Systems Management

Altiris - Best Practice references for Symantec Management Platform 7.1

2011-11-08T10:13:00.001+01:00

Best Practice references for Symantec Management Platform 7.1:

http://www.symantec.com/business/support/index?page=content&id=HOWTO35984

Planning and Documentation
Symantec Management Platform 7.1 Release Notes	DOC3397
Symantec Management Platform Support Matrix	HOWTO9965
Altiris™ IT Management Suite 7.1 from Symantec™ Planning and Implementation Guide	DOC3464
Planning for Symantec Management Platform 7.x maintenance activities	HOWTO10336
Symantec Management Platform 7.1 SP1 User Guide	DOC3940
Symantec Management Platform 7.1 Database Schema	DOC3724
Release Notes Available for Symantec Management Platform 7	DOC1737
Finding the IT Management Suite 7.1 SP1 Documentation	DOC4240

Installation and Migration
Altiris Endpoint Management Migrations to 7.1 (Symantec Connect Portal to main articles)	Link
Installing the Symantec Management Platform on VMware	HOWTO9692
Quick Start to Installing with Symantec Installation Manager	HOWTO21666
Upgrading Notification Servers in a hierarchy	HOWTO21657
Migrating to Symantec Management Platform 7.1 and using your current server	HOWTO32427
Altiris™ IT Management Suite from Symantec™ Migration Guide version 6x to 7.1 SP1	DOC3988
Altiris™ IT Management Suite from Symantec™ Migration Guide version 7.0 to 7.1 SP1	DOC3989
FAQ around Migrating Site Servers and Agents to SMP 7.1	HOWTO44933

Backup and Recovery
Backing up the Notification Server database	HOWTO4561
Restoring Notification Server from a backup or upgrading it to new hardware	HOWTO9763

Performance Tuning
Creating a SQL maintenance plan to optimize database performance	HOWTO8589
Optimizing SQL Server 2005 on Windows Server 2003	HOWTO10723
How to create a Performance Monitor counter set for Altiris support	HOWTO6531
Common Performance Monitor counter thresholds	HOWTO9722
Slower than expected performance in .NET 2.0 - based applications on servers with more than 8 logical processors (cores)	TECH156327

Troubleshooting
What information should I collect when troubleshooting Symantec Installation Manager 7.x?	HOWTO9264

SCOM 2007 R2 Comulative Update 5

2011-08-24T07:08:00.002+02:00

Cumulative Update 5 for System Center Operations Manager 2007 R2 is available

http://support.microsoft.com/kb/2495674 (948 MB)

Cumulative Update 5 for Operations Manager 2007 R2 resolves the following issues:

Restart of non-Operations Manager services when the agent is updated.
Updated ACS reports.
TCP Port Probe incorrectly reports negative ping latency.
MissingEvent Manual Reset Monitor does not work as expected.
Drillthrough fails because of rsParameterTypeMismatch in the EnterpriseManagementChartControl.
ACS - Event log message is truncated or corrupted in SCDW.
UI hang caused by SDK locking.
ACS Filter fails for certain wildcard queries.
Edit Schedule button is disabled with SQL 2008 R2.
Web console times out when you open the left navigation tree.
Scheduled Reports view for Windows Server 2003 and for Microsoft SQL Server 2005 Reporting Services SP3 CU9 returns "System.IndexOutOfRangeException: Index was outside the bounds of the array."
Signed MPs cannot be imported when new attributes are added to existing classes.

Cross Platform Cumulative Update 5 for Operations Manager 2007 R2 resolves the following issues:

Performance data for LVM managed partitions is not available.
Process monitor does not keep name if run by using symbolic link.
AIX with large number of processes crashes with bad alloc.

Cross Platform Cumulative Update 5 for Operations Manager 2007 R2 adds the following feature:

Support for Red Hat 6

Links:

CU5 download http://www.microsoft.com/download/en/details.aspx?displaylang=en&id=26938

RHEL 6 MP download http://www.microsoft.com/download/en/details.aspx?displaylang=en&id=18891

KB CU5 http://support.microsoft.com/kb/2495674

SCOM 2007 R2 - Exchange 2010 Management Pack Tuning

2011-08-24T07:02:00.000+02:00

Guidance, Tuning and Known Issues for the Exchange 2010 Management Pack for System Center Operations Manager 2007

http://support.microsoft.com/kb/2592561

- concepts of correlation engine

- scalability issues

- workarounds (registry keys settings, etc.)

