System Center Operations Manager

The Operations Manager product group is looking for feedback on how you author custom Management Packs for System Center Operations Manager 2007, as well as areas where we can improve. Please take this survey to help guide future authoring investments.

The survey is anonymous and should take about 10 minutes to fill out.

We appreciate your time and feedback

Do you use the Windows Server Print Server role in your environment?  Are you using the either of the print server management packs for OpsMgr 2007?  Do you use the print management console?  If you answered yes to any of these questions then we would greatly appreciate your input to help form the future manageability plans for the print server role.  Head over to the OpsMgr public Connect site and fill out the "Print Server Management Survey".

Registration to the Connect program only requires a Windows Live ID.  The survey is anonymous and should take about 5 minutes to fill out the 11 questions.

Thank you in advance for your time and your feedback.
-Cory Delamarter

I am a big Powershell fan, and I use the Powershell console regularly.  Depending on what I’m taking care of at the time, I might be using the plain vanilla console or I might be using the Operations Manager snapin to work with the latest builds of our product.  In both contexts, I find that a tab expansion feature makes my life a lot easier.  Powershell V1 had tab expansion support, and with Powershell V2 the tabbing capabilities have been greatly enhanced.

One bad thing I found with V2 tab expansion is that it is SLOOOW to autocomplete cmdlet names when using the Operations Manager snapin.   Typing something like “Get-Aler[TAB]” or even a standard cmdlet like “Select-Stri[TAB]” would sometimes hang your console for minutes.  This came up on the SCOM newsgroup recently, so it is clearly a problem for a fair number of folks.

So what’s the root cause of this?

In certain cases, when you try to tab expand, Powershell attempts to autocomplete to the name of an object in the current prompt location.  For example, if navigate to C:\Windows\System32 and type “user32[TAB]”, Powershell autocompletes to “.\user32.dll” as expected.  This isn’t anything new for cmd.exe users, but what’s cool is that this behavior can be enabled by any Powershell provider, so it isn’t limited to the file system.  Try moving to HKLM:\SOFTWARE, typing “microso[TAB]”, and the Powershell Registry Provider supplies the information which allows this to autocomplete out to “.\Microsoft”.  Very smooth, consistent experience.

Everything works really fast for providers like the file system and the registry, but things can sometimes take (much) longer with the Operations Manger provider.  To enable tab expanding the names of Groups and Monitoring Objects in the Ops Mgr provider, behind the scenes a few queries need to be sent all the way to the ops DB, results collected, and .NET objects built and sent back over the wire to your session.  This is what’s bogging down your prompt, especially if you are on a remote machine.

The fix is to tweak the TabExpansion function in V2 so that it doesn’t try to autocomplete child objects if using the Ops Mgr provider.  This can be done via the below script.  Paste this into your console session, or better yet add it to your profile, and tab expansion for Ops Mgr cmdlets will work much more quickly.

Note this only works for Powershell V2, and only if you have not already modified that line of the TabExpansion function.  In Powershell V1 more of the tab completion is handled in the engine so unfortunately a similar speedup is not possible in this case.

Trying it out:

I’ll take a 1,000x speedup any day!

-Lincoln Atkinson

Overview:

In Operations Manager, the Gateway server role is primary used for monitoring servers outside the Root Management Servers trusted Domain boundary.  Another popular  use of the Gateway role is for performance improvements by placing gateways in sites with poor network connectivity.  Sometimes it is necessary to “chain” multiple gateways together to get monitor across multiple untrusted boundaries.

For Example, say you have a scenario that looks like the following:

Here we have a management group installed in the “My Company” network.  The Admin has the requirement to monitoring the machines in the “DMZ” network.  There is no direct connection between the “My Company” network and the “DMZ” network without first going through the “ExtraNet” network.

How to setup chained Gateways?

To minimize the chance of configuring things wrong, install 1 gateway at a time starting with the one reporting directly to an existing MS or the RMS, and moving “out.”  Verify newly installed gateways are properly communicating, downloading MPs, etc before attempting to install the next one in the chain.

The actual install steps are identical for any gateway, whether reporting to an MS/RMS or chained to another gateway.

1. On the RMS, run the GatewayApprovalTool

a. /ManagementServerName:<FQDN of existing server (RMS, MS, or gateway) which the new gateway will report to>

b. /GatewayName:<FQDN of the new gateway>

2. Install the gateway bits on the new machine

3. If needed, configure certificates to establish trust between the new gateway and the server it reports to

Here is the tricky part: Configuring certificates between two gateways is no different than configuring certificates between an agent and a gateway, or a gateway and a MS or RMS.  The same certificate settings are required, the same tools are used to request, install, and import the certs.  A healthservice can only load and use a single auth certificate, so in the chained scenario the same certificate will be used by the gateway to authenticate to its parent and to any children.  The parent and child(ren) must both trust the Certificate Authority which issued the gateway’s cert.

Supported Configurations:

Simple:

Here the RMS loads a cert from CA1 and is configured to trust CA1 as its root certificate authority.  GW1 loads a cert issued from CA1 and trusts CA1.  GW2 loads a cert issued from CA1 and trusts CA1.

