Silvana Deac`s System Center Blog

[SCOM] AccessDeniedException SSRS SQL 2016

Silvana Deac — Thu, 01 Feb 2018 13:47:51 GMT

Hello! The following issue might happen when installing SCOM 2016 reporting on a SQL 2016 server and trying to access the SSRS report server URL with a non SCOM administrator user (but which has admin rights on SSRS level): "Could not load folder contents. You are not allowed to view this folder. Contact your administrator to obtain the necessary permissions" The reports however are viewable in the SCOM console so the AccessDeniedException occurs on SQL level only. This error will be fixed with SQL16 SP1 CU8.

[SCOM] Replication Groups Discovery causes event ID 10801

Silvana Deac — Wed, 31 Jan 2018 11:20:03 GMT

Hello again! You might be getting this discovery issue with both SCOM 2012(R2)/2016 regardless of UR with the latest Windows Server DFS Replication Management Pack. (v. 7.1.10100.1) 10801 event: Discovery data couldn't be inserted to the database. This could have happened because of one of the following reasons: - Discovery data is stale. The discovery data is generated by an MP recently deleted. - Database connectivity problems or database running out of space. - Discovery data received is not valid. The following details should help to further diagnose: DiscoveryId: c5f14a94-16dd-e9dd-7e2f-f97820b8bc18 HealthServiceId: GUID Microsoft.EnterpriseManagement.Common.DiscoveryDataInvalidClassPropertyValueException,The class property value specified in the discovery data item is not valid. The value needs to adhere to the class. Class property name: Microsoft.Windows.FileServer.DFSR.ReplicationGroupMember.MemberGUID Class property value: System Rule ID: c5f14a94-16dd-e9dd-7e2f-f97820b8bc18 Instance: GUIDFQDNGUIDGUIDGUIDSystem. This happens due to some formatting issues with the DFS group naming, if the name contains spaces this error might occur. We will release a fix for this in the next MP version, but if you encounter this error, make sure to open a support case if you want to receive a private fix.

[SCOM] Error 0x8007000e in alerts for windows service template

Silvana Deac — Wed, 17 Jan 2018 09:30:39 GMT

Hello all, If you see alerts that were generated by a windows service template based monitor for a uncommon instance type (like non windows computer) this article might apply to you. These type of alerts get generated almost hourly and have the following format: Error when calling service status Service: ServiceName Error: 0x8007000e Details: There is not enough memory to complete this operation At least one workflow is affected Workflow name: ServiceStateProbePage_GUID.DiscoveryRule Instance name: Here you will have an unhosted instance like SQL AG Listener Instanz-ID: {GUID} Management group: MG_Name The false positive alerts occur due to the design of the Windows Service discovery based on the template which targets all windows computers, not only ones hosted on agents. The discovery is also marked with remotable=true so the discovery runs also on agentless windows computer. As a workaround you can create an override which disables the discoveries sending out false positive and as a target select the instance which should not raise the alerts (for example SQL AG listener windows computer object). After this it is important to run the PowerShell-Cmdlet „Remove-SCOMDisabledClassInstance“ otherwise the change will not be applied.

SCOM 2016 Maintenance Schedule issues

Silvana Deac — Wed, 22 Nov 2017 15:14:39 GMT

Hi, With SCOM 2016 (+/-UR1) sometimes when trying to create a new maintenance mode schedule the following error is displayed: The EXECUTE permission was denied on the object 'sp_help_jobactivity', database 'msdb', schema 'dbo'. The data access service account might not have the required permissions As a workaround for this, we can grant this right. Please note that if the System Center Data Access service is running under local system , the permission will have to be granted for the computer account ( of all management servers)

use msdb go Grant Execute ON OBJECT::[dbo].[sp_help_jobactivity] To [domain\username]

Further, when proceeding with the creation of the MM schedule a further error appears: Microsoft.EnterpriseManagement.Common.ServerDisconnectedException: The client has been disconnected from the server. Please call ManagementGroup.Reconnect() to reestablish the connection. ---> System.ServiceModel.CommunicationObjectFaultedException: The communication object, System.ServiceModel.Channels.ServiceChannel, cannot be used for communication because it is in the Faulted state. Server stack trace: at System.ServiceModel.Channels.CommunicationObject.ThrowIfFaulted() at System.ServiceModel.Channels.ServiceChannel.Call(String action, Boolean oneway, ProxyOperationRuntime operation, Object[] ins, Object[] outs, TimeSpan timeout) at System.ServiceModel.Channels.ServiceChannelProxy.InvokeService(IMethodCallMessage methodCall, ProxyOperationRuntime operation) at System.ServiceModel.Channels.ServiceChannelProxy.Invoke(IMessage message) To solve this, grant the following rights for the SDK/DAS account(or if local system to the MS computer accounts) to the MSDB database:

