Stefan Stranger's Weblog - Manage your IT Infrastructure

"People are strange when you're a stranger" (The Doors) Link to my personal Lifestream

May, 2008

  • Passed OpsMgr Configuring Exam (070-400)

    Today I did my Microsoft System Center Operations Manager Configuring Exam and passed with a score of 980 points. Still room for improvement…

    I thought it was easy, but I work with the product every day and I still love it ;-)

  • OpsMgr 2007: Parameters Explained

    Some time ago I showed you can use PowerShell to create Events for OpsMgr 2007. And according to the comments quite some people have questions about Event parameters. After creating the first version of the PowerShell Create Events for OpsMgr 2007 script, Ken added some functionality and one was modifying the question to not only add a EventLog Description but also a EventLog Parameter.

    I found some info on MOM 2005 parameters on Rory McCaw’s weblog, but except that article I could not find much info on Event Log parameters. So hopefully this will explain what parameters are and how they can be used in OpsMgr 2007.

    EventLog Parameters in the Events

    Every Windows event has description text that is filled in by the values of different parameters. You can find the Eventlog parameters of an event by using the Log Parser. (if you know an easier way on Windows 2003 Servers let me know). Log parser is a powerful, versatile tool that provides universal query access to text-based data such as log files, XML files and CSV files, as well as key data sources on the Windows® operating system such as the Event Log, the Registry, the file system, and Active Directory®.

    Example of EventLog Parameters in an Eventlog:

    C:\Program Files\Log Parser 2.2>LogParser.exe "SELECT Top1 Strings AS Parameters FROM Application WHERE EventID=301"


    So in this example you can use four parameters in your OpsMgr Rules or Monitor.

    Event Parameters in OpsMgr 2007

    Eventlog Parameters can be used in OpsMgr Rules and Monitors. An example where you can find EventLog Parameters used is the Windows Activation State Monitor in the Windows Server 2003 MP. This is a 3 State Event Log Monitor and this monitor looks for EventLog Parameters and the values found in the Eventlog change the state of the monitor.

    Healthy:    Look for EventId 1006 in Application Log of Source Windows Product Activation
    Warning: Look for EventId 1005 in Application Log of Source Windows Product Activation and Params/Param[1] > 6 =< 15
    Critical:   Look for EventId 1005 in Application Log of Source Windows Product Activation and Params/Param[1] =< 6


    You can use the PowerShell Create Events script from Ken to test your monitors or rules with with one EventLog parameter. So it won’t work if you need to test a Rule or Monitor which uses more than one parameter in the Eventlog.

    So if you want to test the Windows Activation State Monitor and want to Change the State to Critical, you need to create an Event with the next values:

    EventID 1005
    Source Windows Product Activation
    Type Error
    Description Your Windows product has not been activated with Microsoft yet. Please use the Product Activation Wizard within <number> days.

    More info about this event can be found on EventID.Net


  • New version of PowerShell Event Creator for Operations Manager 2007

    Some month ago I created a PowerShell Event Creator and quite some people liked what I did ;-) Now Ken has made some great additions to this PS script. How cool is that?

    This are the additions he made:

    1. Modification so that you can log events in any Event Log using the Source to look up which log to use
    2. Check added to ask if the user wants to create the missing Source in the Application log rather than just creating it, never know when you will msispell a source ;-)
    3. Modified the question for description to also say or Params/Param[1].

    I've tested it and and I like it.

    You can download the new PowerShell Event Creator here.

    Thanks Ken for making this PowerShell Event Creator script better!

  • Silect MP Studio Lite vs MPViewer

    Feature MP Studio Lite MPViewer
    Register Management Groups 1 Group n.a.
    Multiple views of Management Pack files or installed Management Packs X you need to select a MP to view
    Graphical view of MP references X  
    View Content – rules, monitors, modules, views, tasks X No Modules (use Module Explorer)
    View all overrides applied to an MP X No Overrides (use Override Explorer)
    View by MP or View by Target X n.a.
    Export to XML X X

    So why should you use MPViewer if you have all the features and more in Silect MP Studio Lite? You can easily install and use the MPViewer, it’s only one executable ;-) For some of the missing features you can use other tools (like the Module Explorer and Override Explorer). One thing I’m really missing is the ability (from both) to export the MP to Excel. Export to Excel is available in latest version.

