The System Center Operations Manager Support Team Blog

The System Center Operations Manager blog has moved!

2012-02-14T17:41:00Z

With the impending release of System Center 2012 Operations Manager, we thought now would be the perfect time to consolidate our blog properties and give you a single, concise gateway into the world of all that is Operations Manager. No longer will we have one blog by the product team and another by product support, but now we’ll have a single blog where everyone involved with developing, deploying, using and supporting Operations Manager can come together and contribute. We’re hoping that this will make it easier for you to find all the information you need, all from a single source.

So what does this mean to you? Starting today we will no long be publishing new articles to http://blogs.technet.com/b/operationsmgr. All of the existing articles will remain right where they’ve always been, but new content will instead be posted to our Operations Manager team blog at http://blogs.technet.com/b/momteam. This means that if you have a current RSS subscription to to http://blogs.technet.com/b/operationsmgr you’ll need to update it to point to http://blogs.technet.com/b/momteam/ instead. If you follow us on Facebook or Twitter nothing will really change so the transition will appear pretty seamless.

We have a lot of exciting things planned so be sure and stay tuned!

J.C. Hornbeck | System Center & Security Knowledge Engineer

Get the latest System Center news on Facebook and Twitter:

The Forefront Server Protection blog: http://blogs.technet.com/b/fss/
The Forefront Endpoint Security blog : http://blogs.technet.com/b/clientsecurity/
The Forefront Identity Manager blog : http://blogs.msdn.com/b/ms-identity-support/
The Forefront TMG blog: http://blogs.technet.com/b/isablog/
The Forefront UAG blog: http://blogs.technet.com/b/edgeaccessblog/

New Application Performance Monitoring (APM) Forum

2012-02-09T20:30:14Z

We have created a new forum under the Operations Manager forum category on TechNet for Application Performance Monitoring (APM). Please feel free to fire away questions to Microsoft, the MVPs, and the broader community, answer questions , and have ...read more...(read more)

Release Candidate of System Center 2012 Integration Packs for Orchestrator Released!

2012-02-08T20:23:00Z

Following the release of System Center 2012 Release Candidate, Microsoft is pleased to announce the availability of the Release Candidate of the Orchestrator Integration Packs for the following System Center 2012 components: System Center 2012 Virtual ...read more...(read more)

Operations Manager Dynamic Group Examples

2012-02-02T18:02:46Z

Here’s another cool article by Microsoft’s own Jeanie Decker that I found over in our TechNet Wiki. This one goes over some examples of dynamic groups in System Center Operations Manager.

Do you have examples of dynamic group formulas that you want to share? Consider adding them to this article, or just link to examples you've already published.

In Operations Manager, groups are logical collections of objects, such as Windows-based computers, hard disks, or instances of Microsoft SQL Server. Groups are populated by explicitly adding objects to the group or dynamically according to criteria you set. For more information on the use of groups, see Creating and Managing Groups in the Operations Guide.

This article provides example of group definitions. The examples describe the items to select in the Query Builder and the resulting formula…

You can read Jeanie’s entire article here.

J.C. Hornbeck | System Center & Security Knowledge Engineer

Get the latest System Center news on Facebook and Twitter:

The Forefront Server Protection blog: http://blogs.technet.com/b/fss/
The Forefront Identity Manager blog : http://blogs.msdn.com/b/ms-identity-support/
The Forefront TMG blog: http://blogs.technet.com/b/isablog/
The Forefront UAG blog: http://blogs.technet.com/b/edgeaccessblog/

System Center 2012 Operations Manager incorrectly reports that a restricted System Center 2012 Data Protection Manager action completed successfully

2012-01-31T18:12:26Z

Here’s a new Knowledge Base article we published today. This one talks about an issue where a restricted user can attempt certain actions that they don't have permission to yet get a (false) message indicating it was successful.

=====

Symptoms

When using System Center 2012 Operations Manager (OpsMgr) to manage System Center 2012 Data Protection Manager (DPM) servers and leveraging the role-based access control, it is possible that a restricted user can attempt certain actions that they don't have permission to and get a message indicating it was successful.

Checking the jobs view in DPM for the given protection group will show that the job is not actually initiated in DPM. Restrictions for the user will be followed.

This is most likely to happen only when dealing with a protection group. When the same action is attempted at the data source level, users will be presented with the expected message indicating the action is not allowed.

Cause

This is caused by unexpected return values from the agent task in OpsMgr.

Resolution

The DPM team is aware of the condition and is working on a resolution that will be targeted for the next DPM QFE.

It is important to note that the action is not actually being performed. There is no unexpected elevation of privileges. The roles as defined in OpsMgr are being honored at all times.

More Information

Following are examples of the expected behavior and the erroneous message.

If a restricted user attempts to launch a consistency check for a data source from the OpsMgr console, initially a message will be displayed indicating the job is being sent.

Run Consistency Check on data source
Status: Run Consistency check on data source

This will then be followed by an error indicating the user does not have permission.

Failed to start <task type> on data source
You do not have permissions to perform this action. Your DPM administrator must give you permissions to any one of the following tasks - Run <task type> (ID: 33238)

If the same user attempts to initiate the consistency check, but this time at the protection group level, the experience changes and an erroneous message is displayed. First, an indication that job is being sent will be displayed.

Run Consistency Check on Protection Group
Status: Run Consistency Check on Protection Group

At this point, OpsMgr reports that the job was successfully started.

Run Consistency Check on Protection Group
Status: Successfully started consistency check on Protection Group

The above message is the erroneous message as the job will not be started on the DPM server.

=====

For the most current version of this article please see the following:

2665983 : System Center 2012 Operations Manager incorrectly reports that a restricted System Center 2012 Data Protection Manager action completed successfully

J.C. Hornbeck | System Center & Security Knowledge Engineer

Get the latest System Center news on Facebook and Twitter:

SCOM 2012 DPM 2012

Potential integration issues with System Center 2012 Virtual Machine Manager and Operations Manager

2012-01-30T17:47:04Z

Here’s a new Knowledge Base article we published today on VMM 2012 and SCOM. This one talks about a couple potential integration issues you may run into after configuring OpsMgr integration with System Center 2012 Virtual Machine Manager:

=====

Symptoms

This article presents possible errors and issues you may encounter after configuring Operations Manager integration with System Center 2012 Virtual Machine Manager (SCVMM 2012). Note that this can apply to System Center Operations Manager 2007 (OpsMgr 2007) as well as System Center 2012 Operations Manager (OpsMgr 2012).