SQLAgentOperatorRole
SQLAgentReaderRole
SQLAgentUserRole

What I saw is that if these rights are not added the error is not displayed if the SDK is running under a local system account, but will create a bulk of maintenance schedules and will cause a flood of data and SQL agent jobs. Trying to add/delete maintenance schedules from the SCOM console will just time out after this. It does not make a difference if powershell commandlets are used instead. So if a lot of "invalid" maintenance schedule entries and jobs are created, make sure the above rights are added for the MS computer account on the MSDB database. Also when creating a maintenance schedule and you select more then 216 target objects (instances or groups) the following error might occur: “The client has been disconnected from the server. Please call ManagementGroup.Reconnect() to reestablish the connection.” Workaround:

Create a single group or multiple groups with all the objects you would like to add in the maintenance schedule
Create a maintenance schedule with these groups (number of groups should be less than 216)

[OMS] Portal issues - HTTP Error 400

Silvana Deac — Tue, 12 Sep 2017 11:41:32 GMT

Hi, Sometimes the OMS portal seems to have various issues, so I will write about some that I encounter. For example "HTTP Error 400. The size of the request headers is too long" Usually this error happens if there is a corruption in the browser cache or cookies. What to try which usually solves the issue: clear the browser cache/cookies and browsing history : https://www.thewindowsclub.com/delete-browsing-history-cookies-data-edge Workarounds: -open browser in private mode (incognito) -test across other browsers

[OMS] 'Session Expired' even if the user is working in the OMS portal

Silvana Deac — Mon, 21 Nov 2016 10:50:50 GMT

Hello, Just a short post on an OMS issue. If you are working in the OMS portal and are getting despite of this a 'Session Expired' message, please make sure the user you are logged in with, is an administrator in the OMS portal (under Settings->Accounts->Manage Users). If the workspace is created from the Azure portal, it might be that the user is not part of this group. To be sure you don`t get this message, you should create the workspace directly from the OMS portal, this way the user is added automatically to the admin group.

[SM] Submitted service requests and incidents in the Portal enter a closed state

Silvana Deac — Wed, 09 Nov 2016 12:14:26 GMT

Hi, I wanted to write an article on the new SM HTML5 portal, because one of the issues it has is that submitted service requests and incidents in the Portal enter a closed state. This was fixed with UR2, however even after installing this fix custom states also are displayed with the closed states. So the portal does not know about the custom state and will set as a default state all SR or incidents like this. I made also a repro for this, so I will also post the steps on how I got to it, as a quick version: 1.create a custom SR status, save it into an MP, in this case CustomMPSts

2. use PS to update an SR status to a custom state (previously created)

# Get a specific Service Request $ServiceRequest = Get-SCSMObject -Class (Get-SCSMClass -Name System.WorkItem.ServiceRequest) -filter "ID -eq SR81" # Change the status of the Service Request to Completed Set-SCSMObject -SMObject $ServiceRequest -Property Status -Value "CustomMPSts"

3. See in the SM portal (with UR2) status is set to close:

Service Request type requests: https://localhost:444/MyRequests/RequestDetails?type=ServiceRequest&id=SR81

The closed status is set also for states like: completed, failed, on hold, cancelled. This is by design, but you can edit this in the portal.

The FIX: In order to change the way states are displayed, you will have to edit the web.config of the SM Self Service Portal Here is the official documentation for on how to achieve this: By default, the portal puts custom enumerations for My Request (incident & Service Requests) states in the Closed filter category. Now the portal allows for customization to map required custom states to the Active filter category also. For more details check for “CustomActiveRequestStatusEnumList” under “Basic Customization” section on this link. https://technet.microsoft.com/en-us/library/mt622142%28v=sc.12%29.aspx

Basic Customization The tab in the Web.config file offers some standard settings to easily customize and personalize the areas which are most often modified. Here’s a list of them

CustomActiveRequestStatusEnumList By default, the Self Service portal puts custom enumerations for My Request (incident and service requests) states in the Closed filter category. This key allows customization to map required custom states to the Active filter category. The value of this key should be a comma separated list containing EnumTypeName values of enumerations which are required to be mapped with the Active category in the Self Service Portal. You can look for desired custom states labeled EnumTypeName in the EnumType table, using the following example.

SELECT [EnumTypeName]

FROM [].[dbo].[EnumType]

So for the custom states to be displayed correctly, we have to get the corresponding EnumTypeName from the DB (or MP) and edit it in the web.config under the AppSetting, attribute: CustomActiveRequestStatusEnumList The EnumType has a form like Enum.e6afdb9a20aa4cdbabcd5ef24369f900[GUID], so you can search in the MP after this.

SCOM console crash FIX due to October security patches KB 3192392 is released!

