• • 1. Import the latest Linux Management pack.
    2. Administration pane à Device Management à UNIX/Linux Computers à Right Click à Choose Discovery Wizard.
    3. Choose UNIX/Linux Computers à Next
    4. Add Discovery Criteria à Enter the IP of the Linux Server under Discover Scope and the SSH Port; Discovery Type à All Computers; Credentials à either choose the configured Runa's credentials or click “Set Credentials” and set the credentials (both User name and password or SSH key) à Click Ok; Save the Discovery Criteria.
    5. Select target resource pool à click Discover
    6. Select the Linux Server that was discovered under “Manageable computers” à Click Manage.

• To install the Red Hat Enterprise package, type: sh ./omsagent-<version>.rhel.<version>.<arch>.sh --install --enable-OpsMgr

• If there are existing certificates on the system, they are reused during agent installation. New certificates are not created. Certificates are not automatically deleted when you uninstall an agent. You must manually delete the certificates that are listed in the folder /etc/opt/microsoft/scx/ssl for UNIX and /etc/opt/microsoft/omsagent/scom/certs folder for Linux. To regenerate the certificates at install, you must remove this folder before agent installation.

• On the computer that is running the UNIX or Linux operating system, locate the file /etc/opt/microsoft/scx/ssl/scx-host-<hostname>.pem and securely copy or transfer it to any location on the computer that is hosting Operations Manager.

• On the computer that is hosting Operations Manager, on the Windows desktop, click Start, and then click Run.

• In the Run dialog box, type cmd, and then press Enter.

• Change directories to the location where you copied the pem file.

• Type the command scxcertconfig -sign scx-host-<hostname>.pem scx_new.pem, and then press Enter. This command will self-sign your certificate (scx-host-<hostname>.pem) and then save the new certificate (scx-host-<hostname>_new.pem). Securely copy or transfer the scx_new.pem file into the /etc/opt/microsoft/scx/ssl folder on the computer that is hosting the UNIX or Linux operating system. This replaces the original scx-host-<hostname>.pem file.

• Restart the agent by typing scxadmin –restart.

but Jonathan explains how to write this rule by MP Authoring tool, I will show you how to create this rule by using Visual Studio Authoring Extension:

first you need to download the VSAE : https://www.microsoft.com/en-us/download/details.aspx?id=30169

# Create New Project

# Select SCOM Version

# Create New Folder

# Rule (Custom)

# Select the Rule, in right side look on the following options: Data Source / Condition Detection / Write Action

# Data Source ... Select "TimedScript.PropertyBag"

# In Data Source Configuration, write the Script, and click OK

# First Select Target Class, In Condition Detection Type ID, Select System.ExpressionFilter

# Condition Detection Configuration, Config the Property Bag Output

# Write Action ... Select GenerateAlert TypeID

# Data Source Configuration ...

# Build Solution

# Management Pack file location

# in Solution folder - bin\debug, copy XML file, and Import it to SCOM

Implementation by creating - Custom Rule that contains Data Source to running the script in every X time, and Condition (in this example the condition every time will be true) and Write Action to Alerts with Property bag content

Data Source -"Windows!Microsoft.Windows.TimedScript.PropertyBagProvider":

-<DataSource ID="DS" TypeID="Windows!Microsoft.Windows.TimedScript.PropertyBagProvider">

<IntervalSeconds>120</IntervalSeconds>

<SyncTime/>

<ScriptName>log.vbs</ScriptName>

<Arguments/>

<ScriptBody> Option Explicit Dim oAPI,oBag,sMyScriptValue, shell Set oAPI=CreateObject("MOM.ScriptAPI") Set oBag=oAPI.CreatePropertyBag() sMyScriptValue="AlertCondition" Set shell=CreateObject("WScript.Shell") shell.LogEvent 4,"start the script" Call oBag.AddValue("MyScriptPropertyName",sMyScriptValue) Call oAPI.Return(oBag) </ScriptBody>

<TimeoutSeconds>60</TimeoutSeconds>

</DataSource>

Condition Detection - "System!System.ExpressionFilter":

-<ConditionDetection ID="CD" TypeID="System!System.ExpressionFilter">

-<Expression>

-<SimpleExpression>

-<ValueExpression>

<XPathQuery Type="String">Property[@Name='MyScriptPropertyName']</XPathQuery>

</ValueExpression>

<Operator>Equal</Operator>

-<ValueExpression>

<Value Type="String">AlertCondition</Value>

</ValueExpression>

</SimpleExpression>

</Expression>

</ConditionDetection>

Write Action - "Health!System.Health.GenerateAlert":