Resolution

1. Error 11808 - Unable to set the Operations Manager root server in VMM because the Operations Manager is not installed on the Virtual Machine Manager management server.

Recommended action:

Install the Operations Console for System Center Operations Manger 2007 on the Virtual Machine manager server and then try the operation again.

NOTE This error message can be misleading as it applies to either version of OpsMgr even though it only specifically mentions OpsMgr 2007. The console required has to match the version you are using on the Operations Manager server, so if you are integrating with OpsMgr 2012 you need to install the OpsMgr 2012 console on the SCVMM 2012 server.

=====

2. Error 25907 - The credentials used to connect to Operations Managers management group do not have the necessary permissions

Recommended Action:

Try operation again with different credentials or add the credentials to the OpsMgr Administrator Role

NOTE You will need to add either one of these to the OpsMgr built-in administrators group. Add the account used for integration or add the machine name if local system was selected during integration.

=====

3. Error 10218 - Setup could not import the System Center Virtual Machine Manager Management pack into Operations Manger server because one or more required management packs are missing. The VMM management pack cannot be deployed unless the following components management packs are present in operations manager 2007…..

Recommended action:

To provide the missing component management packs, ensure that the following management packs cannot be deployed unless the following component management packs are present in operations manager 2007:…

NOTE The minimum required version of the Management Packs is 6.0.5000.0

=====

4. Error status in the operations manager settings.

Error Details:

Operations Manager discovery failed with error: "Exception of type 'Microsoft.virtualmanager.enterprisemanagement.common.dicoverydatainvalidrelationshipsourceexception0m10' was thrown.

NOTE This is caused by one or more hosts under SCVMM management not having the OpsMgr agent installed and reporting to an Operations Manager server. The new architecture in SCVMM 2012 requires that the Operations Manager agent be installed on all hosts so they can send VM information directly and not have to go through SCVMM.

=====

5. Error 25923 - PRO Diagnostics Target is not monitored

Recommended Action

Check if Operations manager agent is running on the computer running VMM management server

NOTE This is usually caused by the Operations Manager agent not being installed on the VMM server. It can also occur if the VMM server has the agent installed but it is not monitored (e.g. it there are problems with health agent). Verify the operations manager console and make sure it is in a Healthy State.

More Information

For more information see http://blogs.technet.com/b/scvmm/archive/2012/01/23/potential-issues-with-vmm-2012-opsmgr-integration.aspx

=====

For the most current version of this article please see the following:

2668088 : Potential integration issues with System Center 2012 Virtual Machine Manager and Operations Manager

J.C. Hornbeck | System Center & Security Knowledge Engineer

Get the latest System Center news on Facebook and Twitter:

How to detect and troubleshoot frequent configuration changes in Operations Manager 2007

2012-01-23T18:06:06Z

Here’s a new Knowledge Base article we published today on SCOM 2007. This one talks about configuration churn, what can cause it and how you can address it if you see it in your environment:

=====

Configuration Overview

The System Center Management Configuration service is responsible for calculating the configuration of every health service in the Operations Manager 2007 Management Group. The configuration of a health service consists of the rules, monitors, discoveries and tasks for the health service and for all the instances monitored by the health service. In order to calculate all the required configurations for each health service, the Management Configuration service needs to have a list of all instances of all monitored classes, the hosting relationships between instances, the rules, monitors, discoveries and other workflows assigned to the monitored classes, and the health services responsible for monitoring the instances. In addition, the Management Configuration service also needs to read the membership of all instance groups in the Management Group and apply any overrides for rules and monitors that have been targeted at these groups, classes or individual instances.

Objects in a management group will be defined as instances of monitored classes based on discovery data submitted by discovery workflows. If a key property of an object changes, that object may be added as a new instance of a monitored class, or no longer be considered an instance of that class. As the list of classes the object is determined to be a member of changes, the configuration for the health service that monitors that object will also change as rules, monitors, discoveries, tasks and overrides are added or removed from the previous configuration.

Configuration Churn

If a large amount of discovery data is submitted to the Management Configuration service, or submitted too fast for the Management Configuration service to process before more discovery data is submitted, agents may not be able to receive a stable configuration, as it will always be in the process of being calculated. The frequent submission of discovery data, also known as configuration churn, can cause some health services to run under old configurations, or cause the configuration of management servers to become stale, subsequently causing them to appear gray in the Operations console.

Discovery data is submitted by a health service when a discovery workflow runs. Introduction of a new Management Pack to a Management Group can cause several discovery workflows to run on each agent, and as new instances are discovered, additional discoveries may be run on some agents. Changes to groups, overrides and other workflows can cause discovery workflows to run on agents, and introduction of new agents can also cause the Management Configuration service to update the instance space with the new agent's configuration.

When a discovery workflow is configured to run too often, or the properties discovered by the workflow change each time it is run, the Configuration Management service will be forced to recalculate the health service configuration often. If this happens for many agents, or the Root Management Server (RMS) is under heavy workload already, the Configuration Management service may not be able to keep up with the rate of change and configuration churn may occur.

Identifying Configuration Churn via the RMS event log

The following event in the Operations Manager event log on the RMS indicates that the Management Group configuration has changed due to new discovery data.

Log Name: Operations Manager
Source: OpsMgr Connector
Event ID: 21024
Level: Information
Computer: <RMS Name>
Description:
OpsMgr's configuration may be out-of-date for management group <ManagementGroupName>, and has requested updated configuration from the Configuration Service. The current(out-of-date) state cookie is "3A B0 1E 5C 81 F3 12 F5 56 B7 8A EF F8 01 BA 09 86 55 06 48 "

The following event indicates that the Management Configuration service has finished processing the new discovery data and calculated any changes required to the Management Group configuration based on the new data.

