchange Server 2010 Reports data sets (except the one mentioned in Step 6!), close SQL Server Management Studio and go to the SCOM Console > Tools > Search > Rules;
  8. In the Search box, type Data Set > hit Search > one Rule will be found: Standard Data Warehouse Data Set maintenance rule > click the blue link View Knowledge so the properties of this Rule will be shown;
  9. Go to the tab Overrides > Disable > For a specific object of class: Standard Data Set > select the  Microsoft.Exchange.2010.Dataset.AlertImpact data set > OK and save the Override in a dedicated unsealed MP.
  10. Now the default grooming won’t run anymore for this particular data set. Isn’t necessary anymore since the Exchange Server 2010 Reports MP is already removed (Step 3).

Now all data should be processed (aggregated) step by step, resulting in FILLED reports. Sweet!

Close but no cigar?
Please know that the aggregation of data to catch up takes time (from a few hours to days depending on the size of your Data Warehouse database and the amount of data present in the RAW tables) so you won’t get filled reports right away.

However, when you still have empty reports, and nothing seems to be moving for days, it might be that you’ve got other issues with your data aggregation. In the next posting I’ll write about how to see whether you’re affected and even better, how to crack it (most of the times).

See you all next time!

Friday, November 13, 2015

Updated MP: SQL Server

November 13th, Update:
I’ve got confirmation from Microsoft the issue with the previous version of the SQL Server MP is solved with the release of version On the SQL Release Services Blog there is even a posting about the latest release of this MP with this additional statement:

Want to know more? Go here.

Yesterday Microsoft released an update for the SQL Server MP, version As we all know, the previous version ( had some serious issues so it was pulled.

The related MP guide states (page 6):

Since the bug was present in the visualization component, I expect all is okay now. But – like all other MPs - test it thoroughly before putting it into production.

MP can be downloaded from here.

New KB Article: OM12x Configuration Isn't Updated & Event ID 29181 Is Logged

A few days ago Microsoft published KB3092452 all about OM12x environments not updating configuration changes on one or more OM12x Management Servers.

Also Event ID 29181 is logged in the OpsMgr event log.

KB3092452 is all about this issue, the cause AND the solution.

Data Warehouse: Don’t Forget To Modify The Retention

Even though quite a few postings have been written about it, still many people don’t realize the full impact of the default retention settings of the SCOM/OM12x Data Warehouse database. Okay, they know the data is kept for 400 days before it’s groomed out. But many times this is where it stops. And that’s too bad. Why? Just keep on reading Smile.

No need to repeat others…
Since Kevin Holman has written an excellent posting about the Data Warehouse retention and grooming, there is no need to repost/rewrite it here. And yes, the posting is written for SCOM 2007x but applies to OM12x as well.

For me the 3 key takeaways of that posting are:

  1. The Data Warehouse database will be one of the LARGEST databases supported by a company;
  2. You should give STRONG consideration to reducing your warehouse retention to your reporting REQUIREMENTS;
  3. If you don't have any – MAKE SOME!

I would like to follow up on the third item but I don’t know what dataset to ‘touch’…
Since many people/companies don’t follow up on those advises, the Data Warehouse becomes very big. As a result, backups/restores of the same database becomes a challenge.

So what to do? Easy. Modify the retention settings in the Data Warehouse database so it adheres to your company policy and compliancy requirements.

But as it turns out, all of the sudden some road blocks do pop up. Because people are having a difficult time by deciding what kind of data should be kept for 400 days or not.

Some suggestions of what kind of datasets to modify
Suppose your company has the requirement to run reports which show a maximum of ONE year of data for performance and availability.

I’ve seen many cases like these where the SCOM admins say: Okay, based on those requirements there is no need to modify the retention settings since the difference between 365 days (a year) and 400 is way too small to go through the hassle.

So far so good. BUT there is one HUGE downside. YES, your company wants to run reports back to a maximum of ONE year. So you must keep that data there for at least ONE year. BUT does your company require reports dating a year back containing HOURLY data?

Because that’s the default! HOURLY data (performance & availability) are kept for 400 days. And it goes without saying those very same datasets get VERY big.

Until now I haven’t met one company with that requirement. Yes, they require reports going one year back. But in most cases those reports are allowed to use DAILY aggregations, not HOURLY.

So when you’re going to ask your company what kind of policy they adhere to when it comes to data retention, make sure they not only say for how many days, but also to what kind of data (daily or hourly) it applies to.

And until now, this is what most of the companies I’ve met require:

  • DAILY data: 1 year (leave it to the default of 400 days);
  • HOURLY data: 100 days (a difference of 300 days with the default setting of 400 days!)

And now you’ve got a WHOLE different kind of story. And while you’re at it, don’t forget the Alerting dataset as well. Since here the data is kept for 400 days as well. And most of the times the half or even less is good enough.

Back to Kevin it is
With that information read Kevin’s posting about how to modify the retention settings on the related data sets and your Data Warehouse database will shrink considerably in size!

In another blog posting I’ll share some tips and queries about how to troubleshoot data aggregation issues in the Data Warehouse database.

Tuesday, November 10, 2015

New MP: Team Foundation Server 2015 MP Version 14.0.24622.0 Released

Yesterday Microsoft released TFS 2015 MP, version 14.0.24622.0. MP can be downloaded from here.