Silvana Deac — Wed, 19 Oct 2016 12:20:50 GMT

Hi all, if you have problems with the SCOM console crashing (regardless of OS) after installing the October 2016 security patches and the following event logged in the Application event log on the affected computer, you will be looking for this fix. Faulting application name: Microsoft.EnterpriseManagement.Monitoring.Console.exe, version: 7.1.10226.1177, time stamp: 0x5697e092 Faulting module name: ntdll.dll, version: 6.3.9600.18438, time stamp: 0x57ae642e Exception code: 0xc0000374 Fault offset: 0x00000000000f1b70 Faulting process id: 0xfac Faulting application start time: 0x01d2254a42863351 Faulting application path: Faulting module path: C:\Windows\SYSTEM32\ntdll.dll Report Id: 8b9ab37a-913d-11e6-814d-005056882c6a The fix was released and you can get it here: https://support.microsoft.com/en-us/kb/3200006 Windows 10: https://support.microsoft.com/en-us/kb/3199125 Windows 10 Version 1511: https://support.microsoft.com/en-us/kb/3200068

[SCOM] Agent installation/upgrade Error 25211 Failed to install performance counters

Silvana Deac — Thu, 15 Sep 2016 11:38:49 GMT

If you have some servers where the SCOM Agent is either failing to install or get upgraded (with or without the NOAPM switch) with the following error: „Error 2511. Failed to install performance Counters.. Error Code -2147024809 (Wrong Parameters)" and in the installation log following error "InstallPerfCountersLib: InstallHealthServicePerfCounters() failed . Error Code: 0x80070057. " you might be having an issue with the SDDL. Apparently the SCOM installer checks the following registry key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Security\customsd If the value is corrupt or an SID is invalid (the account does not exist anymore) you might get this error.

[Orchestrator] Orchestration Console and Web Service are not working anymore

Silvana Deac — Thu, 11 Aug 2016 11:35:39 GMT

If you have the problem that the Orchestration Console and Web Service cannot be opened and the following error is logged:

The server encountered an error processing the request. The exception message is 'An error occurred while executing the command definition. See the inner exception for details.'. See server logs for more details. The exception stack trace is: System.Data.EntityClient.EntityCommandDefinition.ExecuteStoreCommands(EntityCommand entityCommand, CommandBehavior behavior)

at System.Data.EntityClient.EntityCommandDefinition.Execute(EntityCommand entityCommand, CommandBehavior behavior) at System.Data.EntityClient.EntityCommand.ExecuteReader(CommandBehavior behavior) at System.Data.EntityClient.EntityCommand.ExecuteScalar[T_Result](Func`2 resultSelector) at System.Data.Objects.ObjectContext.ExecuteFunction(String functionName, ObjectParameter[] parameters) at Microsoft.SystemCenter.Orchestrator.WebService.OrchestratorContext.OnContextCreated()

You might be missing some objects in the Orchestrator DB... exactly what will show up in a WCF Trace configured in the web.config of the web service. In one case, the following Service 'https://schemas.microsoft.com/SystemCenter/Orchestrator/Maintenance/MaintenanceService' and Queue [Microsoft.SystemCenter.Orchestrator.Maintenance].[MaintenanceServiceQueue] were missing from the Orchestrator DB, so a first check would be here. If not a quicker way to solve this issue would be a restore of the Orchestrator DB to a time prior to this error. The service and queue can be recreated manually by running the following queries on the Orchestrator DB:

MaintenanceServiceQueue

USE [Orchestrator] GO /****** Object: ServiceQueue [Microsoft.SystemCenter.Orchestrator.Maintenance].[MaintenanceServiceQueue] Script Date: 8/10/2016 7:19:31 AM ******/ CREATE QUEUE [Microsoft.SystemCenter.Orchestrator.Maintenance].[MaintenanceServiceQueue] WITH STATUS = ON , RETENTION = OFF , ACTIVATION ( STATUS = ON , PROCEDURE_NAME = [Microsoft.SystemCenter.Orchestrator.Maintenance].[MaintenanceWorker] , MAX_QUEUE_READERS = 1 , EXECUTE AS N'dbo' ), POISON_MESSAGE_HANDLING (STATUS = ON) ON [PRIMARY] GO
2. MaintenanceService USE [Orchestrator] GO /****** Object: BrokerService [https://schemas.microsoft.com/SystemCenter/Orchestrator/Maintenance/MaintenanceService] Script Date: 8/10/2016 7:20:22 AM ******/ CREATE SERVICE [https://schemas.microsoft.com/SystemCenter/Orchestrator/Maintenance/MaintenanceService] ON QUEUE [Microsoft.SystemCenter.Orchestrator.Maintenance].[MaintenanceServiceQueue] ([DEFAULT]) GO