Log Name: Operations Manager
Source: OpsMgr Connector
Event ID: 21025
Level: Information
Computer: <RMS Name>
Description:
OpsMgr has received new configuration for management group <ManagementGroupName> from the Configuration Service. The new state cookie is "34 FA 11 61 4D B8 03 59 3D 1D 66 B7 83 F3 C0 AA 7A 6F 1A 3B "

In a typical environment, every 21024 should be followed by a 21025. If the discovery data did not cause any configuration data to change, the event ID will be 21026 instead. In a large Management Group, pairs of 21024 and 21025/26 events should be expected to occur several times per hour. Long strings of 21024 events with no corresponding 21025/26 event is a sign of configuration churn. In addition, the event log may show the following event, indicating churn has been detected.

Log Name: Operations Manager
Source: OpsMgr Config Service
Event ID: 29202
Level: Warning
Computer: <RMS Name>
Description:
OpsMgr Config Service could not retrieve a consistent state from the OpsMgr database due to too frequent database changes.
This could be due to a normal and temporary increase of discovery data; however check the most recent changes to determine if this increase is unexpected.
Most recent monitoring object change:
Instance = %1
Class = %2
Modified time = %3
Most recent monitoring relationship change:
Relationship instance = %4
Source instance = %5
Target instance = %6
RelationshipClass = %7
Modified time = %8

The Data Access Layer must read multiple tables when querying for changes. If one of the tables is modified after it is read but before all tables have been read, the Data Access Layer will log the above event and retry. If an entity or relationship instance was read during this time, information about these is included in the event fields; otherwise, these fields are left empty.

Identifying Potential Causes of Configuration Churn via the Operations Manager Datawarehouse

In management groups where the Operations Manager Reporting component has been installed, several SQL queries can be used to identify workflows that are submitting frequent changes. These queries should be run in SQL Management Studio against the Datawarehouse instance.

Total Changes Submitted by Discovery Workflows in Last 24 Hours:

select ManagedEntityTypeSystemName, DiscoverySystemName, count(*) As 'Changes'
from
(select distinct
MP.ManagementPackSystemName,
MET.ManagedEntityTypeSystemName,
PropertySystemName,
D.DiscoverySystemName,
D.DiscoveryDefaultName,
MET1.ManagedEntityTypeSystemName As 'TargetTypeSystemName',
MET1.ManagedEntityTypeDefaultName 'TargetTypeDefaultName',
ME.Path,
ME.Name,
C.OldValue,
C.NewValue,
C.ChangeDateTime
from dbo.vManagedEntityPropertyChange C
inner join dbo.vManagedEntity ME on ME.ManagedEntityRowId=C.ManagedEntityRowId
inner join dbo.vManagedEntityTypeProperty METP on METP.PropertyGuid=C.PropertyGuid
inner join dbo.vManagedEntityType MET on MET.ManagedEntityTypeRowId=ME.ManagedEntityTypeRowId
inner join dbo.vManagementPack MP on MP.ManagementPackRowId=MET.ManagementPackRowId
inner join dbo.vManagementPackVersion MPV on MPV.ManagementPackRowId=MP.ManagementPackRowId
left join dbo.vDiscoveryManagementPackVersion DMP on DMP.ManagementPackVersionRowId=MPV.ManagementPackVersionRowId
AND CAST(DefinitionXml.query('data(/Discovery/DiscoveryTypes/DiscoveryClass/@TypeID)') AS nvarchar(max)) like '%'+MET.ManagedEntityTypeSystemName+'%'
left join dbo.vManagedEntityType MET1 on MET1.ManagedEntityTypeRowId=DMP.TargetManagedEntityTypeRowId
left join dbo.vDiscovery D on D.DiscoveryRowId=DMP.DiscoveryRowId
where ChangeDateTime > dateadd(hh,-24,getutcdate())
) As #T
group by ManagedEntityTypeSystemName, DiscoverySystemName
order by count(*) DESC

This query will display three columns. The first column is the class of object at which the workflow is targeted. The second column indicates the internal name of the discovery workflow. The third column indicates the total number of property changes for all instances of this class submitted by the workflow in the last 24 hours. The total number of changes, for all classes, represents the number of times the Configuration Management service must recomputed the configuration for an agent health service.

The number of changes for some classes of objects, even in a stable environment, may not ever reach zero. Any change, such as adding or removing a property, agents being added or decommissioned, server roles being added or changed, etc. will be reflected in the numbers returned. In environments where configuration churn is experienced, one or several workflows will likely show a significantly larger value than other workflows.

Properties Changed in the Last 24 Hours:

select distinct
MP.ManagementPackSystemName,
MET.ManagedEntityTypeSystemName,
PropertySystemName,
D.DiscoverySystemName,
D.DiscoveryDefaultName,
MET1.ManagedEntityTypeSystemName As 'TargetTypeSystemName',
MET1.ManagedEntityTypeDefaultName 'TargetTypeDefaultName',
ME.Path,
ME.Name,
C.OldValue,
C.NewValue,
C.ChangeDateTime
from dbo.vManagedEntityPropertyChange C
inner join dbo.vManagedEntity ME on ME.ManagedEntityRowId=C.ManagedEntityRowId
inner join dbo.vManagedEntityTypeProperty METP on METP.PropertyGuid=C.PropertyGuid
inner join dbo.vManagedEntityType MET on MET.ManagedEntityTypeRowId=ME.ManagedEntityTypeRowId
inner join dbo.vManagementPack MP on MP.ManagementPackRowId=MET.ManagementPackRowId
inner join dbo.vManagementPackVersion MPV on MPV.ManagementPackRowId=MP.ManagementPackRowId
left join dbo.vDiscoveryManagementPackVersion DMP on DMP.ManagementPackVersionRowId=MPV.ManagementPackVersionRowId
AND CAST(DefinitionXml.query('data(/Discovery/DiscoveryTypes/DiscoveryClass/@TypeID)') AS nvarchar(max)) like '%'+MET.ManagedEntityTypeSystemName+'%'
left join dbo.vManagedEntityType MET1 on MET1.ManagedEntityTypeRowId=DMP.TargetManagedEntityTypeRowId
left join dbo.vDiscovery D on D.DiscoveryRowId=DMP.DiscoveryRowId
where ChangeDateTime > dateadd(hh,-24,getutcdate())
ORDER BY MP.ManagementPackSystemName, MET.ManagedEntityTypeSystemName

This query can identify which properties have changed in the last 24 hours. Combined with the previous query, this query can show what the old and new values were for the property, which agents submitted the change, the workflow that conducted the discovery, and the management pack it was contained in.

