Stay Classy, With Azure, System Center and Hybrid Cloud Ramblings from San Diego https://docs.microsoft.com/archive/blogs/antoni/feed.xml Blog by Antoni Hanus for Useful Azure, Hybrid Cloud, OMS and System Center Ops Mgr and System Center Service Mgr info. This is provided "AS IS" with no warranties, and confers no rights. Use of included script samples are subject to the terms specified in the Terms of Use. Wed, 28 Feb 2018 14:41:26 GMT en-US hourly 1 Operations Manager and Operations Management Suite 101: Useful System Center Operations Manager Links and Resources https://docs.microsoft.com/archive/blogs/antoni/operations-manager-and-operations-management-suite-101-useful-system-center-operations-manager-links-and-resources Thu, 08 Feb 2018 04:08:10 GMT https://blogs.technet.microsoft.com/antoni/?p=5905 INTRO AND OVERVIEW
Microsoft Monitoring Product Comparison https://aka.ms/monitoring
Operations Manager / Operations Management Suite 101 https://aka.ms/101
What's New In 2016 What's new in 2016:  https://docs.microsoft.com/en-us/system-center/scom/what-is-new?view=sc-om-1711
Operations Manager 101 OPERATIONS MANAGER 101: https://aka.ms/101
Official Microsoft Documentation (2016) https://docs.microsoft.com/en-us/system-center/scom/welcome
Official Microsoft Documentation (2012) https://technet.microsoft.com/en-us/library/hh205987(v=sc.12).aspx
Official Microsoft Documentation (2007 R2) https://technet.microsoft.com/en-us/systemcenter/om/default.aspx
 

MANAGEMENT PACKS

Management Pack Catalog https://aka.ms/mpcatalog
Management Pack Best Practices (Operations Manager and Service Manager https://blogs.technet.microsoft.com/antoni/2013/10/09/system-center-service-manager-operations-manager-management-pack-and-naming-convention-best-practices/
MP VIEWER (ESSENTIAL Tool for any SCOM admin) https://blogs.msdn.microsoft.com/dmuscett/2012/02/19/boriss-opsmgr-tools-updated/
PROXY SETTINGS TOOL (enable in bulk) https://blogs.msdn.microsoft.com/dmuscett/2012/02/19/boriss-opsmgr-tools-updated/
SQL MP RUN AS ACCOUNTS NO LONGER REQUIRED https://blogs.technet.microsoft.com/kevinholman/2016/08/25/sql-mp-run-as-accounts-no-longer-required-2/
Certificate Management Pack https://www.systemcentercentral.com/pack-catalog/pki-certificate-verification-mp/
Tao Yang's Self-Maintenance Management Pack https://blogs.technet.microsoft.com/kevinholman/2014/02/24/tao-yangs-self-maintenance-management-pack-for-opsmgr-2012/
 

DESIGN AND DEPLOYMENT

Quick-Start Deployment Guide https://blogs.technet.microsoft.com/kevinholman/2016/10/22/opsmgr-2016-quickstart-deployment-guide/
System Requirements https://docs.microsoft.com/en-us/system-center/scom/plan-system-requirements?view=sc-om-1711
Agent Discovery and push troubleshooting: and Deployment Troubleshooting https://blogs.technet.microsoft.com/kevinholman/2007/12/12/agent-discovery-and-push-troubleshooting-in-opsmgr-2007/
Enable Proxy as Default: https://blogs.technet.microsoft.com/kevinholman/2017/04/10/enable-proxy-as-a-default-setting-in-scom-2016/
Understanding Resource Pools https://blogs.technet.microsoft.com/kevinholman/2016/11/21/understanding-scom-resource-pools/
Antivirus Exclusions https://support.microsoft.com/en-us/help/975931/recommendations-for-antivirus-exclusions-that-relate-to-operations-manager
 

ONGOING MAINTENANCE, OPERATIONS AND ADMINISTRATION

DB maintenance https://blogs.technet.microsoft.com/kevinholman/2017/08/03/what-sql-maintenance-should-i-perform-on-my-scom-2016-databases/
Which hotfixes should I apply? https://blogs.technet.microsoft.com/kevinholman/2009/01/27/which-hotfixes-should-i-apply/
User Roles https://technet.microsoft.com/en-us/library/hh872885(v=sc.12).aspx
Recommended Registry tweaks https://blogs.technet.microsoft.com/kevinholman/2017/03/08/recommended-registry-tweaks-for-scom-2016-management-servers/
Change Agents to remotely manageable https://blogs.technet.microsoft.com/kevinholman/2010/02/20/how-to-get-your-agents-back-to-remotely-manageable-in-opsmgr-2007-r2/
Enhanced Email Notifcation https://blogs.msdn.com/b/tysonpaul/archive/2014/08/04/scom-enhanced-email-notification-script-version-2-1.aspx
Troubleshooting Grey Agent State https://support.microsoft.com/kb/2288515
 

MANAGEMENT PACK AUTHORING

Visual Studio Authoring Extensions (VSAE) https://blogs.technet.microsoft.com/kevinholman/2016/06/04/authoring-management-packs-the-fast-and-easy-way-using-visual-studio/
MP Author MP Author - https://www.silect.com/mp-author/
PowerShell Management Pack PowerShell Management Pack - https://squaredup.com/free-powershell-management-pack/
 

MANAGEMENT PACK TUNING

Getting lots of script failed to run alerts: https://blogs.technet.microsoft.com/kevinholman/2009/06/29/getting-lots-of-script-failed-to-run-alerts-wmi-probe-failed-execution-backward-compatibility-script-error/
Tuning Over Collection of Events (Event Collection Rules) https://blogs.technet.microsoft.com/kevinholman/2009/11/25/tuning-tip-turning-off-some-over-collection-of-events/
 