SCOM 2012 BETA - Now available

2011-07-20T16:51:00.001+02:00

Public beta is available for download here:

http://www.microsoft.com/download/en/details.aspx?id=26804

Overview

System Center Operations Manager 2012 provides the monitoring component of cloud and datacenter solutions, to help you manage your datacenter and cloud environments by:

    Delivering flexible and cost effective enterprise-class monitoring and diagnostics while reducing the total cost of ownership by leveraging commodity hardware, with standard configurations to monitor heterogeneous environments.
    Helping to ensure the availability of business-critical applications and services through market-leading .NET application performance monitoring and diagnostics plus JEE application health monitoring.
    Providing a comprehensive view of datacenters, and private and public clouds.

Feature Summary

    Predictable performance and availability of critical applications
        End-to-end views of application health and topology
        Establishment of application service-level delivery (SLAs)
        Precise identification of application errors
    Flexible and cost-effective infrastructure monitoring
        In-depth monitoring, diagnostics, and reporting for heterogeneous environments
        Integrated network device monitoring and alerts
        Simplified management infrastructure
    Comprehensive monitoring for your datacenter and cloud—on your terms
        Integrated physical, virtual, and cloud management
        Common console across datacenter and clouds
        Rich reporting

System Center Operations Manager 2012 Beta resources

    Documentation: http://go.microsoft.com/fwlink/?LinkID=213297
    Forums: http://social.technet.microsoft.com/Forums/en-US/category/systemcenteroperationsmanager
    Feedback: https://connect.microsoft.com/OpsMgr/Feedback
    Team Blog: http://blogs.technet.com/b/momteam/

System requirements

Supported Operating Systems: Windows 7, Windows Server 2003 Service Pack 2, Windows Server 2008 R2, Windows Server 2008 Service Pack 2, Windows Vista Service Pack 2, Windows XP Service Pack 3

    Other Software:
        Any server role
            .NET 3.5 and 4.0
        Management Server, Reporting Server, Web Console, Gateway Server
            Windows Server 2008 R2 (64 bit)
        Operational & Data Warehouse
            SQL 2008 SP1 and above
            SQL Collation - SQL_Latin1_General_CP1_CI_AS
        Supported Operating Systems for Operations Manager Agent
            Windows Server 2003 SP2 and above
            Windows Server 2008 SP2 and above
            Windows Server 2008 R2
            Windows XP Professional SP3 and above
            Windows Vista SP2 and above
            Windows 7
            Red Hat Enterprise Linux 4, 5, and 6 (x86/x64)
            SUSE Linux Enterprise Server 9 (x86), 10 SP1 (x86/x64), and 11 (x86/x64)
            Solaris 8 and 9 (SPARC) and Solaris 10 (SPARC and x86)
            HP-UX 11i v2 and v3 (PA-RISC and IA64)
            AIX 5.3, 6.1, and 7.1 (POWER)

    Supported Hardware Configuration:
        Operations Manager Operations database: 4 GB of RAM or higher, 50 GB of available hard disk space
        Management server: 2 GB of RAM or more, 20 GB of available hard disk space
        Operations console: 2 GB of RAM or more, 20 GB of available hard disk space
        Reporting data warehouse: 4 GB of RAM or more, 100 GB of available hard disk space
        Reporting server: 2 GB or more, 20 GB of available hard disk space
        gateway server: 2 GB of RAM or more, 20 GB of available hard disk space
        Web console server: 2 GB of RAM or more, 20 GB of available hard disk space
        Audit database: 4 GB of RAM or more, 100 GB of available hard disk space
        Management server with audit collector: 2 GB of RAM or more, 50 GB of available hard disk space
        Management server with Agentless Exception Monitoring file share: 2 GB of RAM or more, 30 GB of available hard disk space
        Agent: Please refer to the recommended hardware requirement required by the operating system.

SCCM 2012 Beta 2 VHD Download

2011-06-17T13:58:00.001+02:00

VHD Test Drive – System Center Configuration Manager 2012 (on Windows Server 2008 R2).

Download. App. 11 GB

SCOM 2007 R2 - Admin Resource Kit

2011-06-06T12:11:00.000+02:00

System Center Operations Manager R2 Admin Resource Kit was released 3th of June 2011 (version 1.0.0.0).

Available for download here.

