Cross Platform ACS Architecture

How to Install Cross Platform ACS

1- Download System Center Operations Manager 2007 R2 Cross Platform Audit Collection Services

https://www.microsoft.com/en-us/download/details.aspx?id=1939

2- To install Cross Platform ACS

Download and Import the Cross Platform Audit Collection Services Management Packs

Cross Platform Audit Collection Services Management Packs for System Center Operations Manager 2007 R2

https://www.microsoft.com/en-us/download/details.aspx?displaylang=en&id=7302

After import the Management Packs:

Enable the ACS Endpoint Discovery for Unix Computers

Discovery Name:  Discover Unix/Linux ACS Endpoint

By default, Cross Platform ACS AIX rules are not enabled After importing the Cross Platform ACS AIX management pack, follow the steps in “Configure Syslog and Rules for Audit Edits” in “Audit Collection Services (ACS) Support for Cross Platform Operating Systems.”

How to Configure AIX Syslog

By default, the AIX platform does not log audit events. The logging configuration is controlled by the file located at /etc/syslog.conf.
Perform the following steps to enable logging of all event messages at the debug level or higher.

To enable the rules:

Scope the Console> Authoring to AIX 5.3 ACS Endpoint and AIX 6.1 ACS Endpoint

Override > Enable all the AIX 5.3 and AIX 6.1 ACS Collection Rules (10 Rules per version)

Check Discovered Inventory (ACS Endpoint)

How to Install Cross Platform ACS Reporting

To install Cross Platform ACS Reports

https://support.microsoft.com/kb/2690744

This describes the steps to troubleshoot or configure the SharePoint 2010 Management Pack for the following scenarios:

1. No Access to SharePoint Foundation 2010 and SharePoint Server 2010 Databases
2. Configuring the Run As Account Association
3. Unable to monitor multiple farms in local domain or remote domains
4. How to run the Configuration Task
5. Unable to run the "Configure SharePoint Management Pack" task in System Center 2012 Operations Manager
6. Unable to monitor SharePoint 2010 Databases
7. User Education - Isolating Discoveries
8. User Education - Sync Time Overrides
9. User Education - Adding Workflows to SharePoint Config file

_____________________________________________________________________________________ 

Troubleshooting gray agent states in System Center Operations Manager

https://support.microsoft.com/kb/2288515

This article describes how to troubleshoot problems in which an agent, a management server, or a gateway is unavailable or "grayed out" in System Center Operations Manager.

_____________________________________________________________________________________

Agent Health tips and fixes for System Center Operations Manager 2007

https://support.microsoft.com/kb/2616936

This article discusses tips on fixes and changes for Microsoft System Center Operations Manager 2007 (OpsMgr) Agent Health. This article discusses hotfixes and registry keys. Be aware that these hotfixes and registry keys may not be noticed in your environment directly but might be causing issues of which you are not aware. If you have an issue with agents that are in a gray state, these tips and fixes may help. However,

_____________________________________________________________________________________ 

When you try to install a System Center Operations Manager agent on a workgroup computer without using a  gateway server, Operations Manager cannot see  the workgroup computer

When you try to install a Microsoft System Center Operations Manager agent on a workgroup computer without using a gateway server, Operations Manager cannot see the workgroup computer.

    Additionally,  the following error message will be logged in the Operations Manager event log: 

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7024
Date: dd-mm-yyyy
Time: hh:mm:ss
User: N/A
Computer: [computername]
Description:
The OpsMgr Health Service service terminated with service-specific error 3 (0x3).

Store overrides in a separate management pack

For each management pack that you use in System Center Operations Manager, create an additional management pack in which to store overrides. For example, after you import the Active Directory management pack, create an Active Directory Override management pack. Then, store any overrides that you configure for the Active Directory management pack objects in the Active Directory Override management pack.

Do not use the Disable command in the Overrides menu to create an override to disable monitors, rules, or object discoveries

When you want to disable a management pack object, do not use the Disable the ObjectName command on the Overrides menu. Instead, click the Overrideoption to override the object. Then, follow these steps:

1. In the Override Properties dialog box, click to select the Override check box that corresponds to the Enabled parameter.
2. In the Override Setting column, click False.
3. In the Select destination management pack list, click the appropriate management pack in which to store the override.

Note This method lets you specify a management pack in which to create the override. However, if you click the Disable the ObjectNamecommand, System Center Operations Manager 2007 creates the override in the Default management pack. 