Reducing Configuration Churn

Older management packs introduced discovery workflows that submitted property changes too frequently. The current version of most management packs have modified these discovery workflows to submit data less frequently, or not query volatile properties that change frequently. Serious consideration should be given to upgrade any management pack with workflows that show up frequently in the previous query. New versions of the management pack can be downloaded from the management pack catalog: http://systemcenter.pinpoint.microsoft.com/en-US/applications/search/operations-manager-d11?q=

If a new version of the management pack is not available, or cannot be deployed at the time, the discovery interval can be adjusted via override to run less often. In some situations, the discovery responsible for the configuration churn can be entirely disabled by override. If the discovery is disabled for several weeks, the objects discovered by the workflow may be groomed out of the database, but disabling the discovery can provide a short-term solution to eliminate configuration churn before this occurs. The workflow can also be enabled for short intervals to rediscover the objects prior to them being groomed.

Some of the workflows in these older management packs are highlighted in the following blog:

http://blogs.technet.com/b/kevinholman/archive/2009/10/05/what-is-config-churn.aspx

If the workflow is from a custom discovery that targets a volatile property, such as free disk space, the discovery should be re-written to not target a property that changes often. Discovery workflows should not target instances with a short lifetime (a few weeks or less), nor collect properties of those instances that change often (more than once a month). Rules that collect performance data should be used for volatile data, as that is not considered in calculating configuration.

Additional Performance Tuning

In large management groups (> 1000 agents), the RMS may become very busy with operations that would not normally cause a problem in smaller management groups. In this situation, even a small rate of property changes could cause frequent churn, due to the length of time required to process the changes. There are a number of configuration changes that can be implemented to reduce the operational overhead of the RMS and allow it to process a normal rate of property changes quickly enough to avoid configuration churn. These configuration changes are highlighted in the following blog:

http://blogs.technet.com/b/mgoedtel/archive/2010/08/24/performance-optimizations-for-operations-manager-2007-r2.aspx

Forcing Configuration Change for the Management Group

If configuration churn for the management group is occurring constantly, any changes to reduce frequency of or disable the problem workflows will never be propagated to agents. In this case, the flow of inbound discovery data will need to be blocked to allow the System Center Configuration Management service to calculate a current configuration with the modified or disabled workflow.

Discovery data is submitted to the OperationsManager database via the System Center Data Access Service. The data is first submitted to the DAS by the System Center Management service on the RMS. The RMS gets this data from agents or other management servers. Using the Windows Firewall or some other networking means to block inbound connections to the RMS on port 5723 will prevent discovery data from being submitted to the OperationsManager database just long enough for the Configuration Management service to calculate the current configuration for the agents submitting the data.

The System Center Management service and the System Center Data Access Service on the RMS should not be stopped or disabled during this process. The System Center Configuration Management service requires a running and healthy System Center Management service on the RMS in order to complete calculation of the management group configuration. It also requires the System Center Data Access Service to communicate with the database. In addition, some data may become backlogged on the agents and other management servers during this process, so the Firewall or port exclusion should be lifted as soon as event 21025 is seen in the Operations Manager event log on the RMS, indicating that the Configuration Management service has calculated the new configuration for the management group with the disabled or modified workflows.

Identifying Potential Causes of Configuration Churn via Operations Manager Reporting

New reports were introduced with version 6.1.7599.0 of the Operations Manager 2007 R2 Management Pack. These reports provide insight into the overall volume of data being processed by the management group. These reports can be used to establish a standard baseline and to identify opportunities for tuning object discovery workflows. Once configuration churn has been identified and addressed, these reports can be used for long-term planning to prevent recurrences of churn.

The management pack can be downloaded from here: http://www.microsoft.com/download/en/details.aspx?displaylang=en&id=23081·

Data Volume by Management Pack report
The Data Volume by Management Pack report compiles information on the volume of data generated by management packs. The report lists the number of occurrences per management pack for the following data types:
- Discoveries
- Alerts
- Performance (number of instances submitted for performance counters collected by management pack)
- Events
- State changes
Data Volume by Workflow and Instance report
The Data Volume by Workflow and Instance report compiles information on the volume of data generated, broken down by workflows (discoveries, rules, monitors, etc.) as well as by instances.
There are two ways to access this report:
- In the Data Volume by Management Pack report, click one of the counts cells in the table at the top of the report to open the Data Volume by Workflow and Instance report for the management packs.
- Run the report directly from the Reporting section in the Operations console. If you run the Data Volume by Workflow and Instance report directly, you should set the parameters of the report to customize the results; this report is designed to provide details for information in the Data Volume by Management Pack report and so the default parameter settings may not provide the information you are looking for.

Query Words

Churn SCOM 2007 config

=====

For the most current version of this article please see the following:

2603913 : How to detect and troubleshoot frequent configuration changes in Operations Manager 2007

J.C. Hornbeck | System Center Knowledge Engineer

Get the latest System Center news on Facebook and Twitter:

Potential issues with VMM 2012/OpsMgr integration

2012-01-23T17:29:15Z

Hi everyone, Alvin Morales here. This article presents possible errors and issues you may encounter after setting Operations Manager integration with System Center 2012 – Virtual Machine Manager (SCVMM 2012). Note that this can apply to System Center Operations Manager 2007 (OpsMgr 2007) as well as System Center 2012 – Operations Manager (OpsMgr 2012).

1. Error 11808 - Unable to set the Operations Manager root server in VMM because the Operations Manager is not installed on the Virtual Machine Manager management server.