Overview

The System Center Operation Manager 2007 Administration Resource Kit provides the following features to aid in management group administration:

    Scheduled Maintenance Mode - Ability to schedule and manage maintenance mode in the management group.
    Clean Mom - Helps remove all installed R2 components.
    MP Event Analyzer - MP Event Analyzer tool is designed to help a user with functional and exploratory testing and debugging of event based management pack workflows like rules and monitors.

Feature Summary:

    Ability to schedule Maintenance mode for “run once”, daily, weekly, and monthly schedules
    Ability to removal all OpsMgr 2007 R2 files from a system
    Ability to debug event based management pack workflows

SCOM 2007 R2 - New management packs portal

2011-05-26T07:59:00.000+02:00

The System Center Marketplace:

http://systemcenter.pinpoint.microsoft.com/en-US/default.aspx

Management packs for SCOM sorted by release date:

http://systemcenter.pinpoint.microsoft.com/en-US/applications/search/operations-manager-d11?sort=released&q=

SCOM 2007 R2 SQL Server Monitoring MP

2011-05-16T07:16:00.001+02:00

SQL Server Monitoring Management Pack was released 6th of May 2011 (version 6.1.400.0)

Download link: http://www.microsoft.com/downloads/en/details.aspx?FamilyID=8c0f970e-c653-4c15-9e51-6a6cadfca363

Update notes:

Minor bug fixes
Fixed sql injection security issues
Updated the “Run As Profiles” section with detailed information about Run As accounts mapping targets (see guide)
Updated the “Changes in This Update” section (see guide)
Updated the “Configuration for Monitoring Clustered Resources” in the “Other Requirements” section (see guide)

Note:
Read management pack guide.
As for me, it was helpful to configure sql "run as" accounts, as I deployed this management pack to low privilige environments.

SCOM 2007 R2 - Pool NonPaged Bytes monitoring

2011-05-09T14:03:00.000+02:00

One of the way to monitor Memory Leaks in the system is to monitor the NonPaged Pool Bytes performance counter.

Although any leak is serious, memory leaks are of particular concern when they involve the nonpaged pool. Many system services allocate memory from the nonpaged pool because they need to reference it when processing an interrupt and cannot take a page fault at that time. To identify whether or not a leak affects the nonpaged pool, include the following counters in your monitoring:

Memory \ Pool Nonpaged Bytes
Memory \ Pool Nonpaged Allocs
Process( process_name)\ Pool Nonpaged Bytes

This counter is not being monitored by default in SCOM. There're only performance collection rules for that(disabled by default) and self-tuned monitor for Exchange 2003 role servers(Exchange management pack).

But for some reason you maybe interested to monitor such counter with predefined threshold. In my case, it was needed to created a monitor disabled by default with threshold of 178257920 bytes.

You can access/download this management pack in XML format here.

p.s.

Excellent article about Paged and NonPaged Pool:

http://blogs.technet.com/b/markrussinovich/archive/2009/03/26/3211216.aspx

Troubleshooting WMI probe and Script related problems (part 3)

2011-05-04T11:31:00.003+02:00

Part I.

Part II.

This part applies for Windows 2008 and Windows 2008 R2 managed servers.

Investigation of a cause of alerts can be found in a previous part.

Most common fixes:

1. Apply KB2470949

It will fix "RegQueryValueEx function returns a very large incorrect value for the "Avg. Disk sec/Transfer" performance counter in Windows Server 2008 R2" related issues.

2. Apply KB981314

It will fix "Win32_Service" WMI class leaks memory in Windows Server 2008 R2 related issues.

3. Apply KB958807

It will fix "Clustering WMI provider does not correctly handle invalid characters in the private property names causing WMI queries to fail" related issues in Windows Server 2008 (included in SP2)

This post was created basing on information form Kevin Holman's blog.

Troubleshooting WMI probe and Script related problems (part 2)

2011-04-28T09:17:00.001+02:00

Previous part.

This part applies for Windows 2003 managed servers.

I would remind you that we are investigating the following types of alerts:

- Workflow Runtime: Failed to run a WMI query
Object enumeration failed
Query: 'SELECT xx FROM xx WHERE Name =xx
HRESULT: 0x800xxxxx
- Script or Executable Failed to run
- WMI Probe Module Failed Execution
- Failed to run a WMI query
- Failed to run a process or script
- Backward Compatibility Script Error

Let's take a look on action that we can perform to investigate the cause of alerts.

