Create A Unit Monitor based on a EventID

Standard

In this blog post I am going to take you true the steps that I took to create a Unit Monitor.

A Unit Monitor measures aspects of an application. The monitor can be checking a performance counter tot determine the performance of an application, running a a script to perform a Synthetic transaction, or watch for an event that indicates an error or warning.

I’m going to create a unit monitor using the SMS-Passcode event log based on Unhealthy Event 150 (SMS-Passcode: Modem has been blacklisted and will not restart automatically anymore) and the Healthy Event 202 (SMS-Passcode: Modem Initialization successful (COM 3))

  1. Start the "System Center Operations Manager Console"
  2. In the "System Center Operations Manager Console", click the "Authoring"

    SelectAuthoring

  3. On the "Authoring" pane, expand "Authoring", expand "Management Pack Objects", and the select "Monitors"

    SelectMonitors

  4. In the "System Center Operations Manager console", in the "Tasks" pane click "Create a Monitor"

    CreateMonitor

  5. Select the "Unit Monitor"

    UnitMonitor

  6. On the "Create a unit Monitor" wizard, on the "Monitor Type" page in the section "Select the type of monitor to create", expand "Windows Events", "Simple Event Detection" and select "Windows Event Reset". On the section "Management Pack" on the page "Select a Monitor Type" click "New"

    NewManagementPack

  7. On the "Create a Management Pack" wizard, on the "General Properties" page in the section "Management Pack General Properties", give the management pack a "Name" and click "Next"
  8. On the "Create a Management Pack" wizard, on the "Knowledge" page click "Create"
  9. On the "Create a Unit Monitor" wizard, on the "Monitor Type" page click "Next"

    MonitorType

  10. On the "Create a Unit Monitor" wizard, on the "General" page, in the "General Properties" section, give the monitor a "Name" and on the "Monitor Target" line click "Select
  11. In the "Select Items to Target" wizard, select "Window Computer" and click "OK"

    WindowComputer

  12. On the "Create a Unit Monitor" wizard, on the "General" page, in the "General Properties" section, under "Parent monitor" select "Availability", uncheck "Monitor is enabled" and click "Next"

    GeneralMonitorProperties

  13. On the "Create a Unit Monitor" wizard, on the "Event Log (Unhealthy Event(" page, in the "Specify the event log to read the events from" section, click ""
  14. On the "Select Event Log" wizard in the section "Browse or enter computer name", select the computer you want to read the event log from
  15. On the "Select Event Log" wizard in the section "Available event logs", select "SMS Trans" and click "OK

    SelectEventLog

  16. On the "Create a Unit Monitor" wizard, on the "Event Log (Unhealthy Event(" page, click "Next"
  17. On the "Create a Unit Monitor" wizard, on the "Event Expression (Unhealthy Event)" page in the "Filter one or more events" section, behind the "Event ID" enter "150" and behind the "Event Source" enter "SMS Dispatcher and click "Next"

    EventExpressionUnhealthy

  18. On the "Create a Unit Monitor" wizard, on the "Event Log (Healthy Event(" page, in the "Specify the event log to read the events from" section, click ""
  19. On the "Select Event Log" wizard in the section "Browse or enter computer name", select the computer you want to read the event log from
  20. On the "Select Event Log" wizard in the section "Available event logs", select "SMS Trans" and click "OK

    SelectEventLog

  21. On the "Create a Unit Monitor" wizard, on the "Event Log (Healthy Event(" page, click "Next"
  22. On the "Create a Unit Monitor" wizard, on the "Event Expression (Healthy Event)" page in the "Filter one or more events" section, behind the "Event ID" enter "202" and behind the "Event Source" enter "SMS Dispatcher and click "Next"

    EventExpressionHealthy

  23. On the "Create a Unit Monitor" wizard, on the "Configure Health" page on the section "Map monitor conditions to health states" change the "First Event Raised" to "Critical" and click "Next"

    ConfigureHealth

  24. On the "Create a Unit Monitor" wizard, on the "Configure Alerts" page on the section "Alert Settings" and select "Generate alerts for this Monitor" and click "Create"

    ConfigureAlerts

Now that we have created the monitor it’s time to enable the Monitor.

