rohitkochher

Monitoring machines using Certificates with Operations Manager 2007 R2 - Part 2

2011-11-26T01:15:32Z

In part 1, we discussed scenarios where we can use certificates to monitor SCOM. Also we configure certificate template for SCOM. In this part we will use certificates for gateway servers and deploy it. At the end we will also have steps to monitor machines in WORKGROUP.

Download and Import trusted Root (CA) Certificate

Open browser https://<servername>/certsrv where <servername> is name of server running certificate services. On welcome page click download a CA Certificate, certificate chain, or CRL

Save the certificate. Now to import it open MMC. From File, select Add/Remove Snap-in. Add certificates snap-in and select Computer Account.

Expand Certificates (Local Computer), expand Trusted Root Certification Authorities, and then click Certificates. Use All tasks to Import the trusted root (CA) certificate.

We already covered on configuring template for SCOM in part 1.

Request a certificate for SCOM/Gateway server

1) Open browser with https://<servername>/certsrv again. In Select a task page click Request a certificate.

2) In request a Certificate page , select advanced certificate request.

3) In Advanced Certificate request , select Create and Submit a request to this CA

4) In Certificate template, from the drop down, select the certificate template that we configured in Part 1 of the series.

5) At the bottom of the page in Friendly Name, give the FQDN for SCOM Server/ Gateway server.

We need to install certificate both on SCOM server and gateway server.

Installation of Gateway server

On gateway server, open the media of SCOM. Click Install Operations Manager 2007 R2 Gateway. Enter the management group name, Management server.

Select Gateway Action Account and we have two options from Local System or Domain account

Click next and wait for installation to get complete.

Registering Gateway server with Management group using gateway approval tool

Copy the Microsoft.EnterpriseManagement.GatewayApprovalTool.exe from the installation media to the Operations Manager 2007 installation directory.

Open a Command Prompt window, and navigate to the \Program Files\System Center Operations Manager 2007 directory.

Syntax of command is Microsoft.EnterpriseManagement.gatewayApprovalTool.exe /ManagementServerName=<managementserverFQDN> /GatewayName=<GatewayFQDN> /Action=Create

Importing Certificates with the MOMCertImport.exe Tool

We need to import certificate both on management and gateway server.

On Command prompt Navigate to \SupportTools\<platform> (i386 or ia64).

Run momcertimport.exe /SubjectName <certificate subject name>.

With this, I was able to monitor machines in non-trusting domain using gateway server and certificates. To confirm everything is good, you can check one thing.

Open the certificate that you install on management/gateway server. Click on Details Tab and check the Serial Number.

Now navigate to HKLM\Software\Microsoft\Microsoft Operations Manager\3.0\Machine Settings and check the value of ChannelCertificateSerialNumber. Serial number of certificate should be listed backwards here in registry.

Further I can configure multiple gateway servers for agents to fail over. Also I can configure multiple SCOM servers for my gateways to fail over. This can be done using Power shell and is covered in the blog.

Monitoring Workgroup machines using certificates

Now, we will discuss about how we can monitor machines which are in workgroup. I have outlined this in few steps:

Name resolution between SCOM server and workgroup server can be done by host files which are located at C:\Windows\System32\drivers\etc

Make sure TCP port 5723 is opened for communication. You can telnet to confirm same.

You can manually install SCOM agent on workgroup server and later use certificates. Copy the AGENT folder from SCOM media. Based on 32/64 bit OS, run the MSI. Specify the management group and SCOM server name and complete the installation.

Check the Download and Import trusted Root (CA) Certificate in beginning of this blog. Perform that to download and import CA certificate on local computer. CA certificate should be imported in Trusted Root Certification Authorities store. Here I am assuming you can connect to https://<servername>/certsrv through your browser.

Next step is to get certificate for workgroup server. We already discussed in part 1 on how to configure certificate template for SCOM. Check Request a certificate for SCOM/Gateway server section at top of the blog to request certificate from workgroup server. You need to have permissions in domain of SCOM server for this. Also while requesting certificate, in FRIENDLY NAME give name of workgroup server.