MAINTENANCE MODE

Orchestrator runbook https://blogs.technet.microsoft.com/scom_atlas/2014/04/22/schedule-scom-maintenance-mode-with-orchestrator/v
SCOM 2016 Maintenance Mode scheduler: https://www.scom2k7.com/new-version-scom-2016-maintenance-mode-scheduler/v
 

CROSS PLATFORM MONITORING

Monitoring Unix / Linux with 2016 https://blogs.technet.microsoft.com/kevinholman/2016/11/11/monitoring-unixlinux-with-opsmgr-2016/
SUPPORTED VERSIONS https://docs.microsoft.com/en-us/system-center/scom/plan-supported-crossplat-os?view=sc-om-1711
SUDO ELEVATION https://social.technet.microsoft.com/wiki/contents/articles/7375.scom-2016-and-2012-configuring-sudo-elevation-for-unix-and-linux-monitoring.aspx
Troubleshooting Discovery https://social.technet.microsoft.com/wiki/contents/articles/4966.scom-2012-troubleshooting-unixlinux-agent-discovery.aspx
Restarting a Linux Services Daemon with Orchestrator https://www.systemcentercentral.com/how-to-restart-a-linux-service-daemon-with-system-center-2012-orchestrator/
 

POWERSHELL

 

VIEWS AND DASHBOARDS

News widgets and dashboards - check out word doc https://blogs.technet.microsoft.com/momteam/2014/04/23/new-widgets-and-dashboard/
intro to widgets https://blogs.technet.microsoft.com/antoni/2013/05/13/operations-manager-2012-dashboard-widgets/
Tool to create custom dashboards https://blogs.technet.com/b/momteam/archive/2012/06/12/free-windows-server-2008-dashboards-for-opsmgr-2012-and-tool-to-help-create-your-own-customized-dashboards.aspx
 

THE Kevin Holman Collection

My good friend and colleague Kevin Holman has a LOT of useful blogs. These are my top 10 that I use (for reference or point folks to) extremely frequently:  
Deployment troubleshooting Table https://blogs.technet.microsoft.com/kevinholman/2009/01/27/console-based-agent-deployment-troubleshooting-table/
Agent Discovery and Push troubleshooting https://blogs.technet.microsoft.com/kevinholman/2007/12/12/agent-discovery-and-push-troubleshooting-in-opsmgr-2007/
understanding resource pools https://blogs.technet.microsoft.com/kevinholman/2016/11/21/understanding-scom-resource-pools/
which hotfixes should I apply https://blogs.technet.microsoft.com/kevinholman/2009/01/27/which-hotfixes-should-i-apply/
useful queries https://blogs.technet.microsoft.com/kevinholman/2016/11/11/scom-sql-queries/
what maintenance should I perform on my databases? https://blogs.technet.microsoft.com/kevinholman/2017/08/03/what-sql-maintenance-should-i-perform-on-my-scom-2016-databases/
Visual Studio Authoring Extensions (VSAE) https://blogs.technet.microsoft.com/kevinholman/2016/06/04/authoring-management-packs-the-fast-and-easy-way-using-visual-studio/
Real world notifications https://blogs.technet.microsoft.com/kevinholman/2008/06/26/using-opsmgr-notifications-in-the-real-world-part-1/  
Enable Agent Proxy on ALL agents https://blogs.msdn.microsoft.com/wei_out_there_with_system_center/2013/10/16/opsmgr-monitoring-file-content-with-a-powershell-based-monitor/
Monitoring Unix / Linux https://blogs.technet.microsoft.com/kevinholman/2016/11/11/monitoring-unixlinux-with-opsmgr-2016/
 

FUN

 

REPORTING / POWER BI

Get Started with Power BI https://powerbi.microsoft.com/en-us/get-started
Download Power Bi Desktop https://powerbi.microsoft.com/en-us/downloads/
KPI Reports from SCOM https://blogs.technet.microsoft.com/askpfeplat/2016/03/28/using-power-bi-to-create-kpi-reports-from-system-center-operations-manager/
 