    This should not be that difficult I would think if you use some PowerShell commands. Here an example to export the monitors for the Windows Server 2003 ManagementPack.

    PS Monitoring:\OpsMgrRMS
    >get-ManagementPack | where {$_.Name -like "*Microsoft.Windows.Server.2003*" } | get-Monitor |sort-object LastModified -descending | select-object name, displayname, timeadded, lastmodified
    | export-Csv -Path "D:\temp\exportmp.csv"
    PS Monitoring:\OpsMgrRMS
  • Microsoft Office Visio 2007 Pro SCOM and SCCM Connectors

    Source: Microsoft Download Center

    With Microsoft Visio 2007 Pro the user now has the ability to connect data to diagrams and use data graphics to make the visualization more meaningful and impactful. The OpsManager and ConfigManager Solution for Visio 2007 Pro helps you visualize your key reports. Using the solutions framework which utilizes an easy to configure web server component provided for your environment you can now easily connect data from OpsManager and ConfigManager in Visio 2007 Pro. Download the Visio add in and the web server component to connect and generate datasets to connect to your existing diagrams or auto generate your diagrams for your infrastructure monitoring needs. See your data from OpsManager and ConfigManager live in Visio diagrams Today by downloading this valuable Visio Add-in free.

  • Exclusive: Savision Live Maps 2.0

    Savision showed their new version Live Maps 2.0 on MMS, and because I’ve been a beta tester I can already tell you it has some great new features.

    Live Maps Web Console
    The Live Maps web console displays Live Maps maps in Microsoft Internet Explorer (version 6.0 and above). Any map can be accessed directly by using its unique URL.

    Alarm Sounds
    New alerts and state changes can be announced using the new, configurable alarm sound. Alarm sounds can be customized by copying a WAV sound file to %Program Files%\System Center Operations 2007\AlarmSounds.

    Updated Maps
    The following country map templates have been updated:

    • Netherlands
    • France

    The following items have been fixed or improved in this release:

    • Performance while drilling down nested maps has been improved.
    • Refresh error if multiple maps are part of a single dashboard view has been corrected.

    Isn’t it cool you now see the Live Maps in Microsoft Internet Explorer?


    This new release will probably available at the end of next week. Please watch their website for this latest release.

  • OpsMgr 2007 toolbox

    There are so many tools currently developed that it is hard to know where to find them. Here is a list that I know of maybe it’s helpful to you.

    Please let me know if I’m missing one.