Certificate will by default get installed in personal store of Current user. Open MMC and export that certificate from current user store to some location. Later import it in Personal section of Local computer.

Importing Certificates with the MOMCertImport.exe Tool

Copy MOMCertImport from SCOM support tools on workgroup server.

On Command prompt Navigate to \SupportTools\<platform> (i386 or ia64).

Run momcertimport.exe /SubjectName <certificate subject name>.

Process Manual Agent Installations in Operations Manager 2007

On your SCOM server configure the security settings for manually installed agent. It should be Review new manual agent installations in pending management view with/without Auto-approve new manually installed agents depending upon your security settings. Refer to the article for more details.

Thanks for reading!!

Monitoring machines using Certificates with Operations Manager 2007 R2 - Part 1

2011-11-26T01:12:44Z

In this series of two blogs, we will discuss about monitoring machines in non-trusted domain. In part one we will discuss about scenarios to use certificates and configuring certificate template for SCOM. In part two, we will talk about installation, approval of gateway servers and configuring monitoring for Workgroup machines.

Kerberos or Certificates

System Center Operations Manager 2007 R2 uses mutual authentication to communicate with agents. This can be done using Kerberos v5 or certificates. In case of same domain as that of SCOM server or if the two domains have two way trust we can use Kerberos. But if you want to monitor machines in workgroup or in non-trusted/one way trusted domain we need certificates. Certificates help in Mutual authentication.

Scenarios to used Certificates

If my SCOM server is in domain A and I want to monitor machines which are in Workgroup, I need Certificates. I will install Certificate on my SCOM server and on each workgroup machine that I want to monitor.

If my SCOM server is in domain A and I want to monitor machines in untrusted domain B, I will use certificates along with gateway server. But this time I don’t need to install certificate on all machines in domain B. I can simply install Gateway Server in domain B and have certificates installed on SCOM server of domain A and Gateway Server of domain B. Within Domain B, Kerberos is security mechanism between agents and Gateway server. And between gateway and SCOM server, certificates help for mutual authentication.

Another benefit of gateway servers is that I need to open only 1 port 5723 (TCP) between gateway and SCOM server.

We need name resolution between SCOM server and gateway server. This can be done using DNS, host files etc.

Let’s get it Started

I have installed Active Directory Certificate Services (AD CS) and Certificate Authority Web Enrollment roles on 2008 R2. Certificate Authority is of Enterprise type. More on 2008 R2 CA can be found here. Also to configure HTTPS binding for CA, check this.

Configuring certificate template for SCOM

1) On 2008 R2 Server, Click Start, then Administrative Tools and open Certification Authority snap-in. Click on Certificate templates, then on Manage.

2) Right Click on IPSec (offline request) template and select Duplicate Template option.

Select Windows Server 2003 Enterprise option for the version.

3) In Properties of new Template on General tab, give any name to template like OpsMgr Certificate using Template Display Name.

4) On request handling tab check Allow private key to be exported.

5) Click the Extensions tab, and in Extensions included in this template, click Application Policies, and then click Edit. In the Edit Application Policies Extension dialog box, click IP security IKE intermediate, and then click Remove.

6) Click Add and then select Client Authentication and Server Authentication and click OK.

7) Click on Security tab and give Authenticated users Read and Enroll permissions.

8) Close the Certificate templates console.

Add the configured templates to certificate templates folder

Right click Certificate templates in CA console. Click on New and then Certificate template to issue. Select the certificate template that we named in step 3.

This way we configure our certificate for SCOM. In part 2 we will discuss about installation of certificates, deployment of gateway server and monitoring WORKGROUP computers.

Stay Tuned!!

Network Monitoring using System Center Operations Manager 2012

2011-11-26T01:06:28Z

Today we will discuss about another out of box feature in OM 2012 - Network monitoring.You can monitor physical routers and switches their ports, interfaces, VLAN memberships etc. We have some default reports for networking like Interface Traffic volume, Packet Analysis. Also we have Dashboards for network devices like Network node Dashboard and Network Vicinity.