HOT RIGHT NOW

ur4 for 2016 Step-by-Step https://blogs.technet.microsoft.com/kevinholman/2017/10/28/ur4-for-scom-2016-step-by-step/
         ]]> System Center 2016 – Operations Manager and Operations Management Suite (OMS) 101 Series https://docs.microsoft.com/archive/blogs/antoni/system-center-2016-operations-manager-and-operations-management-suite-oms-101-series Sat, 03 Feb 2018 02:59:58 GMT https://blogs.technet.microsoft.com/antoni/?p=5845 Operations Manager 101 for 2007 R2. My esteemed colleague and friend Mr. Kevin Holman was kind enough to post it on his blog in order to make it easily retrievable for those that could use it. Over time, I have received feedback on this being a useful guide for folks getting started with System Center Operations Manager. Fortunately, most of it was applicable and translated without much issue into 2012 and 2016, but with 2016 being released, I took the opportunity to update it and turn it into a web blog series. Also, if you have System Center Operations Manager, it makes a lot of sense to check out Operations Management Suite (OMS) as these 2 products are complimentary and better together, which you can read more about at this post - https://aka.ms/together Please find Below the following posts and look out for new ones here. NOTE: Any comments and feedback greatly appreciated if you find these posts helpful or have any corrections / suggestions.  Cheers, Antoni OPERATIONS MANAGEMENT SUITE 101 Operations Management Suite and System Center Operations Manager – Better Together Operations Management Suite (Azure Log Analytics) 101 - Log Analytics Queries 101 Operations Management Suite (Azure Log Analytics) 101 - Links and Resources Operations Management Suite (Azure Log Analytics) 101 - Create an OMS Workspace and Add agents to it. SYSTEM CENTER 2016 – OPERATIONS MANAGER 101 Operations Manager 101 – Where do I see Views / monitoring / Alerts etc for my technology? Operations Manager 101 – Something Shows as Red / Critical or Warning / Yellow in a State View. How do I check why this is? Operations Manager 101 – How do I get more detail on what is in my Technology's Management Pack? Operations Manager 101 – How do I disable or tune something in Operations Manager? Operations Manager 101 – How do I create a rule to be alerted on a scenario such as a user being added to domain admins? Operations Manager 101 – How do I create a Subscription which will notify when a given alert occurs. Operations Manager 101 – How do I know if Operations Manager is collecting a specific performance counter? Operations Manager 101 – How do I create a rule to collect performance data that is not already collected in a management pack, and show it in the graphs in Operations Manager? Operations Manager 101 – How do I create a performance monitor to monitor if a performance counter sample exceeds a threshold? Operations Manager 101 – How do I run a report for a performance counter that Operations Manager is collecting? Operations Manager 101 – How Do I Generate a Top 'n' Performance Report? Operations Manager 101 – How do I know what parameters are available in an event to monitor off? Operations Manager 101 – Create an Event Collection Rule for Monitoring Server Restarts Operations Manager 101 – Links and Resources]]> Operations Manager 101: Create an Event Collection Rule for Monitoring Server Restarts https://docs.microsoft.com/archive/blogs/antoni/operations-manager-101-create-an-event-collection-rule-for-monitoring-server-restarts-2 Sat, 03 Feb 2018 02:40:31 GMT https://blogs.technet.microsoft.com/antoni/?p=3986 https://aka.ms/101 In this scenario we will create an event collection rule for Monitoring Server Restarts. Depending on how frequently this happens in your environment, it is possible you do not want an alert generated every time this happens, hence it may be more appropriate just to have an event collection rule, so these events can be viewed in an event view. NOTE: An Event Collection Rule will only store the events in the Operations Manger database, making them accessible via event views. It will not generate an alert when an event occurs – for the purpose of generating an alert (from which email notification can be configured) use an Alert-generating rule. Go to the Authoring space 1) Launch the Operations Console 2) Click the 'Authoring' space on the bottom left hand side. 3) Right-click Management Pack Objects>Rules and choose 'Create a new rule' 4) In the dialog, expand Collection Rules>Event based 5) Click 'NT Event Log' NOTE: A Golden rule of Operations Manager is to NOT store anything in the Default Management Pack. See this post for more additional guidance on Management Packs best practice: https://blogs.technet.microsoft.com/antoni/2013/10/09/system-center-service-manager-operations-manager-management-pack-and-naming-convention-best-practices/ 6) Change the Management Pack to an appropriate Management Pack. For example, a management pack containing custom rules and monitors, then select it from the dropdown. If necessary, create a new Management Pack by clicking the New button, give it a name, hit Next and Create) 7) With NT Event Log and the appropriate Management Pack selected, click Next: 8) Give the rule a name (For Example: 'Contoso Event Collection Rule for 6005 Events in System Log - Agent Restarts') NOTE: It is best practice to use some form of prefix or three-letter acronym as a naming convention, to identify all of an organization's custom rules and monitors (I am using Contoso as my prefix in all these examples). This makes it much easier to find custom rules in the console when necessary. 9) Click the 'Select' button next to the Rule target box and choose an appropriate target such as 'Windows Computer', uncheck the 'Rule is Enabled' and click OK. NOTE: Start typing the name of the object desired in the 'Look For' box to narrow the list down, and If the object desired is not displayed, click the 'View all targets' radio button. 11) In the Event Log Name, type the word System, or alternatively click the 3 dots and select the System Event Log, and click Next: NOTE: This is nothing to do with the targeting. This is purely to make sure you get the name of the event log correct with no typos. The Rule will look in the selected event log on every object targeted (e.g. every windows computer or domain controller) that has the selected event log. 12) In the Value box on the Event ID line, type 6005 and in Event Source type EventLog: NOTE: If you wish to collect a different Event, simply specify the alternative Event ID here. NOTE. In the case of the 6005 event, the Event Source is EventLog 14) Click Create. 