SCOrch: Integration Modules Converted From Microsoft Supported Integration IPs For Orchestrator

Yesterday Microsoft released the Integration Modules converted from Microsoft supported Integration Packs for Orchestrator. They support the migration of Orchestrator runbooks to Azure Automation and Service Management Automation.

The modules include activities to connect against:

  • System Center Virtual Machine Manager
  • System Center Data Protection Manager
  • FTP
  • Exchange Admin
  • Exchange User
  • SharePoint
  • REST
  • Active Directory
  • Azure
  • VMware vSphere
  • HP Operations Manager

Please know these are in BETA! So test them before putting them into production. They can be downloaded from here.

SCOrch Migration Toolkit

Yesterday Microsoft released the System Center Orchestrator Migration Toolkit, enabling you to migrate integration packs, standard activities, and runbooks from System Center 2012 – Orchestrator to Azure Automation and Service Management Automation.  

Tools included:

  • Integration Pack Converter
    This tool converts integration packs that were created using the Orchestrator Integration Toolkit to integration modules based on Windows PowerShell that can be imported into Azure Automation or Service Management Automation. Using the tool’s wizard, you can select the activities in the integration pack that will be converted to cmdlets in the integration module. Placeholders are created for monitor activities that are not supported in Azure Automation or Service Management Automation.

  • Standard Activities module
    Integration module that contains all of the standard activities used in Orchestrator Runbooks that can be imported into Azure Automation or Service Management Automation. This module must be installed in your environment prior to importing any runbook converted with the Runbook Converter.

  • Runbook Converter
    This tool converts Orchestrator runbooks into graphical runbooks that can be imported into Azure Automation.

This toolkit is still in beta, so test it before you put it into production. Toolkit can be downloaded from here.

Monday, November 9, 2015

OM12x Tuning: Battle Those State Changes!

A little bit of history
Before SCOM 2007 became RTM, there were NO Monitors. Only Rules. So Alerts were fired but the monitored objects didn’t have a real ‘status’. That changed when SCOM 2007 went RTM. Rewritten from the ground up, many new things were introduced, among them the real life status of all monitored objects.

Those very same statuses came from the Monitors, a whole new concept in SCOM. You can look upon Monitors as ‘State Machines’, allowing an object to reflect the real-time health status. So primarily the function of a Monitor is to ‘change state’. Firing an Alert comes secondary. So when a Monitor changes State from healthy to unhealthy, an Alert can be fired. And when the status of the same object changes back to healthy, the Monitor will close the Alert.

As you can see, Monitors do play a significant role in the way SCOM works. This hasn’t changes at all in OM12x for that matter.

So far for the little bit of history.

Too many State Changes are BAD…
Like all good things in life, too much of anything isn’t good. The same thing goes for OM12x. So too many State Changes aren’t good at all. This is also known as ‘flip-flopping’. A certain Monitor for a certain object of a Class changes state for way too many times, like 20 (or more) times per hour.

Think about it. Every single State Change has to be calculated by one of the OM12x Management Servers, participating in the All Management Servers Resource Pool. Every State Change has to be written to the OpsMgr database AND the Data Warehouse database.

For ONE object of a Class with ONE flip-flopping Monitor that’s not too big of an issue. But imagine a Management Group with 1000+ monitored servers, 500+ MPs (many among them custom made) where MANY Monitors on MANY objects of MANY Classes are flip-flopping…

OUCH! That’s going to hurt, that’s going to bite you! So in cases like these you’ve got to know what’s going on in your environment. Because changes are your SCOM environment is affected by it, even when you don’t think it is.

How do I know I am affected?
Simple. Look for Event IDs like 31551, 31552,  & 31553 in the OpsMgr event log of your OM12x Management Servers. Events like these are many times the tell tale sign that something isn’t okay in your environment since data can’t be written into the Data Warehouse database in a timely fashion.

Yes, there can be a multitude of reasons for these Event IDs, but many times it boils down to too many State Changes taken place in your SCOM environment.

The best way to go about it is to run some queries against the operational database (OperationsManager) in order to get an idea of what kind of data and how many for the State Changes is coming in. These queries enable you to pin point step by step whether you’ve got an issue going on with too many State Changes, and when so, what objects and what Monitors are causing them.

Again, all these queries are run against the OpsMgr database (OperationsManager).

Also know these queries have been posted before by other people on other blogs. So all credits for these queries should go to them or their sources (many times Microsoft CSS).

Query 1: How many State Changes are happening on a day to day basis?
This query shows you how many State Changes are taking place on a day to day basis. This way you can compare days with each other in order to identify potential issues.

THEN 'All Days' ELSE CONVERT(VARCHAR(20), TimeGenerated, 102)
END AS DayGenerated, COUNT(*) AS StateChangesPerDay
FROM StateChangeEvent WITH (NOLOCK)
ORDER BY DayGenerated DESC

Example of the output:
Please know that in a SCOM environment which isn’t heavily tuned, the amount of State Changes per day can differ big time. Also keep in mind what kind of day it was. Was it a smooth ride or were there some outages?