Recommended action:

Install the Operations Console for System Center Operations Manger 2007 on the Virtual Machine manager server and then try the operation again.

=====

2. Error 25907 - The credentials used to connect to Operations Managers management group do not have the necessary permissions

Recommended Action:

Try operation again with different credentials or add the credentials to the OpsMgr Administrator Role

=====

Recommended action:

NOTE The minimum required version of the Management Packs is 6.0.5000.0

=====

4. Error status in the operations manager settings.

Error Details:

Operations Manager discovery failed with error: "Exception of type 'Microsoft.virtualmanager.enterprisemanagement.common.dicoverydatainvalidrelationshipsourceexception0m10' was thrown.

=====

5. Error 25923 - PRO Diagnostics Target is not monitored

Recommended Action

Check if Operations manager agent is running on the computer running VMM management server

Alvin Morales | Senior Support Escalation Engineer

Get the latest System Center news on Facebook and Twitter:

OpsMgr 2007 SCOM 2007 SCOM 2012 OpsMgr 2012 VMM 2012

Custom APM Rules for Granular Alerting

2012-01-23T16:48:00Z

Michael wrote a post in August, about working with Alerts . One of the key takeaways from that post, is that – for each application and for each application component – we have FOUR Alerting rules, that can be turned on or off from the APM Template ...read more...(read more)

Microsoft Enterprise Product Roadmap Webcast

2012-01-19T17:18:15Z

Please join us for a high level discussion into Microsoft software investments designed to cover most of the major product lines. This will be a 35,000 foot view into the following areas:

Windows Family
Virtualization
Office System
Unified Communications
IT Management
Security

This particular webcast is scheduled for Friday, January 20 at 1:00pm Pacific Time although others are scheduled as well. See this link for more information.

J.C. Hornbeck | System Center & Security Knowledge Engineer

Get the latest System Center news on Facebook and Twitter:

Upcoming Learning Opportunities for System Center 2012

2012-01-18T22:50:11Z

So - now that the Release Candidate of System Center 2012 is out and the general availbility is fast approaching you may be starting to get more serious about getting up to speed on System Center 2012. Am I right? Don't even worry! We are here to help ...read more...(read more)

System Center 2012 RC Released & New Licensing Information

2012-01-17T18:20:00Z

At the webcast this morning Satya Nadella, President of the Server and Tools Division, and Brad Anderson, Corporate Vice President of Management and Security at Microsoft announced the availability of System Center 2012 RC and introduced the new licensing ...read more...(read more)

TechNet Virtual Lab: System Center Operations Manager 2012: Infrastructure and Application Performance Monitoring

2012-01-17T18:17:40Z

Looking to get some hands-on lab work on how to do infrastructure and application performance monitoring with System Center 2012 – Operations Manager? If so then this one’s for you:

=====

Deploying the infrastructure for a private cloud is just the first step. Once it’s in place, IT administrators have to monitor those resources to ensure that the infrastructure SLAs are met, quickly find the causes for any problems, and plan for future growth. Operations Manager and Virtual Machine Manager for Microsoft System Center can help with all of these tasks. The benefits include less downtime, better user experiences, adherence to SLAs, and lower overall costs.

Event ID: 1032501040
Language(s): English.
Product(s): Microsoft Application Virtualization for Windows Desktops.
Audience(s): IT Generalist.

For all the details see the MS Events site here.

J.C. Hornbeck | System Center & Security Knowledge Engineer

Get the latest System Center news on Facebook and Twitter:

Reminder: BIG Webcast - Transforming IT with Microsoft Private Cloud - Tomorrow Jan 17th

2012-01-17T01:22:09Z

There is a really important web cast that is happening tomorrow that I wanted to remind you all about. You won't want to miss it. Here is the description of the event. Registration link is below. The definition, business value, and technology ...read more...(read more)

Fix: System Center Operations Manager 2007 ACS reports return no more than 42 days of data

2012-01-16T20:07:16Z

Here’s a new Knowledge Base article we published today on SCOM 2007. This one talks about an issue where ACS reports only return a max of 42 days worth of data:

=====

Symptoms

When using System Center Operations Manager 2007, the audit database data retention period is set to 100 days but Audit Collection Services (ACS) reports return no more than 42 days data.

Cause

The ACS collector service uses DbCreatePartition.sql to create the partition tables and DbDeletePartition.sql (C:\Windows\System32\Security\AdtServer on the Collector server) to delete the partition tables based on the retention period. It also creates the views AdtServer.dvall, AdtServer.dvall5 and AdtServer.dvheader. In DbCreatePartition.sql and DbDeletePartition.sql, the dvall , dvall5 and dvheader views use a union of only the top 42 partition tables.

Resolution

To resolve this issue, complete the following:

1. First create a ACS data retention period as per your requirements. To update the data retention period, run the following SQL query:

USE OperationsManagerAC
UPDATE dtConfig
SET Value = <number of days to retain data + 1>
WHERE Id = 6

For example, to retain 7 days of data set <Value> = 8. Data is accumulated at approximately 7.6 MB per day per workstation.

NOTE Microsoft SQL Server 2005 has a limitation that allows only 255 partition tables in a view. Do not set the value more than 255. The higher the value, the longer it can take to fetch the data in the reports, thus performance may be affected.