15) Find the Event Collection Rule using the Look For box: 16) In Authoring>Rules, if the yellow bar is shown click the 'Change Scope' hyperlink. If the yellow bar is not shown, click the Scope button in the taskbar : 17) Choose Windows Computer and click ok: 18) Use the 'Look for' box to find the rule that you just created: 19) Override the Rule for all objects of class, for a group, for a specific object depending on your scenario (which of these you wish to turn the event collection rule on for): : 20) Place a check mark next to 'Enabled' and then change the override value from False to True, and then click OK to save the override: Task 2 (Optional) – Create an Event View in Operations Manager for collecting the Events. NOTE: If you create the view under 'my workspace;' this is associated with your user profile and the view will only be visible to you. If you create it under a folder in the main Monitoring folder structure, then it will be available to others (depending on configured security / user roles etc) 1) In the Operator's console, right click either the desired folder in the main monitoring structure, or the top level in My workspace, 3) Give the view a name. In our case, a name like 'Agent Restarts - 6005 events' is relevant. 4) Place a check in the 'with a specific event number' criteria 5) Click the 'specific' hyperlink that appears in the criteria description box. 6) Type the event ID that you want to display (in our case 632) and click OK: 7) Click OK in the Properties dialog 8) Verify that the new rule makes it down to the computer on which you intend the event to be collected from by looking for a series of 1200, 1201 and 1210 events In the Operations Manager event log (The 1201 event should show the name of the management pack that you created the rule in): 9) Repro the scenario so that an event is generated on the computer and collected in operations Manager. In this example I rebooted SCCM Note, if you wanted to create an email alert, you would need to re-create this as an alert generating rule as described at https://aka.ms/scom101subscription NOTE: Any comments and feedback greatly appreciated if you found this post helpful or have any corrections / suggestions.  Cheers, Antoni ]]> Operations Manager 101: How do I know what parameters are available in an event to monitor off? https://docs.microsoft.com/archive/blogs/antoni/operations-manager-101-how-do-i-know-what-parameters-are-available-in-an-event-to-monitor-off Sat, 03 Feb 2018 02:39:00 GMT https://blogs.technet.microsoft.com/antoni/?p=4005 In Operations Manager, these parameters can be used as criteria when creating a rule, to create a more granular event collection rule or alert generating rule as outlined in https://aka.ms/scom101domainadmins   NOTE: Any comments and feedback greatly appreciated if you found this post helpful or have any corrections / suggestions.  Cheers, Antoni  ]]> Operations Manager 101: How do I run a report for a performance counter that Operations Manager is collecting? https://docs.microsoft.com/archive/blogs/antoni/operations-manager-101-how-do-i-run-a-report-for-a-performance-counter-that-operations-manager-is-collecting Sat, 03 Feb 2018 02:38:04 GMT https://blogs.technet.microsoft.com/antoni/?p=4215 https://aka.ms/101 Note: This exercise assumes that Operations Manager reporting is already installed and that a Performance Collection Rule already exists (either in an imported management pack or created in the authoring space in a custom management pack) which is collecting the desired data. The first step will illustrate how to create an 'All Performance' view which shows all the Performance data that is currently being collected. This only needs to be done once and is used as a reference as to which counters and rules are available. If a new performance collection rule is created or a disabled one is enabled for the purposes of seeing the performance data in a report, the data will not be available in reports until an hour later because the data is aggregated on an hourly cycle. It is the aggregated data that is displayed in the out of the box reports. The steps below only need to be followed once to create a report. Once the report is created with all the required parameters, objects etc, it can be saved to authored reports (by publishing it) or saved to 'favorite reports' or to a Management Pack, and then be executed, without having to carry out the following steps each time the report is ran. IT can also be scheduled to be emailed or copied to a file share. This document uses the example of creating a performance report displaying the performance counter SQL Server: SQL Statistics and Counter –Batch Requests /Sec. This data is collected by the Rule – 'Contoso Performance Collection Rule - SQL Server: Statistics\Batch Requests/sec' which is targeted to 'SQL Serve 2016 DB Engine' Outline of Steps (Fully Detailed Steps Commence on Next Page) 1) Create an 'All' Performance View in My Workspace 2) Identify the rule and target name(s) for the required Performance Counter 3) Open the Generic Performance Report 4) Add the Required Chart and Series lines 5) Add an individual object to the first series line: 6) Add an individual object to any additional series lines: 7) Add the appropriate rule to the first series line 8) Add the appropriate rule to any additional series lines 9) Click OK in the settings dialog to confirm the settings. 10) Change the From value to a start time in the past, for instance use a previous day in the week. 11) Click Run Detailed Steps
  1. Create an 'All Performance' View in My Workspace using the steps in https://aka.ms/scom101checkperf and use the 'Look for' box to find the appropriate rule / counter / object that you want to create a performance report for.
NOTE: in this example, we will use the Object SQL Server:SQL Statistics and the Counter 'Batch Requests/sec c) Right click the appropriate line and click 'Show or Edit Rule properties': c) Note the 'Rule Target' and 'Rule Name' in the rule properties. In this example: Rule Name – Contoso Performance Collection Rule - SQL Server: Statistics\Batch Requests/sec Rule Target – SQL Server 2016 DB Engine NOTE: I will typically copy these to a notepad file so I have them handy for later: 3) Open the Generic Performance Report