Configure overrides for groups instead of for specific instances

We recommend that you configure an override for a group instead of using an override to target a specific instance. Configuring overrides for groups allows for better manageability than what is available if you target a specific instance. To configure an override for a group,  follow these steps:

1. Create a group that has the following characteristics:
   • Create the group in the appropriate overrides management pack.
   • Configure the group to contain the particular instances or formulas that target the instances that you want to override.
   For example, create a group that is named AD DC 2003 Role. Then, manually put instances of the AD Domain Controller 2003 Role objects into the AD DC 2003 Role group.
2. Click the For a group command on the submenu of the Overrides menu.
3. In the Select Object dialog box that appears, click the new group that you created. 

Test overrides by using an override management pack and groups in a test environment

You can test overrides in one environment  and then apply the overrides  to another environment. For example, you can test an override in a test environment and then implement the override in a production environment. To do this, follow these steps:

1. Create the test groups in the appropriate override management pack.
2. Add the appropriate instances from the test environment to the test groups. You can explicitly specify the instances. Or, you can use a formula to specify the instances.
3. Perform sufficient testing to validate the override.
4. Export the particular management pack from the test environment.
5. Import the override management pack into the production environment.
6. Populate the groups that are contained in the override management pack by using the appropriate instances from the production environment.

You can use resource pools for:

• Monitoring network devices.
• Monitoring UNIX and Linux computers.

Resource pools ensure the continuity of monitoring by providing multiple management servers that can take on monitoring workflows if one of the management servers becomes unavailable. You can create resource pools for specific purposes. For example, you might create a resource pool of management servers that are located in the same geographic area to provide network device monitoring.

When Operations Manager is installed, three resource pools are created: All Management Servers Resource Pool, Notifications Resource Pool, and AD Assignment Resource Pool. All management servers are automatically members of these resource pools.

To create a resource pool

Modifying Resource Pool Membership

When you view the resource pools in the Administration workspace, you will see that resource pools that you create have a manual membership type and resource pools created when Operations Manager was installed have an automatic membership type, as shown in the following image.

By default, all management servers are members of the resource pools created when Operations Manager is installed, and any management servers added to the management group are automatically added to the resource pools that have an automatic membership type. You can remove individual management servers from those resource pools, however that will change the membership type to manual. If you add a management server to a management group after the membership type of the resource pools created when Operations Manager was installed is changed to manual, you must add the management server to the resource pool manually.

To remove a member from an automatic resource pool

1. Log on to the Operations console with an account that is a member of the Operations Manager Administrators role.
2. Click Administration.
3. In the navigation pane, click Resource Pools.
4. In the results pane, click the resource pool that you want to modify.
5. In the Tasks pane, click Manual Membership, and then click Yes in the Manual Membership message.
6. On the General Properties page for the resource pool, click Next.
7. On the Pool Membership page, click the management servers that you want to remove from the resource pool, click Remove, and then click Next.
8. On the Summary page, click Save.

You will receive warnings as the following:

Script or Executable Failed to run

The process started at 10:41:22 AM failed to create System.PropertyBagData, no errors detected in the output.  The process exited with 1

Command executed: "C:\WINDOWS\system32\cscript.exe" //nologo "C:\Program Files\System Center Operations Manager <version>\Health Service State\Monitoring Host Temporary Files 73\3456\ScriptName.vbs" 

Working Directory: C:\Program Files\System Center Operations Manager <version>\Health Service State\Monitoring Host Temporary Files 73\3456\

One or more workflows were affected by this.

Cause:

This problem occurs because some antivirus software blocks Visual Basic scripts or Java scripts.

Resolution:

To resolve this problem, verify that your antivirus software is not blocking scripts from running.

This is applied to

System Center Operations Manager 2007

System Center 2012: Operations Manager

Why?!

This issue occurs because Operations Manager uses management groups for the following purposes:

• To approve members of an Operations Manager user role to manage specified groups of objects
  
  For example, you can approve members of the Messaging Operators user roles to monitor objects in the Messaging group.

• To create views for specific groups of objects and to approve members of an Operations Manager user role to see the views
  
  For example, you can create a state view for the Messaging group and approve members of the Messaging Operators user role to see the Messaging view.

• To use overrides to disable or to adjust the configuration of a monitor that is applied to one or more managed objects.

To target your rule or monitor to the systems that you want to track, you must now use the correct class  that describes the objects that you want to monitor.

Workaround..

To work around this issue,   disable the rule or the monitor. Then,  create an override for a  group that enables the rule. To do this, follow these steps:

1. Make sure that the rule or the monitor is disabled.  To do this, click the General tab in the Properties dialog box for the rule or for the monitor in question. Then, make sure that the Rule is enabled check box is cleared.
2. Configure the rule or the monitor to target  the group that you want to use. To do this, follow these steps:
   1. In the Authoring pane in the Operations Console, locate the rule or the monitor.
   2. Right-click the rule or the monitor, point to Overrides, point to Override the Rule or to Override the Monitor, and then click For a group.
   3. Click the group that you want to use, and then click OK.
   4. Click to select the Override check  box, and then click True under Override Setting.