    Tool Purpose Description Author Website
    Mpviewer 1.7 MP viewing Browse for both MP and XML files.Export to Excel and HTML. Boris Yanuspolsky OpsMgr++
    ModuleExplorer v2 MP Module Viewing Provide some visibility into the library of modules and information about each module Boris Yanuspolsky OpsMgr++
    OverrideCreator MP editing utility that allows you to multiselect a number of rules/monitors/discoveries and create an override to either disable them or enable them Boris Yanuspolsky OpsMgr++
    Run As profile configuration helper v1 MP Authoring Will allow you to configure a RunAs profile for agents in bulk Boris Yanuspolsky OpsMgr++
    Override Explorer v3.3 MP Viewing View what overrides exist in a management group Boris Yanuspolsky OpsMgr++
    InstallTool MP Authoring Remove override references from the MP you are trying to remove R. Brennan Secure Vantage Team Blog
    Eventlog Explorer Testing and debugging Helps in exploring NT Eventlog sources installed on a local machine and design and fire user selected sets of events involving multiple sources with one button click Zbigniew Butor Operations Manager Product Team Blog
    MP2XMLDumper MP Viewing Export of specific management packs by partial name criteria Clive Eastwood OpsMgr, SCE and MOM Blog
    MgInfo Shows
    Displays licensing, and some summary information about your management group Clive Eastwood OpsMgr, SCE and MOM Blog
    ProxyCFG Configure/View Configure/view agent proxy (Cmd) Clive Eastwood OpsMgr, SCE and MOM Blog
    ProxySettings v1.1 View Proxy Settings Configure/view agent proxy (GUI) Operations Manager Product Team
    AgentMM Maintenance Mode Puts OpsMgr agents into maintenance mode Clive Eastwood OpsMgr, SCE and MOM Blog
    Windows PowerShell Scriptomatic MP Authoring  Utility that writes WMI scripts for system administration  Ed Wilson  Microsoft Download Center 
    My Log File Viewer Utility  Testing and debugging  Lets you view System Center Operations Manager 2007 Server/Agent Event logs on a remote computer   Jeevan Bisht  Manageability Team Blog 
    Data Warehouse Data Retention Policy (dwdatarp.exe)  Configure/View Allows you to view and configure the data warehouse data retention policies configured within your Operations Manager DW  Daniel Savage  Operations Manager Product Team Blog 
    System Center Content Search Gadget   Knowlegde This gadget makes it easier to find help for Microsoft System Center products because it uses Live Search macros to search specific sites instead of the entire web  Chris Scoville  Live Gallery 
    OpsMgr Linear Explorer Build 316 View  This tool allows you to explore the lineage of OpsMgr MP elements. Vin DiPippo SCOMNIVORE
    OpsMgr Cleanup tool View  Command-line utility that enables you to remove all the components of Operations Manager 2007 from a local computer in cases where the typical method of removing applications through Add or Remove Programs in Control Panel fails Walter Chomak Walter Chomak's System Center Operations Manager 2007 Landing Zone
    SCOM Remote Maintenance Mode Scheduler Management GUI based tool that lets administrators easily schedule maintenance mode for a server or group of servers inside System Center Operations Manager 2007. Tim McFadden Everything System Center Operations Manager 2007
    OpsMgr Alert Closer Management Command line tool that connects to the SDK service on the RMS, retrieves all open alerts, then resolves them. Jeremy D. Pavleck Pavleck.Net
    Log Smith for Operations Manager Management Log Smith connects to your Root Management Server (SDK Service) to gather and display events in a much more flexible way than the original Operations Console. Stefan Koell Code4Ward
    OpsMgr 2007 - RuntimeHealthExplorer Management Tool helps someone with investigation of health state issues Marius Sutara Notes on System Center Operations Manager
  • Why not use Twitter as MP Notifier?

    I’m trying to use Twitter more and more and why should not we use it for notifying about new OpsMgr downloads? I’ve created a “tweet” about the Remote Operations Manager 2007 Deployment Guide and RelNotes available on Microsoft Download Center.

    Scott Hanselman has written an excellent article about Twitter: The Uselessfulness of Micro-blogging. Maybe we can use Twitter a message bus for OpsMgr MPs or downloads?

    Any thoughts about the idea? Please let me know.

  • New PowerShell Event Creator for Operations Manager 2007


    Did you remember the Event Creator for MOM 2005 which was available in the Resource Kit? You could use this tool to create events for testing Management Packs. Event Creator enables you to choose event sources for the existing event logs that are currently registered. You can probably use this tool also for testing in your OpsMgr environment but why not use PowerShell?

    You have at least installed PowerShell on you Management Server(s) so why not use PowerShell to create events for testing?

    With some help from the PowerShell Guy I created a PowerShell script to create events in the eventlog.

    # Description:     Create Events in Application log
    # Date:                03-05-2007
    # Author:            Stefan Stranger
    # Explanation:    If you only wish to write to the event log you must do two things. The first is to create or specify a Source. 
    #                         The second is to call the WriteEntry method. The source would be your application name, by default,
    #                         if you create a source that is new then your log entry will be written to the Application Log.
    #                         To WriteEntry method does the actual writing to the Event Log.

    #                         ev.WriteEntry(My event text, System.Diagnostics.EventLogEntryType.Information, myeventid)

    #Check if user is admin
    function get-Admin {
    $ident = [Security.Principal.WindowsIdentity]::GetCurrent()
    foreach ( $groupIdent in $ident.Groups ) {
    if ( $groupIdent.IsValidTargetType([Security.Principal.SecurityIdentifier]) ) {
    $groupSid = $groupIdent.Translate([Security.Principal.SecurityIdentifier])
    if ( $groupSid.IsWellKnown("AccountAdministratorSid") -or $groupSid.IsWellKnown("BuiltinAdministratorsSid")){
    return $TRUE
    return $FALSE

    $Result = get-Admin

    if ($Result -eq $FALSE) 

    write-host "Better be an admin for this script."