a) Click the reporting space and 'Microsoft Generic Reports Library' on the left

b) Double Click 'Performance'

4) Add the Required Chart and Series lines a) Click the 'Change' button near the top right of the window b) In the settings dialog box, click the new chart button c) Click the New Series button one or more times depending on how many instances you would like your graph to show. If you will be adding an object such as SQL Server: Statistics\Batch Requests/sec for 15 different SQL Server DB Engines , you would need to add 15 Series lines. NOTE: In the example, I will add 2 SQL Server 2016 DB Engines so I click New Series twice: 5) Add an individual object to the first series line: a) Click on the first series and click Add Object b) Click the Options button: c) Click the Add button: d) Type in all or part of the class name that you noted in Step 2, Search for it, click Add and then click OK: e) Click Ok in the Options dialog: f) With the Filter applied, click Search and all instances of the selected object should be returned: g) Pick ONE instance , Add One to the Selected Objects and click OK (DO NOT SELECT MULTIPLE!) NOTE: Do not pick multiple instances. If you wish to add more than 2 instances (for instance 10 SQL Servers) you will need to add 10 series lines (using the new series button) and then add an individual instance to each series using steps Xx, Xx and X. 5) Add an individual object to the second series line a) Click on the second series and click Add Object b) Click the Options button: c) Click the Add button: d) Type in all or part of the class name that you noted in Step 2, Search for it, click Add and then click OK: e) Click Ok in the Options dialog: f) With the Filter applied, click Search and all instances of the selected object should be returned: g) Pick ONE instance , Add One to the Selected Objects and click OK (DO NOT SLEECT MULTIPLE!) If you have additional lines in the chart, repeat these steps until each line (series) of the chart is associated with an object 7) Add the appropriate rule to the first series line a) If not already selected, click the first series line that was added under the chart header b) Click the Browse button next to Rule on the right-hand side of the Settings Dialog: c) Leave the default 'Search by Name' Selected and in the search box, type part or the entire rule name noted in step 2 and click search: Select the appropriate rule and click OK. Repeat Steps 7abc for any additional series, until each has a rule and object assigned. When finished it should look something like this: NOTE: although the rule name is cached and you will not need to search for it if using the same rule, you will need to search for the object type again, apply the filter, search for instances and then add the instance. 8) Click OK in the settings dialog to confirm the settings. 9) Change the From value to a start time in the past, for instance here I chose Advanced and configured Today minus 7 days in the From field: 11) Click Run This was the report output using my example: TIPS: 1) You can click the 'Show or Hide Parameter button' to bring back the parameters and modify the report settings. Access the settings dialog using the Change button. 2) Once the report appears, you can use the File menu to perform one of the following options which will remember the way in which you configured the report, allowing it to be re-ran by simply double clicking it: Save to favorites – This will save the report to the 'Favorite Reports' node which is user-profile specific so the report will only be seen by the user who publishes it Publish – This will save the report to the 'Authored Reports' node which is user-profile specific so the report will only be seen by the user who publishes it Save to Management Pack – Will allow you to specify an existing management pack or create a new one to store the report in. This will create a new Folder under the reporting tree in the reporting space. Schedule will enable the ability to copy the report to a file share, or email it on a specified schedule. To enable email functionality, be sure to add the email server and address in Reporting Services Configuration Manager on the SQL Server Reporting Server that is being used in your System Center Operations Manager environment.   NOTE: Any comments and feedback greatly appreciated if you found this post helpful or have any corrections / suggestions.  Cheers, Antoni  ]]> Operations Manager 101: How do I create a performance monitor to monitor if a performance counter sample exceeds a threshold? https://docs.microsoft.com/archive/blogs/antoni/operations-manager-101-how-do-i-create-a-performance-monitor-to-monitor-if-a-performance-counter-sample-exceeds-a-threshold Sat, 03 Feb 2018 02:37:24 GMT https://blogs.technet.microsoft.com/antoni/?p=4325 https://aka.ms/101 Example: Create a monitor so I am alerted when CPU exceeds 80% usage on a server: NOTE: there is already a monitor called 'Total CPU Utilization Percentage that monitors both Processor Information\% Processor Time\_Total and the System\Processor Queue Length (More about that here - https://blogs.technet.microsoft.com/kevinholman/2017/05/13/how-does-cpu-monitoring-work-in-the-windows-server-2016-management-pack/ ) The monitor created in the following steps monitors just CPU %Processor Time Total NOTE: When working with a threshold for monitoring, it is necessary to create a monitor, rather than a rule. The key difference between a monitor and a rule, is that a monitor is state-based which means it will actually change the state of an object to red (critical), yellow (warning) or green (healthy) in the state views. A rule is targeted to an object, but can not change the health state of an object (in the event of a threshold been exceeded for example). Also a performance collection rule collects samples on a designated interval and stores these in the DB, but does not create alerts based on this collected data. Instead the data is viewed via performance views and reports. 1) Navigate to Authoring and expand Management Pack Objects. Click Monitors>Create a Monitor>Unit Monitor: 2) Navigate to Windows Performance Counters>Static Thresholds> Single Threshold>Simple Threshold and change the Management Pack to something other <Select Management Pack> (It may be good practice to create a new one called something like 'Contoso SQL Performance Monitoring' , and click Next: NOTE : This is a single threshold rather than a double threshold. A Single threshold has 2 states such as healthy and critical when the threshold is exceeded. A double threshold monitor has 3 states such as healthy, critical and warning and 2 thresholds are used to calculate which of these health states an object is in. 3) Give the monitor a name (For Example: 'Contoso Simple Threshold Monitor for CPU'), Select a Monitor Target that will be present on the computer you want to monitor the performance counter on. In this case an appropriate target is 'Windows Server 2012 Operating System', uncheck the 'Monitor is Enabled and then click Next NOTE: It is best practice to use some form of prefix or three-letter acronym as a naming convention, to identify all of an organization's custom rules and monitors. This makes it much easier to find custom rules and monitors in the console when necessary. 4) In the following dialog, click the 'Select' button; 5) In computer, Browse to a computer that has the performance counter you need to monitor and the available object and counters in the list will refresh. NOTE: This is purely for picking the correct counter. By selecting a computer to pick the counter from, you are not saying 'I just want to target this one computer'. Because in the previous dialogs we selected Windows Server 2012 Operating System, the performance counter rule will be activated on every Operations Manager agent where a Windows Server 2012 Operating System object and the counter picked out is found. 