2. On the Collector Server, navigate to C:\Windows\System32\Security\AdtServer. Edit the DbCreatePartition.sql SQL stored procedure in Notepad. Increase the days to 100 (or as per your requirements) by replacing 42 in the 5th line of for AdtServer.dvall, AdtServer.dvall5 and AdtServer.dvheader as shown below:

/*************************************************
*
* Create or update dvAll, the view across all partition views
*
**************************************************/
declare @iIsFirst int
declare @vchStmt nvarchar(max)
declare @vchPartitionId nchar(36)
declare cPartition cursor for
select top 42 PartitionId from dtPartition order by PartitionCloseTime desc
/***************************************************
*
* Create or update dvAll5, the view across all partition views limited to the first 5 strings
*
****************************************************/
declare @iIsFirst int
declare @vchStmt nvarchar(max)
declare @vchPartitionId nchar(36)
declare cPartition cursor for
select top 42 PartitionId from dtPartition order by PartitionCloseTime desc
/****************************************************
*
* Create or update dvHeader, the view across all partition views with no dtstring joins
*
*****************************************************/
declare @iIsFirst int
declare @vchStmt nvarchar(max)
declare @vchPartitionId nchar(36)
declare cPartition cursor for
select top 42 PartitionId from dtPartition order by PartitionCloseTime desc
3. On the Collector Server, navigate to C:\Windows\System32\Security\AdtServer. Edit the DbDeletePartition.sql SQL stored procedure in Notepad. Increase the days to 100 (or as per your requirements) by replacing 42 in the 5th line of AdtServer.dvall, AdtServer.dvall5 and AdtServer.dvheader as shown below:
/*****************************************************
*
* Create or update dvAll, the view across all partition views
*
******************************************************/
declare @iIsFirst int
declare @vchStmt nvarchar(max)
declare @vchPartitionId nchar(36)
declare cPartition cursor for
select top 42 PartitionId from dtPartition order by PartitionCloseTime desc
/******************************************************
*
* Create or update dvAll5, the view across all partition views limited to the first 5 strings
*
*******************************************************/
declare @iIsFirst int
declare @vchStmt nvarchar(max)
declare @vchPartitionId nchar(36)
declare cPartition cursor for
select top 42 PartitionId from dtPartition order by PartitionCloseTime desc
/******************************************************
*
* Create or update dvHeader, the view across all partition views with no dtstring joins
*
*******************************************************/
declare @iIsFirst int
declare @vchStmt nvarchar(max)
declare @vchPartitionId nchar(36)
declare cPartition cursor for
select top 42 PartitionId from dtPartition order by PartitionCloseTime desc
4. Restart the “Operations Manager Audit Collection Service” on the Collector Server.

=====

For the most current version of this article please see the following:

2663919 : System Center Operations Manager 2007 ACS reports return no more than 42 days of data

J.C. Hornbeck | System Center Knowledge Engineer

Get the latest System Center news on Facebook and Twitter:

APM object model

2012-01-14T14:50:00Z

It has been a while since we posted some new information about APM in OpsMgr 2012. Michael wrote a post in August, about working with Alerts , which was following up on a couple of previous ones about how to get things running , how APM works , and how ...read more...(read more)

How to create an OpsMgr 2007 diagnostic task for Unix/Linux services

2012-01-12T16:55:30Z

Microsoft’s own Chandan Bharti posted another great article over on his personal blog about how to create a diagnostic task for Unix/Linux services in System Center Operations Manager 2007 (SCOM 2007). This one actually builds on his previous post about creating a recovery task for the same thing:

I have already shown on how you can create the recovery task for Unix services in my previous blog Here. And that was meant to run when the state changes from healthy to critical. But personally, i didn't like that. So i feel its good to allow those services to be queries if its stopped or not, and only then run the recovery. Isnt that Cool!!

Here is how you can create a Diagnostic task for Unix/Linux services…

To continue reading Chandan’s article see the following:

SCOM 2007- How to create a Diagnostic task for Unix/Linux services : http://blogs.technet.com/b/chandanbharti/archive/2011/12/27/scom-2007-how-to-create-a-diagnostic-task-for-unix-linux-services.aspx

J.C. Hornbeck | System Center & Security Knowledge Engineer

Get the latest System Center news on Facebook and Twitter:

How to create a recovery task for Linux services in OpsMgr 2007

2012-01-11T18:26:54Z

Microsoft’s own Chandan Bharti recently posted a great article over on his personal blog about how to create a recovery task for Linux services in System Center Operations Manager 2007 (SCOM 2007). If you’re looking to do the same then you’ll want to check this out:

Once you create a monitor for Linux services and wonder how to create a recovery task for service restart. Here is how you can do that. The following would go in a custom MP that has the Unix Library MP defined in the References sections with the Alias "Unix".

Insert this in the section, right after the closing </Discoveries> tag…

To continue reading Chandan’s article see the following:

Creating the Recovery Task for Linux Services in SCOM 2007 : http://blogs.technet.com/b/chandanbharti/archive/2011/12/21/creating-the-recovery-task-for-linux-services-in-scom-2007.aspx

J.C. Hornbeck | System Center & Security Knowledge Engineer

Get the latest System Center news on Facebook and Twitter:

WinRM command fails with Access Denied, Error number: -2147024891 0x8007005

2011-12-20T16:09:34Z

Here’s a new KB article we published today. This one describes an issue where the WinRM command fails with Access Denied and error number: -2147024891 0x8007005:

=====

Symptoms

After installing the UNIX/Linux agent for System Center Operations Manager 2007, the Discovery process may fail and the client will not appear in the console. When attempting to troubleshooting such an issue, you may run a command similar to the following to verify that the discovery process is functioning:

winrm e http://schemas.microsoft.com/wbem/wscim/1/cim-schema/2/SCX_OperatingSystem?__cimnamespace=root/scx -r:https://<Unix server name>:1270 -u:<User account> -auth:basic -encoding:UTF-8 -skipCAcheck -skipCNcheck

In certain scenarios this command will fail with the following error:

Access Denied, Error number: -2147024891 0x8007005.

You may also see the following in /var/opt/microsoft/scx/log/scxcimd.log

cimserver: Listening on HTTPS port 1270.
cimserver: Listening on local connection socket.
cimserver: Started SCX CIM Server version 2.9.0 Release.
cimserver: Authentication failed for user=<User account>.
cimserver: Authentication failed for user=<User account>.

Cause

This can occur if an incorrect PAM.CONF file is generated on the UNIX server. This file is auto-generated by the SCX installer.

Resolution

To resolve this issue, remove the auto-generated entries from the PAM.CONF file and add the lines below:

# The configuration of scx is generated by the scx installer.
scx auth required /usr/lib/security/$ISA/pam_unix.so.1
scx auth required /usr/lib/security/$ISA/pam_dial_auth.so.1
scx account requisite /usr/lib/security/$ISA/pam_roles.so.1
scx account required /usr/lib/security/$ISA/pam_projects.so.1
scx account required /usr/lib/security/$ISA/pam_unix.so.1
# End of section generated by the scx installer.