Query 2: Noisiest Monitors changing state in the last 7 days
This query will show you the Monitors which generated the most State Changes in the last 7 days.

select distinct top 50 count(sce.StateId) as NumStateChanges,
m.DisplayName as MonitorDisplayName,
m.Name as MonitorIdName,
mt.typename AS TargetClass
from StateChangeEvent sce with (nolock)
join state s with (nolock) on sce.StateId = s.StateId
join monitorview m with (nolock) on s.MonitorId = m.Id
join managedtype mt with (nolock) on m.TargetMonitoringClassId = mt.ManagedTypeId
where m.IsUnitMonitor = 1
  -- Scoped to within last 7 days
AND sce.TimeGenerated > dateadd(dd,-7,getutcdate())
group by m.DisplayName, m.Name,mt.typename
order by NumStateChanges desc

Example of the output:
So now you know what Monitors are causing the most State Changes in your SCOM environment. Mind you, this can be a whole different set of Monitors depending on the configuration of your SCOM MG.

Query 3: What’s the noisiest Monitor PER object/computer in the last 7 days?
This query shows you what Monitor PER object/computer is generating the most State Changes. I’ve seen environments where a single server was good for THOUSANDS of State Changes because the server itself was badly configured…

select distinct top 50 count(sce.StateId) as NumStateChanges,
bme.DisplayName AS ObjectName,
m.DisplayName as MonitorDisplayName,
m.Name as MonitorIdName,
mt.typename AS TargetClass
from StateChangeEvent sce with (nolock)
join state s with (nolock) on sce.StateId = s.StateId
join BaseManagedEntity bme with (nolock) on s.BasemanagedEntityId = bme.BasemanagedEntityId
join MonitorView m with (nolock) on s.MonitorId = m.Id
join managedtype mt with (nolock) on m.TargetMonitoringClassId = mt.ManagedTypeId
where m.IsUnitMonitor = 1
   -- Scoped to specific Monitor (remove the "--" below):
   -- AND m.MonitorName like ('%HealthService%')
   -- Scoped to specific Computer (remove the "--" below):
   -- AND bme.Path like ('%sql%')
   -- Scoped to within last 7 days
AND sce.TimeGenerated > dateadd(dd,-7,getutcdate())
group by s.BasemanagedEntityId,bme.DisplayName,bme.Path,m.DisplayName,m.Name,mt.typename
order by NumStateChanges desc

Example of the output:
So now you know which Monitors on what objects/computers are flip-flopping, enabling you to exercise some good old fashioned tuning and troubleshooting with a maximum set of results!

When to run those queries?
Even when you think you’re in the clear (and you could be!), run these queries at least once per month. This way you know what’s going on in your SCOM MG. This allows you to sniff out potential issues and squash them before they get out of control.

Oh, and while you’re at it, run these queries as well allowing you an even deeper insight into the SCOM database and what’s going on.

A: Performance insertions per day
This query shows you how many performance insertions happen on a day to day basis.

THEN 'All Days' ELSE CONVERT(VARCHAR(20), TimeSampled, 102)
END AS DaySampled, COUNT(*) AS PerfInsertPerDay
FROM PerformanceDataAllView with (NOLOCK)

B: Top 20 performance insertions per object/computer per day
This query shows you what objects/computers generate the most performance insertions per day.

select top 20 pcv.ObjectName, pcv.CounterName, count (pcv.countername) as Total
from performancedataallview as pdv, performancecounterview as pcv
where (pdv.performancesourceinternalid = pcv.performancesourceinternalid)
group by pcv.objectname, pcv.countername
order by count (pcv.countername) desc

C: How many Console Alerts are fired per day?
This query shows you how many Console Alerts per day are fired.

SELECT CONVERT(VARCHAR(20), TimeAdded, 102) AS DayAdded, COUNT(*) AS NumAlertsPerDay
WHERE TimeRaised is not NULL

D: Top 20 of Alerts
This query shows you the Top 20 of the most Alerts in the OpsMgr database.

SELECT TOP 20 SUM(1) AS AlertCount, AlertStringName, AlertStringDescription, MonitoringRuleId, Name
WHERE TimeRaised is not NULL
GROUP BY AlertStringName, AlertStringDescription, MonitoringRuleId, Name

Help! I am NOT allowed to run those queries against the OpsMgr database OR I want to use Reports!
And right you are! In many environments the SCOM databases are only accessible for the DBA’s and not for the SCOM admins. Or you want to have reports which show you exactly that kind of information…

Gladly, there are Reports which do just that! Guess you already know the SCOM Health Check Reports V3? Even though ALL reports here are really good and very helpful, these reports in particular will cover the previous mentioned queries:

  • Alerts – Top 20 Alerts
  • Alerts – Total Daily
  • Misc – Config Churn Overview (drill trough)
  • Monitors – Noisiest Monitors
  • Monitors – State Changes per Day
  • Performance – Performance Inserts Daily per Counter
  • Performance – Performance Inserts Daily Total

The message is clear (I hope): Run at least once per month these queries and/or Reports in order to know what’s happening in your SCOM environment. And when you’ve imported new MPs or updated existing ones, run those queries a few days before and after, so you get a better understanding of those new/updated MPs.

This way you’re in control and stay on top of it all.

Friday, November 6, 2015

OMS Goes Xplat!

As we all know is Microsoft ‘all in’ for their cloud services. This is not only an ever expanding service offering but also the coverage, depth and breadth of it is growing fast.