  1. Start the "System Center Operations Manager Console"
  2. In the "System Center Operations Manager Console", click the "Authoring"
  3. On the "Authoring" pane, expand "Authoring", expand "Management Pack Objects", and the select "Monitors"
  4. On the "Monitors" pane, in the "Look for" input box type "sms"

    LookForSMSPasscode

  5. Select the "SMS PASSCODE Transmission" monitor, and from the "Tasks" pane click "Overrides", "Override the Monitor" and click "For al specific object of class: System Center Managed Computer (Server OS)"

    OverrideForSpecificObjectOfClass

  6. On the "Select Object" wizard, search for the computer that you have have SMS-Passcode installed on and click "OK"
  7. On the "Override Properties" wizard, in the "Override-controlled parameters" section, select "Enable" and change the "Override Value" to "True". Then click "OK".

    OverrideProperties

When the event 150 is raised You will get a warning in the Event-log on the client and in System Center Operations Manager an Alert is generated

AlertProperties

When the issue is resolved and event-id 202 is logged in the Event-Log in the the client. The generated Alert in System Center Operations Manager is Automaticaly closed.

Change the Grooming Settings of the SCOM Databases

Standard

In this blog post i ’am going to take you true the steps that are needed for changing the retention time of the databases that are used in System Center Operations Manager.

System Center Operations Manager 2012 makes use off the following Databases:

  • Operational Database (named: OperationsManager)
  • Data Warehouse Database (named: OperationsManagerDW)
  • ACS DataBase

Operational Database (Named: OperationsManager).

The Operational Database is a SQL Server Database that contains all configuration data for the management group  and stores all monitoring data that is collected and processed for the management group. The Operational database retains short-term data, by default 7 day’s.

The Operations Database needs 50% free space at all time. This for growth, and for re-indexing operations to complete successful. When the free space in the Operations Database is going below 40 % System Center Operations Manager will generate a Alert.

I prefer not to increase the the default off 7 day’s and reduce the performance Data and the Event Data to 4 or 5 day’s. When setting up your System Center Operations Manager environment I will set the Database Grooming settings to two day’s to just to reduce the noise that is generated during the setup, configuring and the import off Management Pack’s

Step’s I took to change the Performance Data and the Event Data:

  1. Start the "System Center Operations Manager Console
  2. In the "Operations Manager Console" click "Administration"
  3. In the "Navigation" pane expand "Administration and click "Settings
  4. In the "Settings" pane, right click "Database Grooming" and the click "Properties"
  5. In the "Global Management Group Setting – Database Grooming" dialog box, select "Performance Data", and click "Edit"

    DatabaseRetention

  6. In the "Performance Data" dialog box, specify "Older than" days, and the click "Ok". I changed the value into 4

    PerformanceData4Days

  7. Repeat step 5 and 6 for the "Event Data"
  8. In the "Global Management Group Setting – Database Grooming" dialog box, click "Apply" and click "Ok"

Know that we have changed the database grooming for the OperationsManager database time check if the grooming is working correct.

Grooming off the OperationsManager Database is done by the rule “Partition and Grooming” and runs  once a day at 0:00. The rule is targeted against to the “All management Servers Resource Pool” and is part of the System Center Internal Library. More information on the Partition and Grooming rule can be found here

To check if the Partition and Grooming rule is working you can run the following SQL query:

select * from InternalJobHistory order by InternalJobHistoryId

The Result should look something like this:

SQLQueryResult

Data Warehouse Database (named: OperationsManagerDW)

The data warehouse database is a SQL Server database that stores monitoring and alerting data for historical purposes. Data that is written to the Operations Manager database is also written to the data warehouse database, so reports always contain current data. The data warehouse retains long-term data.

Different data are kept in the data warehouse in unique “Datasets”. A dataset is a set of tables and stored procedures. System Center Operations Managed datasets are used to store historical data. The default dataset consist of the following sets out of the box:

  • Performance Data set
  • State data set
  • Event data set
  • APM data set
  • Alert data set
  • Client Monitoring data set

To get the data sets that are available in your System Center Operations Manager Environment:

select * from Dataset 

The result should look something like this:

selectfromDataset

The most common datasets that we will aggregate are the Performance data set, State data set and Client monitoring data set. We have raw, hourly and daily aggregations.

