• sys.sysdercv
• sys.sysdesend
• sys.sysconvgroup

Incorrect:

PrincipalName	DomainDnsName	ForestDnsName	NetbiosDomainName
ComputerABC.redmond.corp.microsoft.com	redmond.corp.microsoft.com	corp.microsoft.com	redmond.corp.microsoft.com

The issue appears here

• Data Source: Microsoft.SystemCenter.WindowsComputerPropertyDiscovery
• Discovery: Microsoft.SystemCenter.DiscoverWindowsComputerProperties
• Management Pack: Microsoft.SystemCenter.Internal

Link to download management pack: UnsealedMP

• Is the number of 404's per second on a web server excessive?
  • I need to know that as a percentage of the total method requests per second
• Is a network adapter saturated?
  
  • I need to convert the Bytes/sec performance counters into Bits/sec and then divide by the bandwidth.
• Is a single process using too much CPU time on a server?
  
  • I need to divide the Process\% Processor Time counter by the number of logical cores in the machine (assuming the process is multi-threaded)
• Is a single process using too much memory on a server?
  
  • I need to divide the working set of the process into the server's physical memory
• Is the non-paged pool approaching its limit?
  
  • Okay, I'm dating myself to Windows 2003 here, but you get the idea.

So how do we deal with a situation where we need to monitor the health of a performance counter, but the information provided by that performance counter is not independently adequate to make a judgment?

In my Library MP I am providing

Two Probe Actions

1. Microsoft.PerfCounter.Two.Counters.Probe - This probe runs a PowerShell script that queries two performance counters and returns their values in a Property Bag.
2. Microsoft.PerfCounter.Create.PerfData.Probe - This probe runs a PowerShell script that divides two numbers, and multiplies the result by a third.  If any of the inputs are 0.0, it will return 0.0 without risking division by zero.

Two Data Sources

1. Microsoft.PerfCounter.One.Counter.Plus.Denominator.Perf.DS - This data source uses System.Performance.DataProvider from the System.Performance.Library to sample a single performance counter.  The results are then passed to Microsoft.PerfCounter.Create.PerfData.Probe.
2. Microsoft.PerfCounter.Two.Counters.Perf.DS - This data source uses a PowerShell script to query two performance counters.  The results are then passed to Microsoft.PerfCounter.Create.PerfData.Probe.

Six Monitor Types

1. Microsoft.PerfCounter.Math.One.AverageThreshold.MonitorType
2. Microsoft.PerfCounter.Math.One.ConsecutiveThreshold.MonitorType
3. Microsoft.PerfCounter.Math.One.SimpleThreshold.MonitorType
4. Microsoft.PerfCounter.Math.Two.AverageThreshold.MonitorType
5. Microsoft.PerfCounter.Math.Two.ConsecutiveThreshold.MonitorType
6. Microsoft.PerfCounter.Math.Two.SimpleThreshold.MonitorType

The monitor types are deliberately designed to closely match some types you will find in System.Performance.Library.

1. System.Performance.AverageThreshold
2. System.Performance.ConsecutiveSamplesThreshold
3. System.Performance.ThresholdMonitorType

CAUTION! - There are several things you should be aware of before using this Library.

1. Using either of the data sources will result in a PowerShell script being run that "does math."  Having a SCOM agent run a few scripts at a slow interval should not cause any problems.  But if you use a very short sampling interval and/or query a large number of performance counters you do risk impacting agent performance.
2. For sampling non-instantaneous type of performance counters Microsoft.PerfCounter.Two.Counters.Probe will sleep for three seconds to get two samples.  As with Caution #1, running a large number of scripts can impact the agent.  In addition to this, the data is only accurate during the three second window that the samples were taken.  If your performance counter has large, brief spikes they might get missed.
3. I do not allow you to use the "All Instances" feature of System.Performance.DataProvider and I do not allow the two counter probe to query all instances of a counter.

So what are some real-world examples of how this can be both safe and useful?  For your convenience I have included an example MP that implements these examples.  I have also included both sealed and unsealed copies of the Library.