As of this week OMS supports Linux and Docker container management. These Linux distributions are supported by OMS for now. I am pretty sure more will added along the way:

With OMS you can collect this kind of data:

  • Syslog: Collect your choice of syslog events from rsyslog and syslog-ng
  • Performance Metrics:  We can collect 70+ performance metrics at a 30 second granularity using our new Near Real Time Performance data pipelineGet metrics from the following objects:  System, Processor, Memory & Swap space, Process, Logical Disk (File System) and Physical Disk.  Full list of Performance Counters.
  • Docker container logs, metrics & inventory: We show information about where your containers and container hosts are, which containers are running or failed, and Docker dameon and container logs sent to stdout and stderr. We also show performance metrics such as CPU, memory, network and storage for the container and hosts to help you troubleshoot and find noisy neighbor containersWe support Docker version 1.8+.
  • Alerts from Nagios + Zabbix: The agent can collect alerts from your most popular monitoring tools.  This allows you to view all your alerts from all your tools in a single pain of glass!  Combine this with our existing support for collection of alerts from Operations Manager.  We currently support Nagios 3+ and Zabbix 2.x.
  • Apache & MySQL performance metrics: Collect performance metrics about your MySQL/MariaDB server performance and databases as well as Apache HTTP Servers and Virtual Hosts. 

A feature which is really awesome is to connect Nagios to OMS in order to create a single pane of glass. So no more ‘battles’ between different monitoring platforms, instead it’s all connected! Awesome!

Monday, November 2, 2015

Cross Post: OMS & Near Real Time Performance Monitoring Exchange

Priscilla 'Nini' Ikhena, (Program Manager - Microsoft OMS Log Analytic team) wrote an excellent posting about how to monitor key metrics of your Exchange environment using OMS NRT.

This posting shows how fast OMS is growing in it’s capabilities and use case scenario’s. Want to know more? Go here.


Many years ago the previous CEO of Microsoft had a rant on stage, shouting Developers, Developers, Developers, Developers! Apparently he wanted to get the message across that developers were key to the success of the business and as such were recognized in the force the represented.

On-prem SCOM and the UI…
The same rant goes for the user interface (UI) of any application, whether it’s on-prem, cloud based or a hybrid one. The presentation of the data has to be relevant and a smooth experience as well. Of course there are tons of other requirements it has to live up to, but these two are the two most important ones.

We all know that the on-prem SCOM UI (Console) has some challenges here. And the SCOM Web Console? I even don’t want to go there.

From Azure Operational Insights to OMS. How about the UI?
So when Microsoft started out on the Azure Operational Insights adventure, now rebranded to Operations Management Suite (OMS) I was wondering what it would bring for the UI experience.

And I must say that I am deeply impressed. The OMS web UI runs on a plethora of web browsers AND platforms. And most of the times it’s a very smooth ride as well. The information is relevant AND fast.

Back then I ended that same posting with the comment that OMS lacked apps for Android and iOS. About two weeks ago Microsoft ‘fixed’ that as well. Awesome!

Want to know more? Go here.

Soon I’ll write a posting about my personal experiences with the iOS app.

The Power Of The Community & PowerShell

Some history
A long time ago Jason Rydstrand wrote an excellent PS script for creating a HTML based Health Check Report for a SCOM 2007x environment, to be found here. This PS script enabled one to have a quick overview of the health of their SCOM 2007x environment. It worked like a charm and used quite a few times.

When SCOM 2012 saw the light, fellow MVP Scott Moss rewrote that PS script for SCOM 2012x. And again, it worked like a charm and I used it on many occasions.

Time to add my own ‘ingredients’…
However, I personally thought some additional information was lacking. So I decided to add those sections to the existing PS script in order to obtain a SCOM 2012x Health Check Report with even more information.

Mind you, this isn’t any kind of criticism. It’s always easier to add some lines of code to an existing PS script than to write it from the ground. So all respect AND credits go to Jason Rydstrand and Scott Moss for that matter.

What I added/modified
First off, this PS script has a section which mails it to one or more recipients by using a Gmail account. However, many customers of mine don’t have many internal servers with an internet connection, so this section has been commented out. It’s still available, but it won’t work without some help from you.

Instead this PS script creates a HTML file and saves it to a location as defined in the PS code. In this PS script the location is set to ‘C:\Server Management’. In many occasions it’s better to replace it with a UNC path…

Also the Report gets a file name based on the date (YYYYMMDD. example: 20151102) AND time (HH-MM-SS example: 19-31-52) this Report is run. So when run multiple times, every report file will get a unique name, so nothing gets overwritten. On top of it all, the file name will also reflect the name of the Management Group this Report is about. Example of a report name: 20151102_19-31-52 _SCOM Health Check Report MG OM12.html.

Therefore this PS script is ideal for scheduling it using Task Scheduler or similar tools.

Other stuff I added:

  1. Generic Information section
    This section contains the name of the report file, the location and when it’s created. Also it contains more information about the Management Group: the name of the MG, the number and names of the MS & GW servers, and the number of SCOM Agents. Also the name of the company is shown (replace XYZ in the PS code with the correct company name). Example:
  2. Top 10 Rule Based Closed Alerts
    Personally not only the non-closed Alerts help me tuning a SCOM environment, but also the CLOSED ones. Therefore an additional section has been added showing the Top 10 of the Closed Alerts, based on Rules. Example:
  3. Top 10 Monitor Based Closed Alerts
    Same story, but now for Monitor based closed Alerts. Example:
  4. Report Creation Time
    I want to know how long it took to have this HTML report created. So I use the .NET Stopwatch class in order to obtain that information. Example:

Where to obtain this PS script?
You can download it from my OneDrive.