When you have a default installations of System Center Operations Manager 2012 the data is stored by type, and the ranges from 10 to 400 day’s depending on the data. You can see the grooming setting’s of the OperatinsManagerDW database using the following SQL command:

<pre class="lang:default decode:true " >USE OperationsManagerDW
SELECT AggregationIntervalDurationMinutes, BuildAggregationStoredProcedureName, GroomStoredProcedureName, MaxDataAgeDays, GroomingIntervalMinutes, MaxRowsToGroom FROM StandardDatasetAggregation</pre> 

The result should look something like this:

GroomingConfiguration

Let’s change the the “EventGroome” Stored procedure from “100”  age days to “50” day’s

Use OperationsManagerDW
Update StandardDatasetAggregation set MaxDataAgeDays = 40 where GroomStoredProcedureName = 'EventGroom' 

To check if the change is applied run the following sql-query:

USE OperationsManagerDW
SELECT AggregationIntervalDurationMinutes, BuildAggregationStoredProcedureName, GroomStoredProcedureName, MaxDataAgeDays, GroomingIntervalMinutes, MaxRowsToGroom FROM StandardDatasetAggregation where GroomStoredProcedureName = 'EventGroom'

CheckEventGroomStatus

If you want to change other stored procedures you can download the following Script

ACS Database

When installing ACS into your environment you during the installation process you can set the “Number of days an event is retained in database”. The default configuration is 14 days.

ACSRentetionDefault

You can change the Data Retention using the following SQL Query:

USE OperationsManagerAC
UPDATE dtConfig SET Value = number of days to retain data + 1 WHERE Id = 6

More information on grooming can be found here:

Installing Update Rollup 8 SCOM 2012 Sp1

Standard

In this blog post I will take you true the steps of installing System Center Operations Manager 2012 Sp1 update Rollup 7 to Update Rollup 8

The following issues are fixed in this Update

  • The Health Service bouncing that is caused by high memory usage in the MonitoringHost process.
  • This update includes a fix to prevent resynchronization of all managed entities from the Operations Manager to the Operations Manager Data Warehouse (OMDW) database and to prevent the failure to sync that this causes because of duplicate entries.
  • The import of Visualization.component.library and Visualization.library binary files (.mpb) fails. The import succeeds on a successive try.
  • System Center Operations Manager agents randomly time out when authenticating to the Gateway or Management Server because of domain controller or network performance issues. The time-out value was set to 1 second earlier. A fix was made to increase server time out to-20 seconds and client time out to 5 minutes.

You can download the Update Rollup 8 form here

The following steps outline the process of installing the Update

  1. Backup the operations Manager Databases and unsealed Management Pack’s
  2. Install Update to the Management server
  3. Install update to the secondary Management Servers
  4. Install update to the gateway servers
  5. Install update to the ACS servers
  6. Install Update to the Web Console
  7. Install Update to the Operations Manager Console
  8. Run the SQL scripts
  9. Import Management Pack’s
  10. Deploy the update to the agents

1. Backup the operations Manager Databases and unsealed Management Pack’s

I did a manual backup from my databases using the SQL Console

  1. Start the "SQL Server Management Studio"
  2. Connect to the Database server
  3. Right click on the database that you want to backup, select "Tasks" and click "Backup

    BackupDatabase

  4. On the "Backup Database Select the setting that you want to use and click "Ok

    BackupRunning

  5. When the Backup is completed click "Ok
  6. Repeat the steps Above for all the databases

You can backup your management pack’s using the powershell Operations Manager shell and type the following command:

Get-SCManagementPack | Export-SCManagementPack -path D:\Backup\MP

backupMP

2. Install Update to the Management server

  1. Extract the cabinet file
  2. Start a "elevated powershell command prompt"
  3. Run the "KB2991997-AMD64-Server.msp"

    UpdateManagementServer

  4. Installation is running. This can take some time.

    UpdateManagementServerRunning

  5. On the Dialog Screen "System Center Operations Manager 2012" klik "Yes" to restart the server

    UpdateManagementServerRestart

3. Install update to the secondary Management Servers

I installed the update the same way is installed it on the Management Server. So follow Step 2