In this post, we will discuss key features of network monitoring with Operations Manager 2012. I am using Beta Edition. I have Cisco switch in my lab and three servers (all 2008 R2).

For network discovery and monitoring we need Microsoft.Windows.Server.NetworkDiscovery and Microsoft.Windows.Client.NetworkDiscovery management packs. We can monitor connection health, VLAN health, Up/down status of port/interface, Volume of inbound/outbound traffic for port/interface for discovered network devices. Operations Manager provides more detailed processor or memory monitoring for some network devices. You can check complete list here. For Cisco devices we can monitor in depth memory counters.

Let’s Start with Discovery

From SCOM console, click on Administration and click on Discovery Wizard

On General properties page, give Name and specify management /gateway server from which discovery will run. We can have only one Discovery rule per Management server. Select a management pool option is used to specify pool of management servers you want to use. This is from High availability prospective. Pool can have one or more management servers. This will allow network devices to failover to other SCOM server within pool, if one of them fails.

Select a discovery type : We have two types of discoveries available. Discovery rule can perform either one of the two types. But you can change the type even after the rule is created. Two types:

Explicit discovery – It will only attempt to discover those devices that you explicitly specify in the wizard by IP address or FQDN. It will only monitor those devices that it can successfully access. The rule will attempt to access the device by using ICMP, SNMP, or both depending on the configuration of the rule.

Recursive discovery – This will attempt to discover those devices that you explicitly specify in the wizard by IP address, as well as other network devices that are connected to the specified SNMP v1 or v2 device and that the specified SNMP v1 or v2 device knows about through the device’s Address Routing Protocol (ARP) table, its IP address table, or the topology Management Information Block (MIB).

I selected Explicit Discovery in my case. In case you select Recursive Discovery you get two more options:

1) Include Filters: Allow to discover all connected network devices or devices within specific IP address range

2) Exclude Filters: Allows to exclude specific network devices using IP address or name.

Default Accounts: These accounts are used to discover and monitor network devices. For SNMP V1, V2 we need community string. However for V3 devices we need unique Run As Account . These Run As Accounts can be created before the wizard or during the wizard as well

I click on Create Account option and get the wizard to create run as account.

In the wizard, We can specify the Community String. You can get this from Network Administrator

Next is Specify Devices page. You can give the name or IP address of the device. For Access Mode you can specify whether Operations Manager will use ICMP, SNMP, or both to communicate with the network device. The network device must support the protocol that you specify. If you specify ICMP as the only protocol to use, discovery is limited to the specified device and monitoring is limited to whether the device is online or offline.

You can specify SNMP version here and associate a Run as Account for same. You can also create Run as account here.

You can also click in Import button. You can browse to text file which has IPv4 addresses of all devices you want, with IP address of single device per line.

Schedule Discovery : We can either schedule the network discovery or run it manually.

My discovery was successful and I was able to discover by Cisco switch.

From SCOM console, in Administration export the Network Discovery Internal MP in XML format, if you want to check the changes.

Time for some Screen Shots

1) Network Vicinity Dashboard

2) Average Response Time and Processor Usage

3) Reports

Happy Reading!!

Active Directory tasks failing for 2008/2008R2 Servers in SCOM 2007 R2

2011-11-17T18:35:04Z

Recently, I deployed Active Directory Management pack (version 6.0.7065.0) in my SCOM 2007 R2 environment. To check health of one of my domain controller (2008R2), I tried to run DCDIAG task from SCOM console and I got the error below. I tried launching other AD related tasks from my SCOM Console like repadmin, netdom and got similar error. I thought of updating my AD MP to latest one (6.0.7670.0) but got the same problem.

I went through the error message and did some troubleshooting.Finally I was able to fix this. So in this blog we will discuss cause of this problem and some ways to fix this.