Again, this PS script hasn’t been created by myself. Instead Jason Rydstrand wrote the PS script for SCOM 2007 and Scott Moss rewrote it for SCOM 2012x. I just added some additional stuff, that’s all. So all credits go to Jason Rydstrand and Scott Moss.

When you think you can add some use full code as well, feel free to do so. Contact me and I will update this posting accordingly. Sharing is Caring!

Thursday, October 29, 2015

UR#8 SCOM 2012 R2 Is Available

Yesterday Microsoft released UR#8 for SCOM 2012 R2.

Fixes in this UR:

  • Slow load of alert view when it is opened by an operator
  • SCOMpercentageCPUTimeCounter.vbs causes enterprise wide performance issue
  • System Center Operations Manager Event ID 33333 Message: The statement has been terminated.
  • System Center 2012 R2 Operations Manager: Report event 21404 occurs with error '0x80070057'
  • SDK service crashes because of Callback exceptions from event handlers being NULL
  • Run As Account(s) Expiring Soon -- Alert does not raise early enough
  • Network Device Certification
  • French translation of APM abbreviation is misleading
  • p_HealthServiceRouteForTaskByManagedEntityId does not account for deleted resource pool members in System Center 2012 R2 Operations Manager
  • Exception in the 'Managed Computer' view when you select Properties of a managed server in Operations Manager Console
  • Duplicate entries for devices when network discovery runs
  • Preferred Partner Program in Administration Pane

Again my advise to test this UR in your SCOM test environment before applying it in production.

Friday, October 23, 2015

Issue With SQL Server MP Version Log File DW Fills Up…

Update October 23th:
Microsoft has pulled this MP and is working hard to solve it. When your SCOM environment is affected by it, go
here in order to fix it.

As it turns out, the SQL Server MP version has a ‘known issue’.

Because of this issue the log file of the Data Warehouse database starts to fill up, causing these errors to pop up:

  1. ‘…Data Warehouse failed to deploy database component. Failed to deploy Data Warehouse component. The operation will be retried…’
  2. ‘…Exception 'DeploymentException': Failed to perform Data Warehouse component deployment operation: Install; Component: Script, Id: ‘[GUID]', Management Pack Version-dependent Id: '[GUID]'; Target: Database, Server name: '[DW Server Name]', Database name: 'OperationsManagerDW'. Batch ordinal: 39; Exception: Sql execution failed. Error 9002, Level 17, State 4, Procedure Microsoft_SQLServer_Visualization_Library_UpdateHierarchy, Line 192, Message: The transaction log for database 'OperationsManagerDW' is full due to 'ACTIVE_TRANSACTION'…’

Cause & Workaround
The suspected culprit is the SQL Server Visualization Management Pack. Remove it and all it’s dependencies.

I notice that some people already complained about this issue with the SQL Server MP version Until now I haven’t seen it for myself. But be careful here.

A BIG thanks to a regular reader of my blog, John Bradshaw. He pointed this issue out to me. Thanks John!

Friday, October 16, 2015

MP Authoring: What Toolset To Use & Why

When authoring MPs one can choose from multiple tools, where every tool has some advantages and disadvantages. This posting sums up the tools available and the reasons why (or why not) to use them and in what circumstances.
One thing to keep in mind…
When I talk about MP Authoring I don’t mean creating a couple of Rules, Monitors or Views. That’s just extending the existing monitoring footprint. With MP Authoring I mean creating multiple Classes, Relationships, Discoveries, Monitors, Rules, Views and the lot.
  1. SCOM 2012x Console > Authoring
    Yikes! This IS NOT a MP Authoring tool at all actually. Sure, you can create Monitors/Rules, some of them by the help of a wizard, found under Management Pack Templates. However, in general it will create XML code loaded with GUIDs instead human readable and understandable names. And when one of the MP Templates is used, a whole sh#!t load of additional XML bloat code is generated, making it even harder to maintain a MP like that.

    On top of it all, you can’t create a new Class here nor any related Discovery. Sure, you can extend an existing Class with a related registry Discovery, but that creates a whole new ‘pain’ in your SCOM environment, so my advice is to stay away from that option all together.

    Conclusion: Use the SCOM 2012x Console > Authoring option only for creating some basic Monitors, Rules or Groups in order to  streamline your notifications, overrides, views and so on. But don’t use it for serious MP authoring since it’s falling short for it.

  2. SCOM 2007 R2 Authoring Resource Kit > Authoring Console
    Before SCOM 2012x became GA, this was for a long time to author MPs. Even though it can be still downloaded, it’s discontinued by Microsoft. Sure, you can still author MPs with it but since it’s targeted at SCOM 2007, it doesn’t support the new XMP MP schema used by SCOM 2012x. I know, when importing a MP like that in SCOM 2012x, it will work. And when exporting it, the XML schema will be set to SCOM 2012x. Still, it’s usability is limited.

    Also it doesn’t support the new dashboards present in SCOM 2012x, limiting it’s usability even further.

    Conclusion: It has been for some time the MP Authoring tool, but it’s outdated by now. The only use case scenario is when authoring MPs for SCOM 2007x environments. But in a situation like this one has to start migrating away from it, to a brand new SCOM 2012 R2 MG. In all other cases, don’t use it. Instead, take a serious look at Silect MP Author, as discussed below.