6) Pick the appropriate object and counter and click OK: 7) Configure the interval / instances as required and click Next: 8) Type the desired threshold value and click Next: 9) Reconfigure the states if necessary or leave the defaults and click Next: NOTE: You may need to reverse the states in the 'Health State' column for example if you were monitoring Disk Space in MB, and wanted to change to critical if Over the threshold, and healthy if under the threshold 10) Place a check in the 'Generate Alerts for this Monitor' and optionally change the name to something more meaningful. Also reconfigure the other settings like severity if needed and click Create: NOTE: If you ultimately intend to create a notification off this, if will be necessary to generate an alert as notifications are-alert-driven: 11) Find the Monitor using the Look For box: In Authoring>Rules use the 'Look for' box to find the monitor that you just created and Override the Rule for all objects of class, for a group, for a specific object depending on your scenario (which of these you wish to turn the performance monitor on for): : Place a check mark next to 'Enabled' and then change the override value from False to True, and then click OK to save the override: NOTE: Any comments and feedback greatly appreciated if you found this post helpful or have any corrections / suggestions.  Cheers, Antoni]]> Operations Manager 101: How do I create a rule to collect performance data that is not already collected in a management pack, and show it in the graphs in Operations Manager? https://docs.microsoft.com/archive/blogs/antoni/operations-manager-101-how-do-i-create-a-rule-to-collect-performance-data-that-is-not-already-collected-in-a-management-pack-and-show-it-in-the-graphs-in-operations-manager Sat, 03 Feb 2018 02:36:32 GMT https://blogs.technet.microsoft.com/antoni/?p=4426 https://aka.ms/101 1) Navigate to the 'Authoring' Space of the console. Expand Management Pack Object and right-click Rules and choose 'Create a New Rule' 2) Select Collection Rules>Performance Based> Windows Performance, and change the management pack to something other than the Default Management Pack and click Next: 3) Give the rule a name (I recommend using a prefix to the rule name such as a 3-letter acronym of the company name as this makes it easier to find objects such as rules in the console), select a Rule Target that will be present on the computer you want to collect the performance counter from. In this case an appropriate target is SQL Server 2016 DB Engine, uncheck the 'Rule is Enabled' checkbox and then click Next: 4) In the following dialog, ignore everything else and click the 'Select' button; In computer, Browse to a computer that has the performance counter you need to collect and the available object and counters in the list will refresh. NOTE: This is purely for picking the correct counter. By selecting a computer to pick the counter from, you are not saying 'I just want to target this one computer'. Because in the previous dialogs we selected SQL Server 2008 DB Engine as the Rule target, the performance counter rule will be activated on every Operations Manager agent where a SQL Server 2008 DB engine object is found. Pick the appropriate object and counter and click OK: Configure the interval / instances as required and click Next: Leave the defaults in the Performance Optimization dialog, and click Create: NOTE: Performance Optimization will drop consecutively collected samples that are within a specified range (based on absolute number or percentage) of the last sample collected. This is to reduce space in the database. In Authoring>Rules use the 'Look for' box to find the rule that you just created: Override the Rule for all objects of class, for a group, for a specific object depending on your scenario (which of these you wish to turn the performance collection rule on for): Place a check mark next to 'Enabled' and then change the override value from False to True, and then click OK to save the override: After the collection interval that you specified has past, you will see the data in the all performance view that you created. Click on the 'Show' checkbox to display the data. Note you can click on the graph to show the value of the data, or use the 'Select Time Range' option to show a more granular range: NOTE: The data shown above will go back 7 days by default (unless the settings in Administration>Settings>Database Grooming for performance data have been changed): NOTE: Data older than 7 days can be shown in a report (see section X of this document). The rule by default will store the collected performance data in both the live database and the data warehouse. NOTE: Any comments and feedback greatly appreciated if you found this post helpful or have any corrections / suggestions.  Cheers, Antoni  ]]> Operations Manager 101: How do I know if Operations Manager is collecting a specific performance counter? https://docs.microsoft.com/archive/blogs/antoni/operations-manager-101-how-do-i-know-if-operations-manager-is-collecting-a-specific-performance-counter Sat, 03 Feb 2018 02:35:43 GMT https://blogs.technet.microsoft.com/antoni/?p=4475 https://aka.ms/101 The first thing to determine is whether the performance data you need is already being collected in Operations Manager. The easiest way to do this is to create a view showing all performance counters In My Workspace, Right-Click My favorites, choose New>Performance View: Give it a name such as 'All performance', leave all the other default settings, and click ok to create the view: Change the "All Items' to 'Items by text Search' and type part of the performance object or counter that you're interested in. For this example, we are looking for SQLServer: SQL Statistics\Batch Requests/sec. Typing Statistics into the look for box, returns all counters / objects / rule names that have the word statistics in the title: The above view shows that only the only counters collected by default for the SQL Server: SQL Statistics object are SQL Re-Compilations/Sec and SQL Compilations/Sec. This means we need to create a performance collection rule to collect the data that we want to collect and present in the above graph. NOTE: Any comments and feedback greatly appreciated if you found this post helpful or have any corrections / suggestions.  Cheers, Antoni]]> Operations Manager 101: How do I create a rule to be alerted on a scenario such as a user been added to domain admins? https://docs.microsoft.com/archive/blogs/antoni/operations-manager-101-how-do-i-create-a-rule-to-be-alerted-on-a-scenario-such-as-a-user-been-added-to-domain-admins Sat, 03 Feb 2018 02:34:36 GMT https://blogs.technet.microsoft.com/antoni/?p=4735 https://aka.ms/101 NOTE: The event we are watching out for is this one in the security event log. Note that when you view the 'Event Data' in the Details of the Event Properties, you will see a list of parameters which can be used as criteria in SCOM in the same numerical order in which they appear in the event When you get to this dialog when creating a rule or monitor based on a Windows Event, you will be able to specify one of these numbered parameters: ADDITIONAL NOTES FOR CREATING RULES BASED ON SECURITY EVENTS:
  • If you're using Source as Criteria in the rule, you need to specify 'Microsoft-Windows-Security-Auditing' (with the hypens but without the surrounding quote marks, as specified as the Provider Name in the XML view of the event properties:
  • When you're picking a target, if you're monitoring for an event only created on DCs, a good target would be windows domain controller or domain controller 20xx depending on the version of your DCs.
  • When you pick the event log, it doesn't matter if you do it on the local computer or navigate to a different computer in order to select the 'Security' event log.   The only thing we take away from the selection made within that dialog is the event log name – not the computer you picked the log from.  We took care of where the rule will become active by picking the target in the earlier dialog.
  • If you want to target a single machine / subset, best practice is to target it to something common to the machines you will want to target (such as windows computer / or even better windows 2012 computer / operating system) disable it by default when you create it, and then override enable for the individual instances or a group of instances.
  • Bear in mind Event IDs, sources, parameters etc. can differ between version, so you may need to create multiple rules with different parameters for different versions, targeted to the appropriate OS instance.
  • You can create either an event collection or an alert generating rule – an event collection rule will just collect the event and then event views need to be created in order to see them.  An alert-generating rule will create an alert from which an email notification can be configured.
  • The following links list Security Event Details for Events that occur when a given Security Scenario occurs.  This is useful for creating Security auditing style event-collection or alert-generating rules (or both): https://docs.microsoft.com/en-us/windows-server/identity/ad-ds/plan/appendix-l--events-to-monitor
  • Some of the most popular collected / monitored Event IDs from this list are as follows:
Event ID Event Summary
4625 An account failed to log on
4720 A user account was created
4722 A user account was enabled
4723 An attempt was made to reset an account's password
4728 A member was added to a security-enabled global group
4740 A user account was locked out
4756 A member wwas added to a security-enabled universal group
4767 A user account was unlocked
Steps to create the Alert generating Rule: 1) Launch the Operations Console 2) Click the 'Authoring' space on the bottom left hand side. 3) Right-click Management Pack Objects>Rules (you might need to left-click to expand management pack objects first) and choose 'Create a new rule' 4) In the dialog, expand Alert Generating Rules>Event based 5) Click NT Event Log (Alert) NOTE: A Golden rule of Operations Manager is to NOT store anything in the Default Management Pack. See this post for additional explanation and guidelines on MP best practice - https://blogs.technet.microsoft.com/antoni/2013/10/09/system-center-service-manager-operations-manager-management-pack-and-naming-convention-best-practices/ 6) Change the Management Pack from <Select Management Pack> to an appropriate Management Pack. If there is an MP where all the company's custom rules and monitors are stored (or even better an MP where the organization's AD or Auditing Rules / Monitors are stored) , then select it from the dropdown. If not Create a new Management Pack by clicking the New button, give it a name, hit Next and Create) 7) With Alert Generating Rules>Event Based>NT Event Log(Alert) and the appropriate Management Pack selected, click Next: 8) Give the rule a name (For Example: 'Contoso Alert generating Rule for User Added to Domain Admins 4728 Event') NOTE: It is best practice to use some form of prefix or three-letter acronym as a naming convention, to identify all of an organization's custom rules and monitors. This makes it much easier to find custom rules in the console when necessary. In this example, I am using 'Contoso' 9) Click the 'Select' button next to the Rule target box and choose an appropriate target such as 'Active Directory Domain Controller Server 2008 Computer Role' or 'Windows Domain Controller' and click OK. NOTE: Prior to creating the rule, you may wish to navigate to discovered inventory and change the target type to the class you plan on targeting, to verify that instances of that class exist, and are what you wish to target: NOTE: Because the 4728 event will only occur on domain controllers, it is appropriate to target the rule to the Active Directory domain controller Server 2008 Computer Role object. If the event could occur on any windows 2008 computer, use 'Windows Server 2008 Operating System' as your target. If it could occur on domain controllers of multiple versions (2008 and 2012), you could choose Windows Domain Controller. Best practice is to be as specific as possible, and to never target a group. NOTE: Start typing the name of the object desired in the 'Look For' box to narrow the list down, and If the object cannot be found, click the 'View all targets' radio button. NOTE: If you don't see the 'Active Directory' classes listed above, you probably do not have the Active Directory Management Pack imported, and therefore need to import it, in order for these classes to become available. Alternatively, the class 'Windows Domain Controller' is available out of the box and you could use that class. Just be aware that every windows domain controller will be monitored with this rule if it is enabled against that class. 10) Leave the default of 'Alert' as the Category, but uncheck 'Rule is enabled' and then click Next: NOTE: It is my preference to ALWAYS disable a custom rule / monitor by default and then enable it with an override (rather than using the checkbox in the General page shown above) as once we enable it with an override, this will ensure the custom rule / monitor is visible in my Authoring>Overrides view along with all my other rule / monitor / discovery (in Sealed and or Unsealed MPs) configuration changes. 11) In the Event Log Name, type the word Security, or alternatively, click the 3 dots and select the Security Event Log, and click Next. NOTE: This is nothing to do with the targeting. This is purely to make sure you get the name of the event log correct with no typos. The Rule will look in the selected event log on every object found for the class you selected to target (e.g. every windows computer or domain controller) that has the selected event log. 12) In the Value box to the right of Equals on the Event ID line, type 4728 NOTE: If you wish to monitor for a separate Event, simply specify the alternative Event ID here. 13) Click the grey cell next to Event Source (the second line) and click the Delete button in the UI 14) Click the Insert button (the main button not the drop-down section of it) and then click the 3 dots on the new line that appears 15) In the 'Select an Event Property' dialog' chose 'Specify event specific parameter to use' and change the value from 1 to 3 and click ok: 16) In the operator field on the second line choose Equals 17) In the value field on the 'Parameter 3' Line, type Domain Admins (Case-sensitive): NOTE: For monitoring users added to a group other than Domain Admins, simply type the Alternative Group name in place of Domain Admins. As well as Equals, other operators such as 'contains substring' or 'Matches Regular Expression' are available. Using a regular Expression, you could type a list separated by pipe symbols for example Domain Admins|Enterprise Admins|Really Secure Admin Group 18) Click next. 19) In Alert name either leave the rule name as the default (the rule name), or change this to a more meaningful string such as 'Contoso - User Added to Domain Admins' NOTE: the next 2 steps are optional. By default, only the contents of the event description will be displayed. Carrying out the optional step below will deliver a more meaningful phrase at the top of the alert description: Optional Step) In Alert description, click at the start of the box (before Event description) and type $Data/Params/Param[2]$ Was Added to $Data/Params/Param[3]$ and the result should look like this: $Data/Params/Param[2]$ Was Added to $Data/Params/Param[3]$ Event Description: $Data/EventDescription$ Optional Step 2) Click the Custom Alert Fields button and add a 'tag' such as Contoso Security Auditing and click Ok NOTE: If you had a series of security auditing rules you were creating, set them all up this way with the same custom field and then we can refer to this collection of rules easily for inclusion in a view and / or subscription, using this custom alert field as criteria. 