IMPORTANT Please make sure to have a backup of the original PAM.CONF file before making any changes. PAM.CONF files are UNIX/Linux install specific and this resolution may only work in certain configurations. It is also possible that there may be custom PAM modules added to support additional features such as AD authentication, etc. As such, this resolution only applies if you have no custom PAM module defined.

In most case the entries that are defined for the sshd process are enough. If you are unsure of what entries are needed you can replicate the entries that are defined for the sshd process and for the scx process and that generally will take care of the issue. Be sure that you fully understand the ramifications of making these changes in your specific environment before doing so.

More Information

For more information please see the following: http://technet.microsoft.com/en-us/library/ee344801.aspx

=====

For the most current version of this article please see the following:

2653882: WinRM command fails with Access Denied, Error number: -2147024891 0x8007005

J.C. Hornbeck | System Center & Security Knowledge Engineer

The System Center Operations Manager 2007 R2 Config Service consumes 100% CPU for an extended amount of time

2011-12-15T22:46:05Z

Here’s another KB article we published today. This one describes a problem where the SCOM 2007 Config Service may consume 100% CPU utilization on servers that have 8 or more cores:

=====

Symptoms

On machines that have more than eight (8) CPU cores, you may see the System Center Operations Manager 2007 R2 Config Service consuming 100% CPU for extended periods of time.

Cause

The Config Service reads from the database and notifies the agents that new config is needed. This is seen via event ID 29102 in the event log. After that all agents send a message to the Config Service to get the new config. The Config Service has a threshold on how many requests it is to process at a time which is set to 25 * CPU Core count by default. On machines where there are greater than eight cores this can lead to the launching of threads that are all trying to connect to SQL that can overwhelm the the network or the SQL server.

Resolution

To resolve this issue, change the default setting to a setting where the total number of cores * setting is no more than 100:

1. Stop the Config Service
2. Open Regedit
3. Go to HKLM\Software\Microsoft\Microsoft Operations Manager\3.0\Config Service
4. Create a DWORD value named "Max Number Of Worker Threads Per CPU" without the quotes and set the value such that the number of cores * <your value> is no greater than 100.
5. Restart the Config Service

More Information

This is required for R2 only.

=====

For the most current version of this article please see the following:

2655633: The System Center Operations Manager 2007 R2 Config Service consumes 100% CPU for an extended amount of time

J.C. Hornbeck | System Center Knowledge Engineer

The System Center Operations Manager 2007 console may crash while setting the scale on a performance view

2011-12-13T16:58:44Z

Here’s another KB article we published today. This one describes a problem where the SCOM 2007 console may crash while setting the scale on a performance view if the performance counters have hugely different values:

=====

Summary

While working in the System Center Operations Manager 2007 (SCOM 2007) admin console, the console may crash unexpectedly when a changing the scale on the performance graph. This issue may occur if the following statements are true:

- You have an application with performance counters that have hugely different values. For instance, Counter A of the application has a value that can scale between 0-400 and Counter B has a value that can scale between 0-400000000.

- The performance view is targeted against the application and both of the counters are displayed on the same graph.

More Information

The current workaround is to create two separate performance view based on the application counters. If there is a requirement to view data relevant to the performance counters on the same view, use a dashboard view that includes the two performance view created above.

This is a known issue in System Center Operations Manager 2007. More information will be posted as it becomes available.

=====

For the most current version of this article please see the following:

2652434: The System Center Operations Manager 2007 console may crash while setting the scale on a performance view

J.C. Hornbeck | System Center Knowledge Engineer

Deploying the System Center Operations Manager 2007 Linux Agent fails with "The certificate Common Name (CN) does not match"

2011-12-13T16:05:15Z

Here’s another KB article we published today. This one describes a problem where deploying the SCOM 2007 Linux Agent fails with "The certificate Common Name (CN) does not match" due to a certificate issue:

=====

Symptoms

Attempting to deploy the System Center Operations Manager 2007 Linux Agent to a Red Hat server fails. In this scenario you receive the error below while discovering and deploying the agent:

The certificate Common Name (CN) does not match. Please resolve the issue, and then run

The server certificate on the destination computer (<Redhat machine name>) has the following errors:
The SSL certificate is signed by an unknown certificate authority.
The SSL certificate contains a common name (CN) that does not match the hostname.
For additional help on this error please go to ....

Cause

This can occur for either of the following reasons:

- Certificates may not be valid as the reporting server may have been changed

- The certificate contains an incorrect host name

Resolution

To resolve this issue, complete the steps below:

1. Remove the existing contents of the agent directory on the server and reinstall the agent RPM
2. Generate the certificate, making sure to use the correct host name: "/opt/Microsoft/scx/bin/tools/scssslconfig –f –h <hostname>"
3. Check the status of the certificate: "openssl x509 -noout -in /etc/opt/microsoft/scx/ssl/scx.pem -subject -issuer -dates"
4. Discover the agent from the console and sign the invalid certificate without SSH

=====

For the most current version of this article please see the following:

2651766: Deploying the System Center Operations Manager 2007 Linux Agent fails with "The certificate Common Name (CN) does not match"

J.C. Hornbeck | System Center Knowledge Engineer

Logical Disk free space alerts don’t show percent and MB free values in the alert description in OpsMgr 2007

2011-11-29T18:45:08Z

Microsoft’s very own Kevin Holman just posted a great article over on his blog talking about an issue where Logical Disk free space alerts don’t show percent and MB free values in the alert description in SCOM 2007. If you haven’t seen it yet then you’ll definitely want to check this one out:

I recently wrote about the new Base OS Monitoring Packs that shipped, adding many new features and fixes for monitoring the OS. You can read more about that new release HERE. While this MP update contained many fixes and new features which are VERY beneficial in making alerts more actionable by controlling “false positives”, some of these modifications left a bit of a negative side effect.