  3. Silect MP Author
    This is the new MP authoring tool, targeted at the IT Pro. This tool is available for free. Even though Silect has built it (and maintains it as well), Microsoft has paid Silect some money which is reasonable. The tool itself is mainly wizard driven, making it easier for the user to author a MP. While going through the wizard many comments containing Silect’s name are added. And even when removing or modifying those, a few more are added as well which can only be removed by using Notepad++ for instance.

    None the less, this tool allows you to author good MPs with relatively clean XML code, which makes maintenance a better job. Because of the wizards one doesn’t require a real deep understanding while authoring a MP. Also the sealing of the MP is made easy. With nothing but a simple mouse click it’s sealed. Silect delivers the MP Author key for it but you’re free to use the key used by your company, which is a better choice.

    As a downside, the same wizards used to create Classes and related Discoveries (aka Registry/WMI/Script Targets), Rules, Monitors, Views and Folders, are a ‘one-way street’ only. Meaning that when something is created and it must be modified, it can’t be edited easily anymore without modifying the underlying XML code, requiring deeper knowledge and experience with the MP XML code, tags and construction.

    Also some options are greyed out like authoring Classes, Rollup Monitors, Process Monitors and Relationships, limiting the kind of MPs one can author. These options are available in the paid version of MP Author which is part of MP Studio.

    But there are also MANY plusses. Like postings written by Kevin Holman how to build quickly and efficiently your own MPs with their own Classes, Discoveries, Monitors and Views. So creating a new MP of your own is really like a walk in the park. These are his postings: Using MPAuthor to create a class, discover and monitor a service, MPAuthor - Using a PowerShell script to collect performance data in a SCOM rule – 101, MPAuthor – A more advanced PowerShell Performance Collection Rule.

    Conclusion: This tool is value for money and the tool for the IT pro who want’s to build MPs based on relatively clean XML code, without requiring a deep understanding of it. With the postings from Kevin one is quick on track, capable of building far more better MPs without deep understanding of the underlying XML. These MPs are also far more better than the ones build in the SCOM Console itself.

    However, since the capabilities of the free version are limited, it’s not the tool to build real complex MPs, requiring additional relationships, rollup monitors and so on. Also maintenance on previous built targets, Rules, Monitors, Views isn’t done easy because the GUI doesn’t expose it all. Instead one has to work directly in the XML code itself. None the less, it’s far more better than the previous mentioned tools and has an easy access level for the IT Pro requiring customized monitoring in their SCOM environment.

  4. Silect – MP Studio
    This is the flagship product of Silect. It enables one to have a repository of all the MPs imported in the SCOM environment, complete with advanced version control and management (and much more). On top of it all MP Author is included in MP Studio WITH all options available. So with this version of MP Author it’s easier to build more complex and advanced MPs, again without requiring the knowledge of the underlying XML code.

    Conclusion: When you require a tool to maintain your MPs in an advanced way, this is the tool to use. As an added bonus it contains the full blown version of MP Author, allowing for authoring more complex MPs. Still the same disadvantages as mentioned before with MP Author are at play here. So maintaining a MP requires many times to edit the XML code directly, which is only feasible when one has a thorough understanding of it all. And yet, for many IT Pro’s it’s a seriously good tool for MP authoring.

  5. Visual Studio with Authoring Extensions (VSAE)This is the MP Authoring tool targeted at developers, allowing to build the most advanced and complex MPs. With the Authoring Extensions Visual Studio ‘gains’ a deep understanding of the XML code used by MPs. Combined with snippets, templates and IntelliSense, one can build kick ass MPs.

    The price of this package is between zero euro’s/dollars up to many hundreds, depending on the version of Visual Studio you’re using. When running the Community version this whole package (AE included) comes for free.

    And even though it’s primarily aimed at developers, it can be used by IT Pro’s as well, thanks to the help of Graham Davies who has written a series of low level entry postings about how to build some good MPs with VSAE, aimed at the IT Pro. Combined with the MVA training – written by Brian Wren – about VSAE, there is enough material going around for the interested IT Pro about how to use VSAE.

    Still, a good understanding of the underlying XML code is required. Without it you can’t create a Class, nor a related Discovery for instance. And this is where it all starts. Maintenance here is relatively easy since the wizards are two-way streets here, GUI driven. Also copying code, Rules, Discoveries and Monitors for instance, is super easy, enabling you to author a MP super fast. Also the error check when building the MP saves a lot of time. The error codes help you to solve issues rather easy, compared to the errors thrown by SCOM itself when importing a MP derails.

    On top of it, VSAE enables you to test drive specific workflows of your MPs. This way you can see whether it works as intended.

    Conclusion: VSAE is the next level of MP Authoring. When being a MP pro and not feeling comfortable with XML code, used by MPs, stay with Silect MP Author. When hungry for more knowledge, understanding of MP XML coding, flexibility in authoring your own MPs and easier maintenance, this is the tool to use. Also with the previous mentioned postings written by Graham, one can built SUPER fast a Distributed Application, diagram view included.
IMHO it comes basically down to two MP authoring tools: MP Author (free or paid version) and VSAE. Both tools have their advantages and downsides. MP Author has a low level entrance, enabling fast MP development. However, serious MPs have a life cycle, requiring maintenance. And the maintenance in MP Author is mostly done by editing the XML directly since one can’t edit much of it anymore in the GUI.
So in the long run VSAE is the winner for me personally. And yes, it takes more time to learn it and to maintain that experience and knowledge (only doable when authoring MPs on a regular basis), but when you get the hang of it, you’ll love it.
Still I see serious use cases for MP Author since you can’t expect from all IT Pro’s to run VSAE. There is already enough on their regular to do list . It comes down to your own time, schedule, eagerness to learn some (or more when using VSAE) new stuff.
Since both are available for free, test drive them and decide it for yourself. Feel free to comment on this posting.