SCOM 2007 Troubleshooting Agents Deployment

While deploying the SCOM 2007 Agent, any deployment failure will be logged in Operations Manager eventlog with Event ID's starting with 106xx. The 106xx Events are NOT collected by default..

However, they are essential for Agent Deployment Troubleshooting so, we need to collect them "Of course prior to the deployment/update attempts"

Let's do it..

Create a Event Collection Rule  

1. Start the Operations Manager 2007 Create Rule Wizard.
2. On the Select a Rule Type page, do the following:
1. Expand Collection Rules, expand Event Based, and then click NT Event Log.
2. Select a Management pack from the list or click New to create a management pack with the Create a Management Pack Wizard.
3. Click Next.
3. On the Rule Name and Description page, do the following:
1. Type the Rule name, such as Troubleshooting SCOM Agents Deployment 106xx.
2. Click Select, click a target, such as Windows Computer, and then click OK.
3. Leave Rule is enabled selected to have the rule take affect at the completion of the wizard, or clear the check box to enable the rule at a later time, and then click Next.
4. On the Event Log Name page, leave Log name set to Operations Manager, or click the (…) button and select it, and then click Next.
5. On the Build Event Expression page, build the filter the rule will use to collect events:
1. Set Event Number matches wildcard to 106*
6. Finish

Agent Deployment Scenarios

• Deploy Agents using Discovery Wizard
• Approve Agents that require update after Deploying Cumulative Update
• Repair Agents
• Uninstall Agents

Reporting

1. Open Microsoft Generic Report Library
2. Custom Event
1. Filter by event ID > contains > 106
2. Select Event ID, Date, Logging Computer, Parameter 1 (Action), Parameter 2 (Agent Affected), Parameter 3 (User) , Parameter 4 (Error Code), Parameter 5 (Error Message)
3. Add Object (From Class Windows Computer > Select the RMS, MS's and Gateways)
3. Open File Menu > Publish > Agents Deployment Troubleshooting Report >>> You will find it under Authored Reports
4. Finaly Export the report to Excel.... and group them by Error

Then you can refer to the Agents Troubleshooting by compare the Error code in the following article:

Troubleshooting Issues When You Use the Discovery Wizard to Install an Agent

https://technet.microsoft.com/en-us/library/ff358634.aspx

Report sample:

1. On the Operations Console go to Reporting space
2. Microsoft Generic Report Library
3. Open Performance Report
4. Select Timeframe
5. On Objects Space Select Change
6. Create a Chart and a Series per Server
7. 
8. Folllow the Steps > Search by Counter > Select Performance Object > Select Counter > Search > and select the Rule that collect the required reporting data
9. 
10. Select first Series
11. Select the required "Windows Computer" from  "Add Group"
12. Repeat steps 9, 10 and 11 for each server you need to include in the Report
13. Run the Report
14. Finally Publish the Report to Authored Reports for future use (File | Publish | Rename the Report then Publish), you will find it in the Authored Reports

Enjoy your report..

Alert Description:

The Windows Event Log Provider is still unable to open the Microsoft-Windows-Dhcp-Server/Operational event log on computer 'ServerName.Domain'.
The Provider has been unable to open the Microsoft-Windows-Dhcp-Server/Operational event log for 5760 seconds.

Most recent error details: The system cannot find the file specified.

One or more workflows were affected by this.

Workflow name: Microsoft.Windows.2008R2.DHCP.Server.Monitor.ActivityLogging

Instance name: ServerName.Domain

Instance ID: {1C306FEA-3578-5DBE-DDCA-705B9393F80E}

Management group: ManagemenGroupName

Cause:

This is a incorrct discovey, the affected servers are not Windows Server 2008 R2 computers, mostly (in the cases I faced) Windows Server 2003 Computers,

Resolution:

Disable the Windows Server 2008 R2 DHCP Descovery for a group (Windows Server 2003 Computer Group)

1. Open the Operations Console | Monitoring 
2. Management Pack Objects
3. Object Discoveries
4. Find "Microsoft.Windows.2008R2.DHCP.Server.Discovery"
5. Right click the discovery Override for a group "Windows Server 2003 Computer Group" - Enabled false
6. From Operations Manager shell >> Remove-DisabledMonitoringObject

Couple of minutes and the warnings will disappear, you might need to restart the HealthService on the affected agents..