    function Write-EventLog { 
    param ([string]$msg = $(read-host "Please enter a Event Description"), [string]$source = $(read-host "Please enter Event Source"), [string]$type = $(read-host "Please enter Event Type [Information, Warning, Error]"), [int]$eventid = $(read-host "Please enter EventID"))

    # Create the source, if it does not already exist.

    write-host "Source exists"

    # Check if Event Type is correct
    switch ($type) 
    default {"Event type is invalid";exit}


    $log = New-Object System.Diagnostics.EventLog 


    Write-Host "Event created"

    Or you can download the PowerShell script from the PowerShell Code Repository.

  • RSS2Twitter PowerShell script

    As you might have noticed I’ve been using Twitter quite often lately. On my previous weblog I installed a Drupal Twitter module for updating Twitter with my latest blog posts. But now I migrated to Technet Blogs I didn’t had this possibility anymore, so I looked for an easy way to have my latest blog posts updated to Twitter.

    I searched for “rss2twitter” on Windows Live Search and found a perl script but that didn’t work for me. It just failed with the next errors:

    Malformed UTF-8 character (1 byte, need 4, after start byte 0xf1) at C:\Temp\rss
    2twitter\rss2twitter.exe line 128.”

    So I though why not use PowerShell? With the help of Out-Twitter from Doug Finke it was quite easy.

    So here is the PowerShell RSS2Twitter script:

    # Rss2Twitter PowerShell Script
    # Stefan Stranger 2008
    # Retrieve last post from RSS feed and post to Twitter Account
    # Out-Twitter function from Doug Finke (

    function Send-TwitterStatus($status)
    # Enter Twitter Username and Password
    $userName = "twitteraccount"
    $password = "password"

    $url = ""
    $data = "status={0}" -f $status

    $request = [Net.WebRequest]::Create($url)
    $request.Credentials = New-Object System.Net.NetworkCredential($userName, $password);
    $request.ContentType = "application/x-www-form-urlencoded";
    $request.Method = "POST";

    $bytes = [System.Text.Encoding]::UTF8.GetBytes($data)

    $request.ContentLength = $bytes.Length

    $requestStream = [System.IO.Stream]$request.GetRequestStream()
    $requestStream.write($bytes, 0, $bytes.Length)

    $response = $request.GetResponse()
    $reader = [System.IO.StreamReader]$response.GetResponseStream()


    #Enter rss feed from where you want update Twitter
    $wc = New-Object Net.WebClient
    $rss = [xml]$wc.DownloadString($uri)
    $posts = $ | Select-Object title, link
    #Retrieve last post on RSS feed page.
    $lastpost = $posts[0].title + ' ' + $posts[0].link

    #Post to Twitter
    Send-TwitterStatus $lastpost
  • Rule and Monitor Targeting Best Practices Poster

    Below is a link to a targeting poster that we have created to help select the proper targets when creating rules and monitors. The poster illustrates some of the most common scenarios and provides best practices on how to properly target rules and monitors.

  • Evaluation of SCCP 2007 by Ian Blyth

    Source: Ian Blyth

    Ian gives a clear evaluation of System Center Capacity Planner for OpsMgr 2007.

    “I can say now that I am very disappointed with it and can’t see me using it at all even if it is the official sizing tool.”

    The only thing I can say, I’ve used it a couple of times to check my own designs with the results of SCCP. Just have a look if it’s a useful tool for you or not.

    Here is a link to the System Center Capacity Planner Download Catalog.

  • New Updates for Management Packs

    WSS 2.0 (2003) Management Pack. Release date: /27/2008.

    Terminal Services 2000/2003 MP for OpsMgr 2007. Release date: 5/27/2008.

    SharePoint Portal Server 2003 MP for OpsMgr 2007. Release date: 5/27/2008.

    Windows 2000/2003 IIS Management Pack for OpsMgr 2007. Release date: 5/27/2008.

    Microsoft Information Worker Management Pack. Release date: 5/27/2008.