-<WriteAction Target="Windows!Microsoft.Windows.Computer" ID="WA" TypeID="Health!System.Health.GenerateAlert">

<Priority>2</Priority>

<Severity>2</Severity>

<AlertMessageId>$MPElement[Name="AlertMessageID81358ed3f16a45f58dfba92b78c5658b"]$</AlertMessageId>

-<AlertParameters>

<AlertParameter1>$Data/Property[@Name='MyScriptPropertyName']$</AlertParameter1>

</AlertParameters>

</WriteAction>

ScriptandAlert.xml

[Kevin Holman write post "step by step update" - https://blogs.technet.com/b/kevinholman/archive/2016/01/12/ur8-for-scom-2012-r2-step-by-step.aspx ]

After you finish to running the updates for all server roles, all agents that installed remotely or configure 'remotely managed = true' in DB' are enter to Pending management and waiting that you push the Update Rollup to agents remotely.

Agents that installed locally because you cannot open the entire desired ports, you must to transfer the update msp file, and running it locally on agents.

In this post you learn how to push this update automatically [without distribution software like SCCM] by using SCOM rule and file share that all servers have access to it.

1. Extract the msp file from Agent Update Rollup folder to folder in file share.

2. Create new rule that "execute a script": Config schedule and write VB script:

Uncheck 'Rule is enabled'

Configure your schedule

Write this script, in <> insert the path of the 'file share' that all servers can access it.

Script: ________________________________________________

Dim Wshshell, WshProcEnv, System_Architecture, Process_Architecture

Set WshSehll = Wscript.CreateObject("WScript.Shell")

Set WshProcEnv = WshSehll.Environment("Process")

Process_Architecture = WshProcEnv("Processor_Architecture")

if Process_Architecture = "x86" then

const Event_Success = 0

Wshshell.LogEvent Event_Success, "Start UR for x86 Processor_Architecture"

WshShell.Run "Msiexec.exe /Update "i386-Agent.msp"

else

Wshshell.LogEvent Event_Success, "Start UR for 64 bit Processor_Architecture"

WshShell.Run "Msiexec.exe /Update "AMD64-Agent.msp"

End if

_______________________________________________________

And select Create.

 3. Create dynamic group for Override the filter is: select Agent class and add condition "Path List – Does not match - *UR<Number of this update rollup>*"

Select Agent class, and 'Add', the condition is "Where Patch List Does not match wildcard *UR<X>*"

This group include only the agents the Last update rollup does not installed.

Patch List property - under Operations Manager folder in Agent by Version view

4. Find the rule that you create in section 2 and override on this group.

5. Because the agent's service run on Local system and LS don't have permissions to running installation from share, you need to create run as profile with account that have permissions, and configure this rule to running with this profile.

Now in the next interval the script run locally on every agent that does not update and after the update installed, agent out automatically from group and the script don't running on it again.

you have to monitor SQL database value using Unit Monitor / timed script, by VB Script and return the value to property bag, but the result is Misinformation.

for example: Monitoring Specific runbook status from Orchestrator Database, Policies table, column Published, show the runbook status, value '0' Meaning Runbook stopped.

Dim objCN, strConnection
Dim objAPI, oBag

Set objCN = CreateObject("ADODB.Connection")
Set objAPI = CreateObject("MOM.ScriptAPI")
Set oBag = objAPI.CreatePropertyBag()


strConnection = "Driver={SQL Server};Server=<SQL Server Name>;Database=Orchestrator;Trusted_Connection=TRUE"
objCN.Open strConnection

Dim strSQLQuery
strSQLQuery = "Select Published FROM [Orchestartor].[dbo].[Policies] where name = 'Runbook Name'"

Dim objRS
Set objRS=CreateObject("ADODB.Recordset")

Set objRS = objCN.Execute(strSQLQuery)

Do Until objRS.EOF
                'WScript.Echo objRS.Fields("Published")
                if objRS.Fields("Published") = "0" then
                                                                
                                 Call oBag.AddValue("State","BAD")
                                Call objAPI.Return(oBag)
                else
                                Call oBag.AddValue("State","GOOD")
                                Call objAPI.Return(oBag)
                end if
                objRS.MoveNext
Loop

objRS.Close

The runbook that selected in script status is running [1] but the result of script is '-1' and not 1

Couse:

The reason for that is, because the type of column is 'bit' not 'int', so in INT type if condition are work not in bit type.