- investigate the OpsMgr event log on the agent

Check log for Warning/Critical events to see if a lot of workflows are failing due to this issue

- check if WMI is responsive

run WBEMTEST

connect to "root\cimv2"

hit “query” and execute a “select * from win32_operatingsystem” to see if it returns results, or an error

also you can run a query for a namespace that is mentioned in alert(for example root\MicrosoftDNS)

Basing on this information you can make a decision on possible causes.

Most common fixes:

1. Apply KB933061 This resolves a LOT of issues on the Windows 2003 OS with WMI. This should be one of your first steps.

2. Registry modification for WMI buffer thresholds (see below)

“HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\Low Threshold On Events (B)" to 35000000 (default is 10000000)
”HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\High Threshold On Events (B)" to 70000000 (default is 20000000)

The registry modification to WMI buffers increases the amount of objects that WMI can hold before injecting sleep delays to the WMI service.

3. Apply KB955360 This updates the Windows Scripting Host (cscript) to version 5.7. This resolves script timeouts, and scripts consuming a LOT of CPU during execution, and problems with multiple scripts running at the same time.

Making these three modifications should resolve the majority of systemic issues out there, unless WMI is completely corrupt/unresponsive and needs repair. Sometimes, rebooting a server, or bouncing WMI will temporarily resolve these issues as well, if you cannot apply the fixes immediately.

This post was created basing on information form Kevin Holman's blog.

SCOM 2007 R2 - Email Scheduled Reports

2011-04-21T13:55:00.001+02:00

Don't forget to configure email settings on a Report Server.

You must configure the e-mail settings in the Report Server using the Reporting Server Configuration Manager before you can send your scheduled reports by email automatically.

launch Reporting Services
In Reporting Services Configuration Manager, in the Report Server Installation Instance Selection dialog box, click Connect (for remote connection)
In the navigation pane, click E-mail Settings, enter the following:
- An e-mail address for use as the sender address in the Sender Address text box.
- The address of the SMTP server that will be used to send the e-mail messages in the SMTP Server text box
To e-mail scheduled reports
Log on to the computer with an account that is a member of the Operations Manager Report Operators role for the Operations Manager 2007 management group.
In the Operations console, click the Reporting button.
In the Reporting pane, click Favorite Reports.
In the Favorite Reports pane, right-click the Availability report you saved as a favorite, and then click Schedule.
In the Subscribe to a Report Wizard, on the Delivery Settings page, do the following:
- Type a description in the Description text box.
- Click the down arrow in the Delivery method list, and then click Report Server E-Mail.
- Type an e-mail address of the destination inbox to receive reports in the To text box. You can also type e-mail addresses in the Cc, Bcc, and the Reply To text boxes.
- Click the down arrow in the Render Format list, and then click the file format you want for the report.
- Click the down arrow in the Priority list, and then select the appropriate priority.
- Type a subject for the e-mail in the Subject text box.
- Click Next.
On the Subscription Schedule page, do the following:
- Select one of the Generate the report options.
- Type a start date and start time for the reports to be generated in The Subscription is effective beginning list. You can also enter the date when this subscription will end in The subscription expires on list, and then click Next.
On the Parameters page, specify a span of time for the report in the From and To lists, make any other changes you need for this report, and then click Finish.

SCCM 2012 technet documentation

2011-04-20T15:54:00.001+02:00

SCCM 2012 official documentation available on technet:

http://technet.microsoft.com/en-us/library/gg682041.aspx

SCCM 2007 versions numbers!

2011-04-19T07:18:00.000+02:00

Table of SCCM updates, builds and versions!

Revision Version KB
2007 4.00.5931.0000

2007 SP1 4.00.6221.1000 link
2007 SP1 (KB) 4.00.6221.1193 KB977203
2007 R2 no change

2007 SP2
4.00.6487.2000 link
2007 SP2 (KB)
4.00.6487.2111 KB977203
2007 R3
4.00.6487.2157

Notes:

- KB 977203 may be run against SP1 or SP2 clients
- The R2 feature add-on requires at least SP1, and can be installed after SP2
- The R3 update requires SP2 Client

SCOM 2007 R2 - Counting Alerts from each management pack

2011-04-18T15:33:00.002+02:00

Let's gather statistics about how much alerts are being generated by each management pack in your SCOM environment.

These operations should be done in operations manager shell.