Cause: These AD tasks in SCOM were trying to execute from directory C:\Program files\Support Tools. This path was correct in 2000/2003 Servers but in 2008/2008 R2 servers these tools are part of Core OS. Since SCOM tasks are still trying old path, they failed to locate those tools.

Some possible ways of troubleshooting: I tried three different ways that proved helpful to me to fix this issue.

1) Override the path while running the tasks: This way every time you run any task, you can change the path of execution. It will not save the new path. Click on Override

Change the path from %ProgramFiles%\Support Tools to %windir%\system32.

Click on Override and run the task.

Concern with this is that it will not save the Overridden path and so you need to change it every time.

2) Use MKLINK: We will create directory symbolic link using MKLINK. You can find more about MKLINK here . You can run below given command on 2008/2008 R2 domain controllers one by one manually. Once symbolic link is created, you can launch the task from SCOM console.

3) Using PSEXEC: If you have big enterprise and good number of domain controllers, you can use PSEXEC to create symbolic link for you. Download PSEXEC from here. I created a text file on my SCOM server with name of each domain controller in separate line. Below is the syntax used:

Once the command got completed, I was able to run DCDIAG, REPADMIN and other AD related tasks from my SCOM Console.

Happy Reading

System Center Operations Manager 2012 Dashboards part 2

2011-11-15T20:04:02Z

In part 1 of this series, we discussed about terminology used in dashboards and created a performance widget. In this part 2, we will create state and alert widgets. In the end we will have our Grid Layout ready with all the three widgets. We will also touch on integration of dashboards with SharePoint.

So let’s start with Alert widget. Once again we will select the Alert Widget template.

Next step is to define the scope. We have two options here, using Groups now that helps to view alerts for all objects within the selected group. Using second option Group and Objects allows targeting a certain object within a group or class. We will select SQL computers group in our case.

Next step is to define Criteria. We can specify Severity, Priority and Resolution State.

Last step is to select the columns to display, and we also have option to Sort and group the results. I will select Repeat Count as one of the columns As I am excited to see this

In part 1 of this series, we discuss using Configure and Personalize option in performance widget. Those two options will work for State and Alert widget as well.

Finally we have our Alert widget ready. I stopped SQLRS to get some events in my widget

Third and last widget available in OM2012 is State Widget. We will create one now:

So we will select the State Widget template.

We will name this template as “All Servers State dashboard”. Next we will specify the scope, and we have the option to select only groups or all objects and groups. We will use Windows Server 2008 R2 Computer Group.

Next we specify the Criteria. We can choose objects from healthy, warning, critical and not monitored state.

Lastly we specify columns to display and we have option to Sort and Group the results.

With this our State Widget is ready.

Final Dashboard Screen

We are all set now; Next screen capture has our Dashboard Grid layout ready with State, Performance and Alert widgets.

This Dashboard can be viewed in Web console also.

We can integrate these dashboards in SharePoint as well. This basically requires few steps:

· Deploying the Web Part

· Configuring the Web Part to Connect to a Web Console

· Adding the Web Part to a Page

You can find the detailed procedure in this article.

I integrated my dashboards in SharePoint and below is how it will look.

I hope this series was helpful.

Thanks for reading!

System Center Operations Manager 2012 Dashboards 1

2011-11-15T16:57:00Z

System Center Operations Manager 2012 has some exciting features out of box like Networking Monitoring, Application monitoring and Dashboards. We will cover Dashboards in series of two blogs. In the first blog we will talk about terminology of dashboards and create a performance widget. In the second blog, we will create state and alert widgets. I will be using my OM 2012 Beta edition for these blogs.

Data warehouse which was an optional component in SCOM 2007 R2 is now mandatory in OM 2012. And the main reason for this change is dashboards

While designing dashboards, we define two things:-

1) Templates: We have two types of templates, Column layout and Grid Layouts. We specify number of cells after we select any template. These layouts specify arrangement of cells that actually host content.