Updated MP: SQL Server Version

A few days ago Microsoft released updates for the SQL Server MPs, version This update contains fixes and new features.

Available updated SQL MPs:

MP University EMEA Cohosted By Brian Wren & Kevin Holman

On October 28th Silect Software & Infront Consulting Group organize the first virtual MP University about authoring MPs.

Besides the pro’s from Silect and Infront Consulting Group this university will be cohosted by Kevin Holman and Brian Wren. Even though they don’t need a introduction, I’ll do so anyhow.

They both work for Microsoft, Kevin in the role as Technical Solution Professional (TSP) and well known for his blog all about SCOM with in-depth articles. Brian on the other hand ‘…owns knowledge for management pack authoring and automation technologies for System Center, Windows Azure Pack, and Azure…’. He’s also the author of the MP Authoring with VSAE series on MVA.

Therefore, when you work with SCOM and are interested in MP Authoring with MP Author, this is the event to attend! Since it’s a virtual event, you can join in from anywhere with your computer.

Ignite 2016: Relocated & Shifted From Spring To Fall

The moment I published the posting about Ignite 2016 being cancelled I got many tweets about the shift to another date and another location.

The Official Microsoft Blog recently published a posting about all the events planned for 2016, among them Ignite 2016. It’s schedule is set from September 26-30.

I don’t have any idea why Microsoft has relocated and shifted Ignite 2016. Aidan Finn has his own ideas and theories, so go check for yourself.

All I know is that I sure want to go to Ignite 2016 and experience it all by myself.

Wednesday, October 14, 2015

Ignite 2016 Cancelled?

Aidan Finn just posted an article about the possibility that Microsoft Ignite 2016 is cancelled. Read his posting for more information on this topic.

Monday, October 5, 2015

OM12 DW Database Error. EventID 31553: ‘Arithmetic overflow error converting IDENTITY to data type int’

An OM12 environment had some MPs updated, including the core MPs based on UR#9 AFTER the required SQL scripts were applied. So far so good.

Out of the blue, the OpsMgr event log on the MS servers started to log EventID 31533 with the message  ‘…Data was written to the Data Warehouse staging area but processing failed on one of the subsequent operations. Exception 'SqlException': Sql execution failed. Error 8115, Level 16, State 1, Procedure ManagedEntityChange, Line 237, Message: Arithmetic overflow error converting IDENTITY to data type int…’

I’ve seen a lot 31533 events but never before I saw the message Arithmetic overflow error converting IDENTITY to data type int.

So I reached out to some people I know. And gladly I got a response.

As it turns out, the  related table ran out of ID’s. This can be checked by running this query against the Data Warehouse database: DBCC CHECKIDENT ("Managedentity"). The value should be lower than 2147483647.

Before I start: Microsoft PFE recommends to open a case with Microsoft Customer Support Services, so think TWICE before running this fix.

Be sure you know what you do. When possible, do this with a SQL DBA so you have additional SQL knowledge and experience available. Also know that fixing this issue for a certain table can’t be enough and that other tables will suffer from the issue as well. In cases like these it’s better to open a case with Microsoft Customer Support Services.

Reseed the related table when the value is 2147483647 or higher.

  1. First and foremost, BACKUP both SCOM databases, and ascertain yourself the backups are in working order (aka: they can be 100% restored). Also, BEFORE running the backup, STOP all SCOM related services on ALL SCOM Management Servers so new data will be processed by the SCOM databases. Enable these services AFTER this procedure has been run;
  2. Find the current number of rows in the table. This number will be used in Step 3 as value n: select count(*) from managedentity;
  3. Reseed the identity of this table with this query: DBCC CHECKIDENT ("Managedentity",RESEED, n+1). Again: n is the value found in Step 2. Also: there should be no spaces between the , and RESEED;
  4. Check and confirm that the value was changed: DBCC CHECKIDENT ("Managedentity");
  5. Enable the SCOM related services on the Management Servers;
  6. Confirm that EventID 31553 is gone.

Changes are however, other tables will show up in the OpsMgr event log with the same error. Run Steps 2 to 6 in order to remedy it. And again STOP the SCOM related services on the Management Servers before going through these steps and enable them afterwards.

Thursday, September 17, 2015

Updated MPs: WS2012 DHCP & ADS

A few days ago Microsoft released updates for these two MPs:

  • Windows Server 2012 DHCP
    • Version: 6.0.7295.0
    • Change: ‘…The properties view of Failover Server Relationship did not display all the IP addresses, with this fix the properties view of Failover Server Relationship will display all IP addresses…’
    • Download location:

  • Windows Server 2012 Active Directory Domain Services
    • Version: 6.0.8321.0
    • Change: ‘…The “AD_Op_Master_Response.vbs” script in the Active Directory Domain service MP failed on some environments where region for local system is set to a non EN-US locale. This was due to a date field not bring stored in registry in the date format of the region/locale. With this fix, the script doesn't fail when region is to to a non EN-US locale…’
    • Download location:

Like all other MPs: Test them before putting them into production.