4. Install update to the gateway servers

  1. Extract the cabinet file
  2. Start a "elevated powershell command prompt"
  3. Run the "KB2991997-AMD64-Gateway.msp"

    UpdateGatewayServer

  4. The update doesn’t give any feedback. Check the application event-viewer if the setup is finished.

5. Install update to the ACS servers

  1. Extract the cabinet file
  2. Start a "elevated powershell command prompt"
  3. Run the "KB2991997-AMD64-ENU-ACS.msp"

    UpdateACS

  4. The update doesn’t give any feedback. Check the application event-viewer if the setup is finished.

6. Install Update to the Web Console

  1. Extract the cabinet file
  2. Start a "elevated powershell command prompt"
  3. Run the "KB2991997-AMD64-ENU-WebConsole.msp"

    UpdateConsole

  4. Installation is running. This can take some time.

    UpdateWebConsoleRunning

  5. The update doesn’t give any feedback. Check the application event-viewer if the setup is finished.

7. Install Update to the Operations Manager Console

  1. If you don’t want to reopen the System Center Operations Manager Console close the
  2. Extract the cabinet file
  3. Start a "elevated Powershell command prompt"
  4. Run the "KB2991997-AMD64-ENU-Console.msp"

    UpdateConsole

  5. Installation is running. This can take some time.

    UpdateConsoleRunning

 

8. Run the SQL scripts

  1. Start the "SQL Server Management Studio"
  2. Connect to the Database server and select the “OperationsManagerDW" Database

    SelectOperationManagerDW

  3. On the File menu, click Open, browse to D:\Program Files\System Center 2012\Operations Manager\Server\SQL Script for Update Roll ups , select the "UR_Datawarehouse.SQL" file and then click Open.
  4. When the file is loaded, click "Execute" in the SQL Editor tool bar
  5. Your Result should look something like:

    RowsAffected

Next we need to run the following script against the OperationsManager database

  1. Start the "SQL Server Management Studio"
  2. Connect to the Database server and select the “OperationsManager" Database

    SelectOperationManager

  3. On the File menu, click Open, browse to D:\Program Files\System Center 2012\Operations Manager\Server\SQL Script for Update Roll ups , select the "update_rollup_mom_db" file and then click Open.
  4. When the file is loaded, click "Execute" in the SQL Editor tool bar
  5. Your Result should look something like:

    RowsAffected3

9. Import the management Pack

  1. Start the System Center Operations Manager Console and select the "Administration pane"
  2. Right click "Management Pack" and click "Import Management Packs…"
  3. In the "Import Management Packs" and click "Add" and click "Add from Disk…"
  4. Browse to "D:\Program Files\System Center 2012\Operations Manager\Server\Management Packs for Update Rollups" and select the management Pack’s in that folder
    • Microsoft.SystemCenter.AlertAttachment.mpb
    • Microsoft.SystemCenter.IntelliTraceProfiling.mpb
      • Microsoft.SystemCenter.IntelliTraceCollectorInstallation.mpb which should be installed from SCOM 2012 SP1
      • MediaMicrosoft.Windows.InternetInformationServices.Common.mpb which should be installed from the online catalog
    • Microsoft.SystemCenter.Visualization.Library.mpb
    • Microsoft.SystemCenter.Image.Library.mp
    • Microsoft.SystemCenter.Advisor.Internal.mpb
    • Microsoft.SystemCenter.Apm.Infrastructure.Monitoring.mp
    • Microsoft.SystemCenter.Apm.Infrastructure.mpb
    • Microsoft.SystemCenter.Apm.Library.mpb
    • Microsoft.SystemCenter.DataWarehouse.Report.Library.mp p
    • Microsoft.SystemCenter.DataWarehouse.Reports.mp
    • Microsoft.SystemCenter.DataWarehouse.ServiceLevel.Report.Library.mp
    • Microsoft.SystemCenter.TFSWISynchronization.mpb
    • Microsoft.SystemCenter.Visualization.Component.Library.mpb
  5. Click "Install"

    UpdateManagementPacks

  6. Click "Close"

10. Deploy the update to the agents

  1. Start the System Center Operations Manager Console and select the "Administration pane"
  2. Select " Device Management" and then "Pending Management"
  3. Select the a "Agent" and click "Approve"

    Aprove

  4. On the "Agent Update" page click "Update"

    Update

  5. when you open de the "Agent by Version" you should see something like this:

    Ready

More information on installing Update Rollup 8 for System Center Operations Manager 2012 sp1 can be found here. To install this Update Rollup 8 I used the deployment plan from Kevin Holman