Complex:

Here the RMS loads a cert from CA1 and is configured to trust CA1 as its root certificate authority.  GW1 loads a cert issued from CA1 and trusts CA1 and CA2.  GW2 loads a cert issued from CA2 and trusts CA1.

Unsupported Configuration:

Here the RMS loads a cert from CA1 and is configured to trust CA1 as its root certificate authority.  GW1 loads a cert issued from CA1 and CA2 and trusts CA1 and CA2.  GW2 loads a cert issued from CA2 and trusts CA2.  This is not possible because GW1 cannot load more than one certificate in it’s health service communication channel.

FAQs:

Q1. In the supported complex configuration, doesn’t GW2 also need to trust CA2?
A1.  No, since GW1 presents a cert from CA1, and this is the only cert GW2 needs to trust.  GW2 never needs to verify the trust of a CA2 certificate (HealthService only check settings of the cert it loads, not that it comes from a trusted CA) so it doesn’t NEED to have that CA trust cert.  A machine only needs to trust the incoming certificate from parent or child, it does not need to trust the one it has loaded.

Hope this helps!  I will update FAQs as I get more questions.

Technical content was provided and tested by Lincoln Atkinson.  Thanks Lincoln!!

Rob Kuehfus | System Center Operations Manager | Setup and Deployment Program Manager

This is supplied "as -is" with no support. In addition, my thoughts and opinions often change, and as a weblog is intended to provide a semi-permanent point in time snapshot you should not consider out of date posts to reflect my current thoughts and opinions.

Folks - get your RSS feeds ready and subscribe to Michael's blog.  If you have ever needed support from the product group on perf and scale, you have most likley come in contact with Michael.  I am really excited to announce his new blog.  Check it out!

---

Hello everyone, my name is Michael Pearson.  I’m a Performance and Scalability tester on the Operations Manager test team.  My focus is on UI Performance and UI Scalability for both the Operations and Web Consoles.  I’ve got a background in hosted applications development, SQL Server performance, hardware (especially disk subsystems), and software testing.

On my blog, I want to cover topics that will allow Operations Manager Admins make their systems perform better and help them troubleshoot things when they aren’t.  I also want to relate customer issues that the Performance and Scalability team has encountered and how we’ve helped to resolve them.

Michael Pearson

http://blogs.technet.com/michaelpearson/

Many people have asked how MP import works and how do MPs get down to the health service. Hopefully this diagram helps explain some of this.

Satya

To follow the recent general availability of Windows 7, the updated Client Operating System management pack to support Windows 7 systems is now available. The updated package can be downloaded here. The following is a summary of the major updates in this release:

·         Support for discovery and monitoring of Windows 7 Client machines

·         Aggregate client monitoring for Windows 7 systems

·         Business critical monitoring for Windows 7 systems

·         Vista MP: fixed several rules to ensure that all potential event logs are looked at when checking for error conditions

·         Vista MP: added object picker functionality to reports to ensure a better reporting experience with OpsMgr 2007 R2

·         Vista MP: fixed Logical Disk Availability and Network Adapter Connection monitors to change state at correct conditions

·         Vista MP: updates to display strings and knowledge articles

Jakob Gottlieb Svendsen with the help of Kåre Rude Andersen have written an MP to monitor their coffee pot. Watch the video that they posted: http://www.youtube.com/watch?v=U0_WsgR6hPw&feature=player_embedded. Another awesome way to use OpsMgr.

Link to article:

http://blog.coretech.dk/opsmgr07/opsmgr-2007-r2-scom-coretech-coffee-monitor-management-pack-0001/

Satya Vel

As a follow-up to the OpsMgr 2007 R2 MP update announced here, we've now also released the corresponding update for OpsMgr 2007 SP1.  This updated MP package can and should only be imported onto OpsMgr 2007 SP1 environments and includes a number of fixes that were provided in R2 and the most recent update to the OpsMgr 2007 R2 MP.  Following is a summary of the changes in this release and a more detailed account of the changes is included in the MP Package which you can download from the MP Catalog:

Changes in common with the most recent R2 MP Update:

• Updated the layout and default filters and sort order for a number of views.
• Fixed an issue that was previously preventing all rules related to AEM from generating alerts.
• Added display names, descriptions, and product knowledge where missing.
• Added the rule “Collects Opsmgr SDK Service\Client Connections” to collect the number of connected clients for a given management group.  This data is shown in the view “Console and SDK Connection Count” under the folder “Operations Manager\Management Server Performance”.
• Updated a number of monitors and rules to ensure that data is reported to the correct management group for multihomed agents.
• The following rules and monitors are now disabled by default as they are generally not actionable:
• A GroupPopulator module unloaded due to an unrecoverable error
• Health Service Cannot Find Management Group
• Data Validity Check
• Root Connector Data Validity Check
• Updated the alert suppression criteria for the rule “Alert on Dropped MultiInstance Performance Module” in order to significantly reduce the alert volumes generated by this rule and make it easier to identify the root cause.