1. Collect uptime in days - ((System()\System UpTime / 86400.0) * 1.0)
2. Collect the private bytes of a process as a percentage of the system commit limit - ((Process(TestLimit)\Private Bytes / Memory()\Commit Limit) * 100.0)
3. Alert when Network Adapter is more than 50% used - ((NetworkAdapter(<object property>)Bytes Received/sec / NetworkAdapter(<same object>)\Current Bandwidth) * 800.0)
4. Alert when a process us using more than 20% of total CPU on the system - ((Process(CPUStress)\% Processor Time / <Logical Cores>) * 1.0)
5. Alert when 404/sec > 50% of all web requests - ((Web Service(Default Web Site)\Not Found Errors/sec / Web Service(Default Web Site)\Total Method Requests/sec) * 100.0)

NOTE: You can get CPUStress and TestLimit here: https://live.sysinternals.com/Files

Microsoft.PerfCounter.Math.zip

The SCOM Operations Console provides a way to author TCP and HTTP(S) synthetic transactions.  But sometimes it is handy to be able to author these checks directly into a Management Pack.

Some common reasons to do this would be:

1. You need all members of a class to run the transaction.
2. Authoring Web Application and TCP Port monitors in the Operations Console requires that you explicitly pick agents and/or resource pools from which to run the test.  This means you must manually keep up with configuration churn.
3. You want to use object properties in the monitor configuration.
4. You want to put these monitors into MP's that can be shared or distributed across SCOM deployments.

To meet this need I have created two, very simple monitor types.

Microsoft.Extra.Synthetic.Transactions.TCP.Port.MonitorType

This monitor uses the existing Microsoft.SystemCenter.SyntheticTransactions.TCPPortCheckProbe probe found in the Microsoft.SystemCenter.SyntheticTransactions.Library.  You can read more about it on MSDN.  https://msdn.microsoft.com/en-us/library/jj130214.aspx

I just used a Simple Scheduler and a couple of Expression Filters to turn it into a monitor type.

The monitor takes three configuration settings.

1. Destination – the IP address or DNS name of the destination
2. TCPPort – The TCP port you want to check
3. IntervalSeconds – How frequently you want it to run

If you want to put its output into an Alert Description, you can do something like this:

• Server or IP Address: $Data/Context/DataItem/ServerName$
• TCP Port: $Data/Context/DataItem/Port$
• Connection Time: $Data/Context/DataItem/ConnectionTime$
• Status Code: $Data/Context/DataItem/StatusCode$

Microsoft.Extra.Synthetic.Transactions.Basic.URL.MonitorType

For this monitor type I did write a custom data source in PowerShell.  I could have used VBScript, but that would have prevented me from allowing the option to make the call, automatically using the credentials of the Run As user account, without needing to pass the user name and password as parameters.

These are the monitor type's configuration settings:

1. URL – The URL you want to test.  HTTP and HTTPS are both fine.
2. IntervalSeconds – How frequently you want it to run.
3. UseDefaultCredentials – false will make an ANONYMOUS request.  true will have it use the credentials of the SCOM Action Account.
4. Proxy – Leave it blank to not use a proxy server.  Otherwise fill it in.  You can use IPAddress:PORT or Hostname:PORT
5. CertThumbprint – Leave it blank to not use a client cert.  Otherwise give it the thumbprint of a cert installed in the Local Computer’s Personal certificate store.

The PowerShell script itself is nothing fancy.  I just create a [System.Net.HttpWebRequest] and then optionally set the UseDefaultCredentials, Proxy, and ClientCertificates properties if I need to.  You can read more about this on MSDN here: https://msdn.microsoft.com/en-us/library/system.net.httpwebrequest(v=vs.110).aspx

For your convenience I will place the PowerShell script in the ZIP file attached to this blog post so you can easily see it outside of the SCOM MP.  If you want to use the script outside of SCOM you will need to update the QuitTheScript to output something besides a SCOM property bag.

I am also including a sealed and unsealed copy of the library and an example MP that uses the library.  The example MP demonstrates some possible ways to use the monitor types and data that can be included in alert descriptions.

Extra.Synthetic.Transactions.zip

I was asked to look at a very large OperationsManager database.  One of the MT*_Log tables had over 53 million rows.  This lead me to a bug in one of SCOM's grooming stored procedures.

Background

Whenever you discover a class instance in SCOM it is added to the appropriate MT_ table, along with the discovered properties.  It is also added to the matching MT_Log table with all of the Pre columns set to NULL.  If the properties of a discovered class instance change the MT_ table is updated to reflect the current values and the MT_Log table for that class is updated with the Pre and Post columns for each property set to the old and new values.