2) Widgets: Once layout is created, we add widgets in the layout. In OM 2012 beta edition, we have three types of Widgets namely Alert, Performance and State. While creating widget, we define criteria to collect data from database.

Now, we will start to create a dashboard. We will be doing this from Operations Console.

We have to choose one layout out of the two available templates. We will select Grid layout and name the dashboard.

Next, we define number of cells and we choose one of the layouts.

Once the wizard is completed, you can click on Configure to change the number of cells and layout of dashboard. Also you can interchange the positions of all the widgets by using the two arrows.

Adding widgets to dashboards: You can click on “Click to Add widget” and it will start the wizard of creating widgets. In OM 2012 Beta edition we have alert, state and performance widgets.

We will start by creating a Performance widget.

We will name the widget as “SQL Performance counter”, and will use this to view performance of SQL computers.

On “Specify the Scope and Counters”, select a group.

We select group of SQL computers. Next we will select performance counters. We will define object, counter and instance.

Next step is to define Time Range.

Next step is to configure the way; you would like chart and legend to display.

Finally we get our SQL Performance Widget. You can click on Configure to change scope, counters, time range, chart preferences. Also you can click on Personalize to change chart and legend to display.

You can also hover anywhere on graph to see the exact value.

In the part 2 of the series, we will create alert and state widgets.

Stay Tuned!!

System Center Operations Manager 2012 Setup

2011-11-15T15:09:00Z

Technorati Tags: System Center Operations Manager,2012,setup,installation

System Center Operations Manager 2012 , has significant changes in setup. Setup in 2012 has become simpler and installation has become easier. First thing to be installed is a Management server. Also Operational database and data warehouse are created during setup.

You can download Beta version of SCOM 2012 from here

Concept of Root Management Server (RMS) which was in SCOM 2007 R2 has been removed from OM 2012. All OM 2012 servers are management servers. However we will have RMS emulator to support those management packs which targets RMS.

In this blog we will discuss setup of SCOM 2012 with some snapshots of wizard. Microsoft SQL 2008 Sp1 or 2008 R2 should be installed prior running SCOM 2012 Setup. You can get more information on SCOM 2012 supported configurations here

Now, once we will run setup.exe and it will give us bootstrapper screen:

You can click on Install for setup of Management server, Management Console, Web server and Reporting Server. Other optional installations Local agent, ACS, Gateway server and ACS for Unix/Linux can be installed from main screen.

Once you click on Install you will get screen to accept agreement. Once you accept that you will get below screen

You can select the component that you want to install. Clicking on arrow pointing down in front of each role, will give brief information about that role. There is no explicit option to install OPS DB and data warehouse, as they are integrated. Selecting given features, you will get screen for location of program files. Default location is C:\Program Files\System Center Operations Manager 2012.

Next step will show you prerequisite failure (if any).Prerequisite check is integrated in setup. You will get information for failures like some download links etc.

Next you get screen to input information about management server. You can specify if it is first management server in new management group or second management server in existing management group.

You can specify name of management group here. You will get screen to specify operations database. We need to install both operations database and data warehouse in SCOM 2012. Installing Data warehouse has become mandatory in 2012 as compared to SCOM 2007. We need data warehouse for things like dashboards etc. If this is second management server you can click on Add a management server to existing management group option.

After specifying the required information about Operations database, and clicking on next, you get similar screen for Operations manager data warehouse.

Next screen would be to configure operations manager accounts.

You can specify the required accounts on this screen and click on next to complete the setup. This setup will automatically assign local administrators group on server to OM admin role. Once you enter account information here, it will be automatically verified in the background. You will get Red Cross, in case account cannot be verified.

After this you get option to participate on CEIP and Error reporting. And then you can get option for configuring Microsoft Updates.

Last screen will provide you with Installation summary. Clicking on Install will start the Installation. Once finished, you are all set to monitor your infrastructure. Some on the great features in OM 2012 are dashboards, Network Monitoring , Application Monitoring etc.

You can check the deployment guide for Operations Manager 2012 here

Thanks for Reading!!