    Window Client 2000/XP OS MP for OpsMgr 2007. Release date: 5/27/2008

    Windows Server 2000/2003 OS Management Pack Release date: 5/27/2008

  • Management Pack for SAP Monitoring

    Source: RealTech

    REALTECH's newly developed Management Pack for SAP Monitoring is one of the first integration modules to use the .NET interface of Microsoft System Center Operations Manager 2007 to display real-time information on the availability, performance, and error status of any SAP NetWeaver component. Thanks to the seamless integration of the management pack, Operations Manager will continue to be the primary system.

    A colleague of mine found this Management Pack for SAP and this is not on the System Center Pack Catalog.

    Anybody any experience with this MP? Please leave a comment.

  • Management Packs Guides Online

    Source Jeanie Decker and Raymond Chou

    "The Management Pack Guide library is now live on TechNet. About half (23) of the Operations Manager 2007 guides are available in the library now, with the rest to be added over the next few weeks. The guides are organized into Operating Systems & Technologies and Server Products for easier browsing.

    I (Jeanie) almost forgot to add...we've included the Community Content widget on all of the online guides, which means you can add tags and submit your own content to enhance the information in the guides.”


  • Documenting your OperationsManager Database? Use SqlSpec!

    Today I stumbled on a great tool for documenting your database SqlSpec 3.7 from Elsasoft.

    SqlSpec will generate easy-to-read database documentation for any of the following platforms:

    • SQL Server 2000, 2005, and above
    • Analysis Server 2005
    • Oracle 9i and above
    • DB2 8.2 and above
    • Sybase ASE 12.0 and above
    • Informix IDS 10.0 and above
    • PostgreSQL 8.0 and above
    • MySQL 5.0 and above
    • Access 97 and above
    • VistaDB 3.0 and above
    • ENEA Polyhedra 7.0 and above

    You can read more about the many features of SqlSpec here.

    But we as System Center specialists are probably mostly interested in our SQL Server 2005 OperationsManager, OperationsManagerDW and ReportServer databases;-)

    So I connected SqlSpec to my OperationsManager database and let it run (for some time).

    And when it's finished you can view you the complete OperationsManager database in a Compiled HTML file or in a Webbrowser. You even have a Dependency Graph for for instance the Alert Table. How cool is that!

    If I find more interesting info with this tool about the OperationsManager databases I'll let you know.

  • TechNet Magazine - January 2008

    TechNet Magazine spend a great deal of time introducing you to what System Center can do for you. Whether it's managing your virtual machine environments to keep abreast of needs and performance, or using new Asset Inventory Service from Microsoft to keep an eye on the software you deploy inside your organization, System Center has you covered.

    Check it out!

  • Conversion issue Symantec Backup Exec 11d MOM MP to OpsMgr 2007 MP

    Source: Forum

    One of our members of the Forum found a solution for an issue when converting the MOM 2005 MP for Symantec Backup Exec 11d to OpsMgr 2007 MP.

    During the import of the converted MP you see the next message "The client has been disconnected from the server. Please call ManagementGroup.Reconnect() to reestablish the connection. The communication object, System.ServiceModel.Channels.ServiceChannel, cannot be used for communication because it is in the Faulted state."

    If you look in the eventlog you see that the time notation is not correct. If you remove the next lines from the xml:

                  <After>02/22/06 20:10:49</After>

    It should work.

    Thanks to Cor.

  • Using OpsMgr 2007 RC1 SP1? Update your MP's

    Source: Kevin Holman's OpsMgr Blog

    "One step it seems people often overlooks when upgrading to OpsMgr 2007 RC1 SP1 - is to update their management packs.

    The management packs that ship with the product are RTM version (6.0.5000.0)

    Often, users will have updated many of their Management Packs to the latest version available on the web.... from the catalog:

    However.... a step often overlooked when upgrading to the RC1-SP1 version of OpsMgr - is that you should update your MPs to the SP1 version.  These are included in the SP1 media in the \ManagementPacks directory.  The correct version is 6.0.6246.0 for RC1-SP1 MP's."

    Read more at source.

  • Xian Io Video

    Source: Bernardo Sanchez Blog

    In this video you get a quick overview of how Xian Network Manager Io works with System Center Operations Manager 2007. Focus will be on:
    - Adding devices / servers
    - Adding monitoring rules
    - performance data and alerts in OpsMgr 2007
    - Xian Io Reports within OpsMgr 2007


    You can download the video here.