One of the areas this new MP focused on, was changing a lot of the “average threshold” monitors to “consecutive sample” monitors. This helps control the noise when there are short term fluctuations in a performance value, or when some counters can spike tremendously for a very short time, skewing the average. So for the most part – changing these over to consecutive samples is a good thing. That said, one of the changes made was to the Logical Disk free space monitors, both for Windows Server 2003 and 2008 disks…

You can continue reading Kevin’s post here.

J.C. Hornbeck | System Center Knowledge Engineer

How to change the Operations Manager 2007 Admin group if the original was deleted from Active Directory

2011-11-28T22:15:17Z

Here’s another KB article we published today. This one describes how to change the Operations Manager 2007 Admin group if the original was deleted from Active Directory:

=====

Symptoms

When attempting to login to the System Center Operations Manager 2007 (SCOM 2007) Admin console you receive the following error:

Failed to connect to server ‘RMS.contosso.com’. Insufficient privileges

The user CONTOSSO\scomadmin does not have sufficient permission to perform the operation.

Additional Information :

Date: 11/4/2011 8:33:21 AM
Application: System Center Operations Manager 2007 R2
Application Version: 6.1.7221.0
Severity: Warning
Message: Failed to connect to server 'RMS.contosso.com'. Insufficient privileges

Microsoft.EnterpriseManagement.Common.UnauthorizedAccessMonitoringException: The user contosso\scomadmin does not have sufficient permission to perform the operation.
at Microsoft.EnterpriseManagement.DataAbstractionLayer.SdkDataAbstractionLayer.HandleIndigoExceptions(Exception ex)
at Microsoft.EnterpriseManagement.DataAbstractionLayer.SdkDataAbstractionLayer.CreateChannel(TieredManagementGroupConnectionSettings managementGroupTier)
at Microsoft.EnterpriseManagement.DataAbstractionLayer.SdkDataAbstractionLayer..ctor(DuplexChannelFactory`1 channelFactory, TieredManagementGroupConnectionSettings managementGroupTier, IClientDataAccess callback, CacheMode cacheMode)
at Microsoft.EnterpriseManagement.DataAbstractionLayer.SdkDataAbstractionLayer.CreateEndpoint(ManagementGroupConnectionSettings connectionSettings, IClientDataAccess clientCallback)
at Microsoft.EnterpriseManagement.DataAbstractionLayer.SdkDataAbstractionLayer.Connect(ManagementGroupConnectionSettings connectionSettings)
at Microsoft.EnterpriseManagement.ManagementGroup..ctor(ManagementGroupConnectionSettings connectionSettings)
at Microsoft.EnterpriseManagement.ManagementGroup.Connect(ManagementGroupConnectionSettings connectionSettings)
at Microsoft.EnterpriseManagement.Mom.Internal.UI.Common.ManagementGroupSessionManager.Connect(String server, String username, SecureString password, String domain)
at Microsoft.EnterpriseManagement.Mom.Internal.UI.Console.ConsoleWindowBase.ConnectWithCredentials(Exception ex, ConsoleJobEventArgs args)

Cause

This can occur if the SCOM 2007 Admin group was deleted from Active Directory.

Resolution

In our steps to resolve the issue, we first try finding the user accounts and groups that have sufficient privileges for SCOM 2007:

1. Open Authorization Manager by typing azman.msc in Run.

2. Right click on the Authorization Manager entry found in the left pane and select Open Authorization Store.

3. In the Open Authorization Store dialog box, choose XML File and then, click on Browse.

4. Navigate to the System Center Operations Manager Directory which by default is C:\Program Files\System Center Operations Manager 2007.

5. Open the SDK Service State folder and choose the MomAuth.xml file.

6. Once the store loads you can find Microsoft Operations Manager in the left pane. Expand it.

7. You should be able to find a folder under the Microsoft Operations Manager with the name 597f9d98-356f-4186-8712-4f020f2d98b4.

8. Expand it and open Role Assignments. Click on the list item you see under it.

9. You will now be able to see the users and groups that have privileges in SCOM 2007.

10. By default, you can find SYSTEM listed in the right pane. You can also find the corrupt user groups or accounts noted as ‘Account Unknown’ along with the SID.

11. The fact that SYSTEM is listed there confirms that local SYSTEM has enough

12. In case you don’t find the SYSTEM account, the resolution steps mentioned below won’t work for you.

With the PSExec.exe tool (http://technet.microsoft.com/en-us/sysinternals/bb897553), open the SCOM 2007 console in SYSTEM context:

1. Open Command Prompt.

2. Type the command PSExec.exe –i –s cmd.exe

3. Optional: Execute the whoami command in the new command prompt window. Doing this will verify if the command prompt is running under SYSTEM context (NT Authority\SYSTEM).

4. In the command prompt window running under SYSTEM context, run the executable file {BaseDirectory}\System Center Operations Manager 2007\ Microsoft.Mom.UI.Console.exe. By default the base directory is C:\Program Files\.

You should now be able to open SCOM 2007 Admin console using the SYSTEM context.

5. In the Admin Console, open Administration Pane and select User Roles.

6. Choose the Operations Manager Administrators user role and add the group/account you wish to use.

7. Test the solution by closing the Operations Manager Console and reopening it in the newly added context. You should be able to login now.

The resolution can be verified by checking for the recently added group in Authorization Manager. You should follow the same procedure as mentioned previously.

More Information

Overview on Authorization Manager : http://msdn.microsoft.com/en-us/library/bb897401.aspx

Download PSExec from here : http://technet.microsoft.com/en-us/sysinternals/bb897553

=====

For the most current version of this article please see the following:

2640222: How to change the Operations Manager 2007 Admin group if the original was deleted from Active Directory

J.C. Hornbeck | System Center Knowledge Engineer

How are OpsMgr 2012 Dashboards different from Reports?

2011-11-10T19:35:00Z

While reports are a good way to get data specific for a certain time period, customers like you wanted a way a rich way to visualize data which you could then project and share with your organization. In OpsMgr 2012, we introduced the concept of Dashboards ...read more...(read more)