First of all we need to determine how much management packs do we have:

(get-managementpack).count

How much alerts do we have:

(get-alert).count

Alerts by each management pack(output to csv file):

foreach ($MP in (get-managementpack))
{
$MPname = $MP.name
$counter = 0
$monitors = @()
$rules = @()
$namearray = @()

foreach ($mon in $mp.getmonitors()) {$Namearray += ($mon.id).tostring()}
foreach ($rul in $mp.getrules()) {$Namearray += ($rul.id).tostring()}
foreach ($alert in (get-alert))
{
            if ($NameArray -contains ($alert.monitoringruleID).tostring())
            {$counter ++}
}
$result = $MPName + "    " + $counter >> C:\@temp\alertsMP.csv
echo $result
}

The earliest alert:

get-alert | sort @{expression="timeraised";descending=$true} 

it is not an elegant way, but I had no time to think how to do it better :)

Now we can calculate the percentage of "alerting " of each management pack.

Top alerts count(sql-query to Operations Manager DB):

use operationsmanager

SELECT distinct AlertStringName, SUM(1) AS AlertCount

FROM Alertview WITH (NOLOCK)

GROUP BY AlertStringName

ORDER BY AlertCount DESC

Basing on these simple scripts you can quickly gather an overall condition of your SCOM alerting.

I hope it was informative for you!

SCOM 2007 R2 - The service threw an unknown exception

2011-04-18T10:16:00.004+02:00

Database connection related issue(when you try to install an agent):
The service threw an unknown exception. See inner exception...

Here's the full text of the error from Operations Manager log on RMS:

eventid 26319
An exception was thrown while processing InsertAgentPendingActions for session id uuid:4b89e0b0-c7ec-4179-96ef-4eb698b90181;id=1483.
Exception Message: Error 777980450, severity 16, state 1 was raised, but no message with that error number was found in sys.messages. If error is larger than 50000, make sure the user-defined message is added using sp_addmessage.
Full Exception: System.Data.SqlClient.SqlException: Error 777980450, severity 16, state 1 was raised, but no message with that error number was found in sys.messages. If error is larger than 50000, make sure the user-defined message is added using sp_addmessage.
at System.Data.SqlClient.SqlConnection.OnError(SqlException exception, Boolean breakConnection)
at System.Data.SqlClient.TdsParser.ThrowExceptionAndWarning(TdsParserStateObject stateObj)
at System.Data.SqlClient.TdsParser.Run(RunBehavior runBehavior, SqlCommand cmdHandler, SqlDataReader dataStream, BulkCopySimpleResultSet bulkCopyHandler, TdsParserStateObject stateObj)
at System.Data.SqlClient.SqlDataReader.ConsumeMetaData()
at System.Data.SqlClient.SqlDataReader.get_MetaData()
at System.Data.SqlClient.SqlCommand.FinishExecuteReader(SqlDataReader ds, RunBehavior runBehavior, String resetOptionsString)
at System.Data.SqlClient.SqlCommand.RunExecuteReaderTds(CommandBehavior cmdBehavior, RunBehavior runBehavior, Boolean returnStream, Boolean async)
at System.Data.SqlClient.SqlCommand.RunExecuteReader(CommandBehavior cmdBehavior, RunBehavior runBehavior, Boolean returnStream, String method, DbAsyncResult result)
at System.Data.SqlClient.SqlCommand.RunExecuteReader(CommandBehavior cmdBehavior, RunBehavior runBehavior, Boolean returnStream, String method)
at System.Data.SqlClient.SqlCommand.ExecuteReader(CommandBehavior behavior, String method)
at System.Data.SqlClient.SqlCommand.ExecuteReader(CommandBehavior behavior)
at Microsoft.EnterpriseManagement.Mom.DataAccess.SqlRetryHandler.ExecuteReader(ExecuteArguments executeArguments, QueryResults& queryResults)
at Microsoft.EnterpriseManagement.Mom.DataAccess.SqlRetryHandler.Execute[T](ExecuteArguments executeArguments, RetryPolicy retryPolicy, GenericExecute`1 genericExecute)
at Microsoft.EnterpriseManagement.Mom.DataAccess.SqlRetryHandler.ExecuteReader(SqlCommand sqlCommand, IList`1 prologEpilogList, IList`1 projection, QueryDefinition queryDefinition, RetryPolicy retryPolicy)
at Microsoft.EnterpriseManagement.Mom.DataAccess.QueryRequest.Execute(SqlNotificationRequest sqlNotificationRequest)
at Microsoft.EnterpriseManagement.Mom.ServiceDataLayer.AgentManagement.InsertAgentPendingActions(IList`1 agentPrincipalNames, IList`1 pendingActionDataXmls, String managementServername, Int32 pendingActionType)
at Microsoft.EnterpriseManagement.Mom.ServiceDataLayer.SdkDataAccess.InsertAgentPendingActions(IList`1 agentPrincipalNames, IList`1 pendingActionDataXml, String managementServerPrincipalName, Int32 pendingActionType)
at Microsoft.EnterpriseManagement.Mom.ServiceDataLayer.SdkDataAccessTieringWrapper.InsertAgentPendingActions(IList`1 agentPrincipalNames, IList`1 pendingActionDataXml, String managementServerPrincipalName, Int32 pendingActionType)
at Microsoft.EnterpriseManagement.Mom.ServiceDataLayer.SdkDataAccessExceptionTracingWrapper.InsertAgentPendingActions(IList`1 agentPrincipalNames, IList`1 pendingActionDataXml, String managementServerPrincipalName, Int32 pendingActionType)