When there are class instances with properties that do not change, or very rarely change, these MT*_Log tables are small, and tie back to the EntityChangeLog table.  Once an EntityChangeLogId is deleted from the EntityChangeLog table, any rows with the now deleted EntityChangeLogId may be deleted from the MT*_Log tables.

There is a stored procedure called [dbo].[p_GroomTypeSpecificLogTables] that loops through the MT*_Log tables and grooms them.

Problem

The [dbo].[p_GroomTypeSpecificLogTables] has a mistake.  The ASCII value for the "$" character is 36.  The ASCII value for the "_" character is 95.  This simple bit of TSQL will illustrate the problem.

IF ('A$B$C' > 'A$B_Log')
  PRINT 'Yes'
ELSE
  PRINT 'No'

IF ('A$D$C' > 'A$B_Log')
  PRINT 'Yes'
ELSE
  PRINT 'No'

I ran into this problem with the SQL Server 2012 Analysis Services Management Pack.  My MT_Microsoft$SQLServer$2012$AnalysisServices$MultidimensionalPartition_Log table is over 1.3 million rows.

If you run this query you see the MT_ tables for that MP

SELECT ManagedTypeTableName FROM ManagedType where ManagedTypeTableName LIKE 'MT_Microsoft$SQLServer$2012$Analysis%'

MT_Microsoft$SQLServer$2012$AnalysisServices
MT_Microsoft$SQLServer$2012$AnalysisServices$MultidimensionalPartition
MT_Microsoft$SQLServer$2012$AnalysisServices$PowerPivotInstance
MT_Microsoft$SQLServer$2012$AnalysisServices$TabularInstance
MT_Microsoft$SQLServer$2012$AnalysisServices$TabularDatabase
MT_Microsoft$SQLServer$2012$AnalysisServices$InstanceGroup
MT_Microsoft$SQLServer$2012$AnalysisServices$Seed
MT_Microsoft$SQLServer$2012$AnalysisServices$MultidimensionalInstance
MT_Microsoft$SQLServer$2012$AnalysisServices$MultidimensionalDatabase

But if you use the grooming stored procedures logic, after you groom the first log, you skip the rest of the managed type logs.  Try this:

SELECT * FROM ManagedType where ManagedTypeTableName LIKE 'MT_Microsoft$SQLServer$2012$Analysis%'
AND ManagedTypeTableName > 'MT_Microsoft$SQLServer$2012$AnalysisServices_Log'

Workaround

WARNING: Editing the SCOM DB by hand is not supported.  Do this at your own risk.  Microsoft does not officially suggest doing anything like this.  You get the idea...

If you script [dbo].[p_GroomTypeSpecificLogTables] as "Alter To" look at lines 73-78.  It should look like this:

-- Get next table to groom.
SELECT TOP 1 @TableName = MT.ManagedTypeTableName
FROM ManagedType MT
WHERE MT.ManagedTypeTableName IS NOT NULL
AND MT.ManagedTypeTableName > @LogTableName
ORDER BY MT.ManagedTypeTableName

The problem is @LogTableName ends with "_Log"  and the "_" character has an ASCII value higher than "$" and also higher than any capital letter.

If you alter line 77 of the stored procedure to use @TableName instead of @LogTableName, the MT_Log tables that were not groomed before will groom during the next scheduled run.

-- Get next table to groom.
SELECT TOP 1 @TableName = MT.ManagedTypeTableName
FROM ManagedType MT
WHERE MT.ManagedTypeTableName IS NOT NULL
AND MT.ManagedTypeTableName > @TableName
ORDER BY MT.ManagedTypeTableName

I recently needed to deploy the SCOM MP's for SQL SSAS for the first time.  They include monitors that validate the memory settings of SSAS to ensure that they don't conflict with the SQL Database Engine or the operating system.  However they don't include recovery tasks.  I'd prefer not to bother my DBA's with alerts that I can have SCOM auto-fix, so I set out to write Recovery Tasks for the SCOM Monitors.  Scripting against the SQL Database Engine is extensively documented, but I had trouble finding example scripts for SSAS.

So here's a script that changes SSAS's Low Memory Limit and Total Memory Limit settings.