  • Operations Manager 2007 SP1 tracing

    Source: Notes on System Center Operations Manager

    "As described in this KB article, OpsMgr2007 is using ETW/WPP tracing which was not very customer consumable. The conversion to readable text was required with the use of TMF files which did not ship with RTM version of the product. So decision was made and things changed with SP1 release (and such were also present with SP1 RC)."

    Read more on source.

  • OpsMgr email notifications with high importance

    Source: Microsoft Internal

    Have you ever wanted to send e-mail notifications with the high importance flag set?

    It's possible but you have to start your favorite XML editor ;-)

    Modifying Microsoft.SystemCenter.Notifications.Internal MP XML to Support Email Priority/Importance


    1. From the “Administration” space in the UI, export the Microsoft.SystemCenter.Notifications.Internal management pack.
    2. Open the management pack XML file in an XML or text editor.
    3. Search for the recipient name, typically in the format DOMAIN\username.
    4. Get the recipient ID from between the <RecipientID>…</RecipientID> tags.

    5. Find the subscription that contains this recipient ID.

    6. Find the <WriteAction> tag in this subscription.
    7. Get the type ID from the TypeID attribute in the <WriteAction> tag.
    8. Start at the beginning of the management pack XML.
    9. Find the write action module that matches the type ID.
    10. Find the </IsBodyHtml> end tag.
    11. Insert the following XML after the </IsBodyHtml> end tag:  <Headers><Header><Name>X-MSMail-Priority</Name><Value>High</Value></Header></Headers>
    12. Save the file.
    13. Import the modified management pack XML, confirm to overwrite the existing one

    Once the new management pack is active, recipients should see subsequent email messages from subscriptions that use the modified write action modules display the new priority attribute.

    You can also support priority levels for non-MS clients using the X-Priority header with a numeric value, e.g. <Headers><Header><Name>X-Priority</Name><Value>5</Value></Header></Headers>.

    This is tested this in our lab using the SP1 RC and RTM builds of SCOM 2007.  The mail clients used for testing were Outlook 2003 and Outlook Express 6.



    This sample is not supported under any Microsoft standard support program or service. This sample is provided AS IS without warranty of any kind. Microsoft further disclaims all implied warranties including, without limitation, any implied warranties of merchantability or of fitness for a particular purpose. The entire risk arising out of the use or performance of this sample and documentation
    remains with you. In no event shall Microsoft, its authors, or anyone else involved in the creation, production, or delivery of this sample be liable for any damages whatsoever (including, without limitation, damages for loss of business profits, business interruption, loss of business information, or other pecuniary loss) arising out of the use of or inability to use this sample or documentation, even if Microsoft has been advised of the possibility of such damages.
  • Meeting the OpsMgr heroes

    Yesterday I arrived for my three weeks internal Microsoft Services Training in Redmond and today I still had some time to spent and so I emailed Justin Incarnato to ask if I could meet some of the OpsMgr team members. Luckily he had some time and together with my German Premier Field Engineer colleague Uwe Stuertz we visited the Microsoft Campus where the OpsMgr team is working.

    Now I could finally see the faces of Justin Incarnato, Dhananjay Mahajan, Marius Sutara and many others who I only "speak" via email of conf calls. How cool is it to meet your heroes?



    From left to right (Uwe, Justin and me ;-)

    So for you MVP guys. This is the room of Justin where the MVP conf calls take place. It's a small room...

  • New MPViewer version by Boris

    Source: Boris Yanushpolsky

    Boris has released a new version of his already famous MPViewer. It's version 1.3.

    Check out his website for more info.

    Maybe I should try to contact Boris when I'm here during my internal Microsoft Services training so I can ask if he can implement an auto update feature in his MPViewer ;-)

  • Language issue in Create Performance Rule Wizard?

    Yesterday I've been busy finding out which Performance Thresholds are used for OpsMgr performance monitoring. The reason why, was because we got a Performance class training during my internal Microsoft training. Learned quite some new interesting stuff about Performance monitor and the Reliability and Performance Monitor from Vista.

    If I've some more time I'll blog about the Performance Rules used by OpsMgr. But here is what I've found during the creation of a Performance Rule. There is German text in some of the screens. "Weniger Daten werden in der Datenbank"


    Strange because I'm not using any German client or something else. Am I the only one?