20) Change the Priority and Severity if desired and click Create. 21 In the Authoring>Rules pane, find your rule using the 'look for' box: 22) Right click the rule as it appears under the class you targeted and choose to override for all objects of the class: NOTE: It is the same rule showing twice, because Active Directory DC and Global Catalog Server Role (Windows Server 2008 and above) is a type of 'Active Directory Domain Controller Server 2008 Computer Role (inherited from that) so also inherits the rule. 23) Check the checkbox in the 'Enabled' row, change the Override Value from False to true and click OK: NOTE: Before testing the rule by adding a user to Domain Admins, ensure that the series of 1200, 1201 and 1210 events is observed in the operations manager event log on the Windows Domain Controller that you are monitoring. NOTE: If you have followed these steps of creating the rule and then creating the override, you should see two series of 1200, 1201, 1210 events, one series for when a new version of the management pack containing the new rule (disabled by default) is received, and a second series for when it receives a newer version of the management pack containing the override that enables it. Note: the 1204s will appear if there was an existing previous version of the MP, that gets flushed prior to the import of this current version. Now, test the rule by adding a user to domain admins on the DC, and you should see a new alert appear in the Monitoring>Active Alerts view of the Operator's console: NOTE: Unless any matching subscriptions have been previously created that match the new alert, a notification email will not be sent out. In order to be notified by email when this happens, use the following steps in the section: https://aka.ms/scom101subscription NOTE: Any comments and feedback greatly appreciated if you found this post helpful or have any corrections / suggestions.  Cheers, Antoni]]> Operations Manager 101: How do I disable or tune something in Operations Manager? https://docs.microsoft.com/archive/blogs/antoni/operations-manager-101-how-do-i-disable-or-tune-something-in-operations-manager Sat, 03 Feb 2018 02:33:40 GMT https://blogs.technet.microsoft.com/antoni/?p=4875 https://aka.ms/101 All Configuration changes in Operations Manager (Enabling / Disabling / Tuning) are performed using overrides which are stored in unsealed management packs. In the example below, the 'E:' drive on Windows Computer 'SCOM' is showing as 'Warning' because the disk free space has reached the threshold set in the 'Windows 2012 Logical Disk Free Space Monitor' monitor: An alert is also visible both in the Active Alerts and Windows Server>Active Alerts views: Clicking the Alert Monitor hyperlink (red box in above screenshot) will take you to the Monitor / Rule properties: The one place where configuration changes (Enabling / Tuning / Configuration) are allowed, is in the Overrides tab of the rule / monitor properties: Clicking the Override button presents a number of options:
  • For the Object: (The configuration change will apply to the one object you accessed the monitor properties through (that the alert was raised for) – in this case the single 'E:' Disk on 'SCOM'
  • For all Objects of Class: This will override for every object that the Monitor is targeted to (in this case all Windows Server 2012 Logical Disks that Ops Mgr has discovered – i.e. all Servers with a Windows 2012 logical disk that have the Operations Manager agent installed
  • For a group: You can create a group of logical disks in the authoring space, and then select the group to create the override against.
  • For a specific Object of Class: Clicking this will give you a list of all Windows Server 2012 Logical Disks, and you can pick the one that you wish to create the override (configuration change) for.
  • For all objects of another Class (not for the faint-hearted J) – This option is very rarely used. It can however be useful where hosting relationships exist. For example as Windows Computer has a hosting relationship with logical disk (a computer hosts a disk, such that if the computer is deleted from SCOM, then the disk is also deleted) then you could use 'For all Objects of another class' to pick out a windows computer object. By doing this, the override will apply to all disks hosted by the computer selected for the override.
Once the scope of the override is selected, you will see the same following dialog, whichever object you selected: In this case, we will create an override to change the critical threshold from the default of 1000MB to 100 MB for non-system drives. If you want to disable the rule for the object selected, place a check next to the 'Error Mbytes Threshold for Non-System Drives' Parameter, change the Override Value to 100MB and then Change the Management Pack from something other than <Select Management Pack> NOTE: The golden rule of Ops Mgr configuration is to NEVER store anything in the default Management Pack. Best practice is to store the override in an unsealed Management Pack created for all Overrides for your particular technology's sealed MP. So in this case you would have a Contoso Windows Server 2012 Operating System Monitoring MP, and that would be the appropriate place to store your overrides. If such a Management Pack does not exist, you can easily create it in the above 'Override Properties' dialog, using the New button. Once applied, the effective value should reflect the overridden configuration: This change will be automatically sent to the agent, so that the logical disk space threshold for the one E: drive on this server is now the overridden value. Note that the other parameters above (like Enabled, alert priority, Alert Severity etc.) can all be overridden here also. The Management Pack Author determined what parameters are exposed as overridable, so the overrides dialog always shows the entire scope of what can be configured for a given rule or monitor. Note also that in most cases, the 'Enforced' parameter does not need to be set for the override to take effect. This is only used in scenarios where multiple overrides conflict, with an 'enforced' override taking precedence over those that are not enforced. The monitor properties (and the overrides tab) can also be accessed from the health explorer view that is accessed from a state view: Configuration changes (Overrides) can be viewed using the overrides view: NOTE Right-click the view and use the Personalize view to Group by 'Override Management Pack' or 'Override Target Management Pack' (or 'Override Management Pack', then by 'Override Target Management Pack' for an intuitive view: NOTE: Any comments and feedback greatly appreciated if you found this post helpful or have any corrections / suggestions.  Cheers, Antoni]]>