SCOM - Linux - Discovery - instances

Question

SCOM - Linux - Discovery - instances

Laszlo H 66

Hello,

On Linux servers, I'm trying to write a discovery that should be based on the presence of folders, here's an example:

/folder/app-1
/folder/app-2
/folder/app3

Each folder corresponds to an application instance running on the server.

Then I have to set up monitoring for each of these instances.

If I understood the principle correctly, during discovery, I should create an instance for each of my found folders, but I don't know how to do that.

I know which command to use to discover the folders:

for n in folder/*; do printf '%s\n' "$n"; done | grep "app-[0-9]"

I use Silect MP to create my Management Packs. But I don't find any Management Pack Fragment for this type of case.

Has anyone done this before or have any idea how to do this?

Thanks in advance.

Accepted answer

6 additional answers

Your answer

Answer 1

The Unix/Linux Authoring Library MP will likely help you a lot here.
See https://social.technet.microsoft.com/wiki/contents/articles/18076.scom-2012-discovering-a-unixlinux-role.aspx and various links in the page.

In your case, I would likely go for a timed property bag discovery. What it basically does is that it runs the shell command on linux, send its StdOut to SCOM management server which passes it through a powershell script in which you can parse the StdOut and generate one or more property bags, which can in turn be used like in any "windows" discovery.

Let me know if that's already too much "high level" infos for you and if you need more details :)

Answer 2

Laszlo H 66

Thank you for your reply.

I tried to adapt a fragment made by Mr. Kevin Holman:

https://github.com/thekevinholman/FragmentLibrary/blob/master/Class.And.Discovery.Unix.ShellCommand.Properties.mpx

But without success for now, the discovery is well done on my Linux server.

It seems that the powershell is then not executed, I can't find any trace in the event log on the management server.

For now I'm stuck, I don't know how to add traces to find where I made a mistake.

If I run the script in a powershell it runs without error.

https://gitlab.com/lhornok/scom.linux/-/blob/main/MyCompany.MyApps.Test.xml

I will keep trying to make it work.

CyrAz 5,181 Reputation points

2022-11-11T18:46:12.253+00:00

could you try adding something in the powershell script to verify if it runs and what StdOut looks like to it?
Something like $StdOut | Out-File c:\temp\stdout.txt
Laszlo H 66 Reputation points

2022-11-14T10:23:11.013+00:00

Before adding this trace, I resumed the fragment in its version on Kevin Holman's GitHub, by simply modifying the shell command executed.

I also created a file on the server that contains the information that will be processed by the Powershell script in the fragment.

In the Powershell script I added a line to simply create an empty file "New-Item C:\temp\myapp.start.txt" and I put it at the beginning of the script just after "param($SourceId,$ ManagedEntityId,$TargetSystem,[string]$StdOut)".

On the linux server the discovery runs correctly, I find the trace in the log of the server :

Nov 14 11:03:55 XXXXXXXXXX sudo: XXXXXX : TTY=unknown ; PWD=/var/opt/microsoft/scx/tmp ; USER=XXXXX ; COMMAND=/bin/sh -c ls -lstrh /tmp > /tmp/my.log ; /tmp/my.test.txt

But on the management server, I can't find any trace of the "C:\temp\myapp.start.txt" file. It's as if powershell script is ignored

Answer 3

CyrAz 5,181

You could try running a workflow trace, that should show you if/why the powerwshell script is failing : https://monitoringguys.com/2020/12/15/tracing-scom-workflows-with-powershell/

Answer 4

I run the workflow with trace.

260405-mycustomworkflowtrace.log

I have attached the log.

I extracted the 9 lines that contain the word Powershell:

[0]3640.3528::11/15/2022-09:47:04.191 ModuleDebug[PowerShellProbeActionModule] [IsModuleTracingRequested] IsModuleTracingRequested = true
[0]3640.3528::11/15/2022-09:47:04.191 ModuleDebug[PowerShellProbeActionModule] [NotifyError] NotifyError was called with severity = DataLoss, event source = Health Service Modules, event type = Error, event category = 0, event id = -1073719413, and event parameters = MyCompany.MyApp.MyProperties.Class.Discovery.DS.ps1 300 15
[0]3640.3528::11/15/2022-09:47:04.191 ModuleDebug[PowerShellProbeActionModule] [IsModuleTracingRequested] IsModuleTracingRequested = true
[0]3640.3528::11/15/2022-09:47:04.192 ModuleDebug[PowerShellProbeActionModule] [RequestNextDataItem] RequestNextDataItem was called.
13640.028C::11/15/2022-09:47:04.764 ModuleDebug[PowerShellProbeActionModule] [Shutdown] Shutdown was called
[2]3640.028C::11/15/2022-09:47:04.765 ModuleDebug[PowerShellProbeActionModule] [PowerShellProbeActionModule.DoShutdown] Shutdown called for script 'MyCompany.MyApp.MyProperties.Class.Discovery.DS.ps1'
[2]3640.028C::11/15/2022-09:47:04.765 ModuleDebug[PowerShellProbeActionModule] [PowerShellProbeActionModule.DoShutdown] Shutdown completed for script 'MyCompany.MyApp.MyProperties.Class.Discovery.DS.ps1'
109D8.2998::11/15/2022-09:47:04.773 [ModulesLibrary][DiscoveryFilter] [ModuleImpl::ShutdownImpl] DoShutdown () completed successfully
[3]3640.2CF0::11/15/2022-09:47:04.777 [ModulesLibrary][SchedulerDataSource] [ModuleImpl::ShutdownImpl] DoShutdown () completed successfully

Is my problem this? Data loss?
[NotifyError] NotifyError was called with severity = DataLoss

Answer 5

Laszlo H 66

I found in the eventlog from our test environment SCOM had an issue :

The PowerShell script will be dropped because the it has been waiting in the queue for more than 15 minutes.

I restarted all SCOM servers and now the discovery work.

There was no problem with the fragment. Sorry for the inconvenience and thank you for the help, it allowed me to learn how to put traces.

Share via

SCOM - Linux - Discovery - instances

6 additional answers

Your answer