Resolution:

Change the query to casting the result from bit type to INT, 

With Casting: "Select cast(Published AS INT) AS Published FROM [Orchestartor].[dbo].[Policies] where name = 'Runbook Name'"

the result of query now is:

Select the Script with casting inside the query and build the Monitor and the result will be correct..

workflow like rule must contain Data Source and Write Action (Condition Detection is optional)

In this MP I Config the Data Source - the timer and the write action - the Powershell Script, [in VB Script rule this is the same but with difference write action type]

-<Rule DiscardLevel="100" Priority="Normal" Remotable="true" ConfirmDelivery="false" Target="SystemCenter!Microsoft.SystemCenter.RootManagementServer" Enabled="true" ID="MomUIGeneratedRule938ff2117e8d4821b14d1a6be24b60a4">

<Category>Custom</Category>

<DataSources>

<DataSource ID="Scheduler" TypeID="System!System.Scheduler">

<Scheduler>

<WeeklySchedule>

<Windows>

<Daily>

<Start>00:00</Start>

<End>00:00</End>

<DaysOfWeekMask>6</DaysOfWeekMask>

</Daily>

</Windows>

</WeeklySchedule>

<ExcludeDates/>

</Scheduler>

</DataSource>

</DataSources>

<WriteActions>

<WriteAction ID="ExecuteScript" TypeID="Windows!Microsoft.Windows.PowerShellPropertyBagWriteAction">

<ScriptName>Rule.ps1</ScriptName>

<ScriptBody> Write-eventlog -logname 'operations manager' -Source 'Health Service Script' -EventId 123 -EntryType error -Message "test alert" </ScriptBody>

<TimeoutSeconds>60</TimeoutSeconds>

</WriteAction>

</WriteActions>

</Rule>

</Rules>

The full MP are Attached

Change the Script to your requirement and import the MP than navigate to Console > Authoring > rules >

you can edit the time schedule:

and look or edit the script:

Note! the Target now is Root Management Server, you can change the target depending on your needs

for example: to target on All Windows Server, change the target to Windows!Microsoft.Windows.Server.Computer and so on.

RuleScript.xml

In Discover Inventory under Monitoring tab, you can see that on group didn't have State, that because group was not inherited the monitors from is members

to configure state that depend on members status [Useful in dashboards], you need to create Dependency monitor

Configure Dependency Monitor on a group membership [choice the second]

as you can see the Group now get the State from is Member

Indeed ongoing work properly and delivered messages, but when doing Restart to the server, the Runbooks work with the SCOM and use its Activities are aborted, and you must to run them manually.

The explanation for this is, because during the startup of the server , the service of the Orchestrator 'Orchestrator Runbook Service' rising along with the services of the SCOM, and boot the Runbooks performed before carried out Connectoin to DB of the SCOM then the Monitor Alert Activity for example, is trying to communicate to the SCOM and get the answer Aborted,

You can see this by making Stopping to Services - Data Access and Runbook Service and make a start only for the Runbook Service when approached to Runbook Designer view of processes related to SCOM arrested,
In fact the simplest solution that can be done by setting Dependencies on the Runbook Service in SCOM Services. And thus will initially Start of Data Access,
In practice since Operation Start to Data Access and immediately afterwards start to Runbook Service without waiting to perform the actual Connection, still received Aborted after restart.

Therefore need to make a distinction between the Orchestrator and the SCOM server for each application.
A temporary solution that can be done is:
Manage Startup Services server by script, and because when the service is in Automatic mode is immediately rises during the Boot, define a script to move it during the Shutdown to Manual mode, and in startup setting the order of the start of the Services includes waiting twenty seconds of booting the Services of SCOM in the boot of the orchestartor Services to have enough time to create a Connection to DB, and back the Services to Automatic mode.

this can be done by using group policy in computer settings running Script in Startup and Shutdown:

# for Shutdown Script create batch file with Commands to change the services mode to manual in Shutdown process:

sc config "OMSDK" start=Demand

sc config "cshost" start=Demand

sc config "Healthservice" start=Demand

sc config "orunbook" start=Demand

# for Startup Script create batch file with the commands for Startup process to order the services starting, and change the Mode to Automatic

sc start OMSDK

sc start cshost

sc start healthservice

timeout 20

sc start orunbook

sc config "OMSDK" start=Demand

sc config "cshost" start=Demand

sc config "Healthservice" start=Demand

sc config "orunbook" start=Demand

then after restart the server, the runbooks continue to running.