Changes specific to this SP1 Update, which were made in the initial R2 MP release:

• The implementation that triggers the “Restart Health Service” recovery was changed to be driven by monitors as opposed to rules, to address a number of shortcomings in the previous design.
• Changed the default severity and priority of alerts raised by the “SDK Spn Registration” rule from “warning” to “critical” and updated the knowledge for the rule significantly.
• Added the “Communication Certificate Expiration Check” monitor to monitor certificate expiration for untrusted domain endpoints (agents, gateways, servers) and alert before the certificate expires.
• Fixed an issue with the “Management Configuration Service - Windows Service State” monitor so that it will properly generate alerts for the state of the “OpsMgr Config Service” on a clustered Root Management Server.
• Fixed the “Operational Database Space Free (%)” monitor to compute free space based on maximum data file size, rather than maximum data and log file sizes combined.
• Updated the workflows that drive the state of the “Computer Not Reachable” monitor to handle the condition when the computer’s name does not resolve. 
• Added additional criteria to the rule “WMI Raw Performance Counter Module Execution Failure” to account for some event IDs that were not being detected.
• Removed criteria from the rule “Performance Data Source Module could not find a performance counter” to avoid generating alerts on warning events.

An update to the Windows Network Load Balancing Management Pack has been released.

The main themes of this release are

·         Support for discovery and monitoring of Windows Server 2008 R2 NLB clusters

·         Noise reduction

Shown below are snapshots from some of the tools available in the authoring resource kit which can be downloaded from here

MP Best Practices Analyzer

MP Spell Checker

MP Visio Generator

Workflow Simulator

An update to the Windows Failover Clustering Management Pack has been released.

Some of the updates in this release are

·         Support for discovery and monitoring of Windows Server 2008 R2 clusters and functionality such as Cluster Shared Volumes

·         MP scalability improvements (the MP supports monitoring of 300 resource groups per cluster)

·         Noise reduction, for example clustered resources are no longer discovered and monitored by default (resource groups are monitored by default)

I am very pleased to announce that the System Center Operations Manager 2007 R2 Authoring Resource Kit has RTW’d.

It can be downloaded from : http://www.microsoft.com/downloads/details.aspx?FamilyID=9104af8b-ff87-45a1-81cd-b73e6f6b51f0&displaylang=en

·         The resource kit ships the following features:

o   Authoring Console

o   Management Pack Best Practices Analyzer

o   Management Pack Spell Checker

o   Management Pack Visio Generator

o   Management Pack Diff

o   Management Pack Cookdown Analyzer

o   All References Addin

o   Workflow Analyzer

o   Workflow Simulator

o   System Management Packs

Below is a quick summary of these features.

Authoring Console

o   Develop Management Packs within a GUI environment.

Management Pack Best Practice Analyzer (MPBPA)

o   MPBPA scans management packs for best practice compliance and provides automated resolution for numerous issues. This tool integrates with the Authoring Console.

Management Pack Spell Checker (MP Spell Checker)

o   MP Spell Checker checks spelling in management packs to eliminate errors in display strings.

Management Pack Visio Generator (MP Visio Generator)

o   MP Visio Generator allows you to generate a class inheritance and class relationship diagram using Microsoft Office Visio.

Management Pack Diff (MP Diff)

o   MP Diff shows the differences between two management packs.

Management Pack Cookdown Analyzer (MP Cookdown Analyzer)

o   MP Cookdown Analyzer identifies workflows which may break cookdown. Suggestions are provided for how to fix the performance problems.

All References Add-in

o   All References Add-in helps find all management pack elements that reference the specific element chosen. For example, the ability to right click a class and find all rules, monitors, overrides, as well as anything else that targets that class is provided. This tool works on most management pack elements.

Workflow Analyzer

o   The Workflow Analyzer provides the ability to statically analyze all types of workflows. It also allows users to trace workflows running on any Health Service.

Workflow Simulator

o   The Workflow Simulator provides the ability to test certain types of workflows such as discoveries, rules, and monitors without a Management Server and Management Group. Key functionality includes the ability to test workflows as well as view and validate output prior to signing and importing the MP into a Management Group for additional testing.

Management Packs

o   Three management packs which are frequently used as dependencies are provided as part of the tools installation. These MPs are necessary to allow the Authoring Console to open most MPs available online in the System Center Operations Manager MP Catalog. The provided MPs are:

Microsoft.SystemCenter.DataWarehouse.Report.Library

Microsoft.SystemCenter.InstanceGroup.Library

Microsoft.SystemCenter.ServiceDesigner.Library

Screenshots and more information on how to use the tools effectively to make authoring simple for Operations Manager would be coming out soon.

Happy MP Authoring!

The storage team at Microsoft has just announced their release of the DFS Replication Management Pack for Operations Manager 2007.

Supported operating systems:

• Windows Server 2003 R2
• Windows Server 2008

Supported monitoring platforms:

• System Center Operations Manager 2007 SP1
• System Center Operations Manager 2007 R2

More information is available in their blog post at http://blogs.technet.com/filecab/archive/2009/10/19/dfs-replication-management-pack-for-operations-manager-2007-is-available.aspx.