New Community MP: Monitor & Reduce Health Service Store Size

At the beginning of this month Jimmy Harper released a new MP for the community. This MP monitors the Health Service Store size and can even reduce it.

On many servers this is not an issue. But sure enough you’ve got a few servers with very limited disk space. So every MB saved is welcome. In occasions like these it certainly pays of to reduce the size of the Health Service Store.

Normally you have to do this by hand. Jimmy Harper has developed a MP which monitors, collects and reduces the size of the Health Service store file.

Want to know more? Go here, read Jimmy’s posting and download the MP for FREE!

Thanks Jimmy for sharing this MP with the community.

Updated MP: OpsMgr Self Maintenance MP Version

Yesterday the king of MP authoring, Tao Yang released an updated version of the OpsMgr Self Maintenance MP, version

And (again) I am VERY impressed. The previous version was already awesome and something which should be PRESENT in ANY SCOM 2012x environment, but this update even got better. Besides some bug fixes it contains new features as well.

Please be advised to READ the guide of this MP from cover to back.
Since good tuning/configuration is required in order to get the most out of it.
Therefore RTFM is key here.

Even though it might take some time it’s worth the effort since it’s like ‘Set & Forget’. So when the tuning/configuration phase is done, this MP will do what the name tells you: Making SCOM 2012x to maintain itself! Just awesome a MP like this comes for FREE!

Thanks Tao for sharing this totally AWESOME MP with the community!

Monday, September 14, 2015

Repost/Cross Post: Dynamic OM12 R2 Groups WITH Heartbeat Alerts

When creating dynamic Groups containing Windows Servers for instance, you WON’T get an Alert when one of those servers is down. Ouch! When you don’t know that, it’s something which is going to bite you sooner or later.

There is always a WHY to something and this case isn’t different. YES, SCOM does check on the availability of the monitored Windows Server. Sure. But it does that kind of monitoring on a whole different Class.

As we all know, SCOM is all about Classes. And the Monitors which check for the availability of the Microsoft Monitoring Agent (MMA) and the related Windows Computer are targeted against the Health Service Watcher Class, and not against the Windows (Server) Computer Class:

Health Service Heartbeat Failure Monitor:

Computer Not Reachable Monitor:

As a result, when creating a dynamic Group in SCOM only containing Windows Server objects, and using this Group in your notification model, you WON’T get an Alert when one of those servers goes down. Sure, other Alerts will do come up, but not an Alert like ‘Health Service Heartbeat Failure’ or ‘Failed to Connect to Computer’, while these Alerts do show you the root cause right away…

What to do about it?
Sure. You can get angry/frustrated with it and go on with your life. However, it’s SCOM remember? So with a bit copying and pasting XML you can achieve a lot!

No! MANUALLY adding the related Health Service Watcher object to this dynamic Group won’t fly. We WANT a dynamic Group remember? A ‘set-and-forget’ Group by knowing this Group will always contain the correct members, AUTOMATICALLY.

So the initial investment will be a bit bigger, but when done, you’re truly done here.

This posting isn’t based on a brain wave I got. But just looking on the internet for the right resources. And after some good searching I found what I needed. At the end of this posting I’ll share the resources I used and give credit to the people who deserve it.

Easy. Follow these few steps by example and you’ll be fine.

  1. Create a Dynamic Group which is dynamically populated with the Windows Computer objects. E.g: Example Group with this Dynamic Inclusion Rule:
    Basically ALL Windows Computers monitored by SCOM are added automatically to this Dynamic Group.
  2. Checking the members:
    As you see, Windows Computer objects only.
  3. Export the MP containing this Group, open the related XML in Notepad++ (for instance) and add this additional XML code between the tags </MembershipRule> and </MembershipRules>. So you’ve got something like this:
    Add the code where the red arrows point at:

    You got something like this:
  4. Increment the version number so you can differentiate between both versions of this MP. Save the modifications and import this updated version into your SCOM MG.
  5. Check the Group members:

So this REALLY works. However, there are some caveats to reckon with:

  1. Since you edited the underlying XML of this Group you CAN’T edit it anymore in the SCOM Console:
    The Create/Edit rules button is greyed out AND do you recognize the Query formula? Exactly, it’s the XML code you just added!
  2. The previously mentioned XML code ONLY works for SCOM 2012 R2! When running OM12 SP1 you’ll need to change the version numbers from 7585010 to 7084300.
  3. The modification of the numbers goes for SCOM 2012 RTM. I don’t know the numbers but you can find them in the XML code of the MP, under the header <References>. Look for the Aliases for Microsoft.Windows.Library and Microsoft.SystemCenter.InstanceGroup.Library. Here you’ll find the correct numbers:
  4. Sometimes your MP will use other references ALIASES. So check them in your MP whether they’re correct. When not, adjust the XML code in accordingly:

Used resources
As stated before, this posting came to be by using other resources, in chronological order:

  1. A posting written by Tim McFadden;
  2. A posting written by Jonathan Almquist.;
  3. TechNet Forum for SCOM, thread 01;
  4. TechNet Forum for SCOM, thread 02 (Thanks Marthijn van Rheenen).

So ALL credits for this posting goes to these guys. Thanks men!