[Reflection.Assembly]::LoadWithPartialName("Microsoft.AnalysisServices")
$myServer = New-Object Microsoft.AnalysisServices.Server
$myServer.connect("localhost")

$lml = $myServer.ServerProperties | WHERE {$_.Name -eq 'Memory\LowMemoryLimit'}
$tml = $myServer.ServerProperties | WHERE {$_.Name -eq 'Memory\TotalMemoryLimit'}

$lml.Value = 20
$tml.Value = 40

$myServer.Update()

Obviously I have no error handling here, and I hard-coded the connection string to "localhost" but I hope this serves as a basic example.

I tested the script on the following versions of SSAS.

1. 10.50.4319.0 (2008 R2)
2. 11.0.5058.0 (2012)
3. 12.0.2381.0 (2014)

For additional reading:

https://msdn.microsoft.com/en-us/library/microsoft.analysisservices.server.aspx

https://msdn.microsoft.com/en-us/library/ms174514.aspx

This MP requires version 1.1.42.0 or higher of the Windows Azure MP found here:

https://www.microsoft.com/en-us/download/details.aspx?id=38414

It will not work with the earlier Windows Azure MP version 6.1.7724.0 found here:

https://www.microsoft.com/en-us/download/details.aspx?id=11324

NOTE: You are on your own to turn Azure storage metrics on.  This MP will not turn them on for you.

For additional reading on the topic:

https://msdn.microsoft.com/en-us/library/hh343264.aspx

By default this MP will discover if Blob, Queue, and/or Table metrics are enabled on any if your Monitored Azure Storage services.  If metrics are enabled it will start collecting the following hourly metrics into the Ops DB and the Data Warehouse:

• Availability
• AverageE2ELatency
• AverageServerLatency
• PercentSuccess
• PercentThrottlingError
• ThrottlingError
• TotalEgress
• TotalIngress
• TotalRequests

In addition to that, it will alert if Availability drops below 98% and/or PercentThrottlingError rises above 1%.

There are views for state, script events, and performance.

If you have any questions, comments, or requests, feel free to run them by me.  I may add to this MP over time.

Microsoft.SystemCenter.WindowsAzure.StorageAnalyticsMetrics.xml

Here is the table schema if you need additional or different information.

https://msdn.microsoft.com/en-us/library/azure/hh343264.aspx

Please note that metrics are calculated when an aggregation period ends and are not available immediately.  If you run my script as-is, it will attempt to get blob metrics from the previous hour.  If you run it "early" in the hour, the data from the previous hour may not yet be ready.  You can comment out my filter line to get all data.

Please note that you are on your own to turn storage metrics on.  My script will not enable storage metrics for you.

##########################################################################
# Hard-coded Parameters
# Set $proxyAddr = '' if you don't need a proxy server
# Change $BlobOrQueueOrTable to 'Queue' or 'Table' if you like.
##########################################################################
$mgmtUri = 'https://management.core.windows.net'
$subId = '12345678-1234-1234-1234-123456789ABC'
$msApiVer = '2012-08-01'
$servName = 'asdfgh'
$tableEP = 'https://asdfgh.table.core.windows.net/'
$certPW = '<PFX Password>'
$certPath = 'C:\myCert.pfx'
$proxyAddr = 'https://proxy:80'

$HourOrMinute = 'Hour'
$PrimaryOrSecondary = 'Primary'
$BlobOrQueueOrTable = 'Blob'

##########################################################################
# Create a X509 Certificate from the byte array
##########################################################################
$flags = [System.Security.Cryptography.X509Certificates.X509KeyStorageFlags]"MachineKeySet"
$clientCert = New-Object -TypeName System.Security.Cryptography.X509Certificates.X509Certificate2 -ArgumentList $certPath, $certPW, $flags

##########################################################################
# Call the management service to get the storage keys
##########################################################################
$keysUri = $mgmtUri + '/' + $subId + '/services/storageservices/' + $servName + '/keys'
$mgmtWebRequest = [System.Net.HttpWebRequest]::Create($keysUri)
$mgmtWebRequest.Timeout = 15000
$mgmtWebRequest.ClientCertificates.Add($clientCert)
$mgmtWebRequest.Method = "GET"
$mgmtWebRequest.Headers.Add("x-ms-version", $msApiVer)
If ($proxyAddr -eq '')
{
  $mgmtWebRequest.Proxy = $null
}
Else
{
  $myWebProxy = New-Object System.Net.WebProxy($proxyAddr)
  $mgmtWebRequest.Proxy = $myWebProxy
}

##########################################################################
# Get the storage service keys from the response
##########################################################################
$response = $mgmtWebRequest.GetResponse()
$responseReader = New-Object System.IO.StreamReader($response.GetResponseStream())
[xml]$xmlResponseBody = $responseReader.ReadToEnd()
$responseReader.Close()
$primaryKey = $xmlResponseBody.StorageService.StorageServiceKeys.Primary

##########################################################################
# Create a hasher and seed it with the storage key
##########################################################################
$sharedKey = [System.Convert]::FromBase64String($primaryKey)
$myHasher = New-Object System.Security.Cryptography.HMACSHA256
$myHasher.Key = $sharedKey

##########################################################################
# Construct the Storage Analytics Metrics Table and URI
##########################################################################
$myInvariantCulture = New-Object System.Globalization.CultureInfo("")
$strTable = '$Metrics' + $HourOrMinute + $PrimaryOrSecondary + 'Transactions' + $BlobOrQueueOrTable
$strTableUri = $tableEP + $strTable

     
     
##########################################################################
# Get the current date/time and format it properly
# The culture "" is the invariant culture
##########################################################################
$myDateObj = Get-Date
$strDate = $myDateObj.ToUniversalTime().ToString("R", $myInvariantCulture)

##########################################################################
# This will get only the metrics from the previous hour.  Metrics are not
# available immediately when an hour ends.  If you want to change this
# try either subtracting more than 1 hour from the current time or
# removing the filter from the URI.  You can comment out the next two
# lines if you like.
##########################################################################
$strPartition = $myDateObj.AddHours(-1).ToUniversalTime().ToString("yyyyMMddTHH00")
$strTableUri = $strTableUri + '?$filter=PartitionKey%20eq%20''' + $strPartition + ''''

##########################################################################
# Preare the HttpWebRequest
##########################################################################
$tableWebRequest = [System.Net.HttpWebRequest]::Create($strTableUri)
$tableWebRequest.Timeout = 15000
$tableWebRequest.ContentType = "application/xml"
$tableWebRequest.Method = "GET"
$tableWebRequest.Headers.Add("x-ms-date", $strDate)
If ($proxyAddr -eq '')
{
  $tableWebRequest.Proxy = $null
}
Else
{
  $tableWebProxy = New-Object System.Net.WebProxy($proxyAddr)
  $tableWebRequest.Proxy = $tableWebProxy
}

##########################################################################
# Create the Authorization header
##########################################################################
$strToSign = $tableWebRequest.Method + "`n" `
           + $tableWebRequest.Headers.Get("Content-MD5") + "`n" `
           + $tableWebRequest.Headers.Get("Content-Type") + "`n" `
           + $tableWebRequest.Headers.Get("x-ms-date") + "`n" `
           + '/' + $servName + '/' + $strTable
$bytesToSign = [System.Text.Encoding]::UTF8.GetBytes($strToSign)
$strSignedStr = [System.Convert]::ToBase64String($myHasher.ComputeHash($bytesToSign))
$strAuthHeader = "SharedKey " + $servName + ":" + $strSignedStr
$tableWebRequest.Headers.Add("Authorization", $strAuthHeader)

##########################################################################
# Read the results
##########################################################################
$tableResponse = $tableWebRequest.GetResponse()
$tableResponseReader = New-Object System.IO.StreamReader($tableResponse.GetResponseStream())
[xml]$xmlMetricsData = $tableResponseReader.ReadToEnd()
$entries = $xmlMetricsData.feed.entry

Foreach ($entry in $entries)
{
  Write-Host 'Row Key:' $entry.content.properties.RowKey
  Write-Host 'Partition Key:' $entry.content.properties.PartitionKey
  Write-Host 'Total Requests:' $entry.content.properties.TotalRequests.innertext
  Write-Host 'Total Ingress:' $entry.content.properties.TotalIngress.innertext
  Write-Host 'Total Egress:' $entry.content.properties.TotalEgress.innertext
  Write-Host '---------------------'
}

$tableResponseReader.Close()

GetMetricsData.zip