eventid 33333
Data Access Layer rejected retry on SqlError:
Request: AgentPendingActionProcessChange -- (AgentName=AGENTNAME), (PendingActionType=1), (AgentPendingActionId=7fca8901-1e40-7c8a-b96c-ec282e8201f2), (ManagementServerName=SERVERNAME), (PendingActionData=<PendingActionInformation xmlns="urn:Microsoft.EnterpriseManagement.Mom.PendingActionInformation"><AgentDnsName /><AgentOperatio...), (RETURN_VALUE=1)
Class: 16
Number: 18054
Message: Error 777980450, severity 16, state 1 was raised, but no message with that error number was found in sys.messages. If error is larger than 50000, make sure the user-defined message is added using sp_addmessage.
After investigation, I've found that OperationsManager db and OperationsManagerDW db were restored from backup last night.

This issue happens because of some specific configuration information is stored in the Master database. So it can happen when you migrate your bases to another server, backup and restore.

Here's the list of errors and fix scripts for such kind of sql-related errors:
-----------------------------------------
-- MOMv3 messages are 77798xxxx --
-----------------------------------------

-----------------------------------------------
-- Discovery range: 77798-0000 to 77798-0049 --
-----------------------------------------------
-- Managed type doesn't exist.
EXECUTE sp_addmessage @msgnum = 777980000, @msgtext = N'The specified managed type doesn''t exist.', @severity = 16, @lang = 'us_english', @with_log = false, @replace = 'REPLACE'
GO

-- Relationship type doesn't exist.
EXECUTE sp_addmessage @msgnum = 777980001, @msgtext = N'The specified relationship type doesn''t exist.', @severity = 16, @lang = 'us_english', @with_log = false, @replace = 'REPLACE'
GO

-- Source entity of the relationship doesn't exist.
EXECUTE sp_addmessage @msgnum = 777980002, @msgtext = N'The specified relationship doesn''t have a valid source.', @severity = 16, @lang = 'us_english', @with_log = false, @replace = 'REPLACE'
GO

-- Target entity of the relationship doesn't exist.
EXECUTE sp_addmessage @msgnum = 777980003, @msgtext = N'The specified relationship doesn''t have a valid target.', @severity = 16, @lang = 'us_english', @with_log = false, @replace = 'REPLACE'
GO

-- Discovery data from invalid managed entity is dropped.
EXECUTE sp_addmessage @msgnum = 777980004, @msgtext = N'Discovery data has been received from a rule targeted to a non-existent entity. The discovery data will be dropped.', @severity = 16, @lang = 'us_english', @with_log = false, @replace = 'REPLACE'
GO

-- Invalid relationship rejected by cycle detection.
EXECUTE sp_addmessage @msgnum = 777980005, @msgtext = N'Invalid relationship rejected by cycle detection.', @severity = 16, @lang = 'us_english', @with_log = false, @replace = 'REPLACE'
GO

-- Discovery data generated by invalid connector.
EXECUTE sp_addmessage @msgnum = 777980006, @msgtext = N'Discovery data generated by invalid connector:%s.', @severity = 16, @lang = 'us_english', @with_log = false, @replace = 'REPLACE'
GO

-- Discovery data generated by invalid rule, task, discovery.
EXECUTE sp_addmessage @msgnum = 777980007, @msgtext = N'Discovery data generated by invalid discovery source. Id:%s.', @severity = 16, @lang = 'us_english', @with_log = false, @replace = 'REPLACE'
GO

-- Health service should not generate data about this managed object.
EXECUTE sp_addmessage @msgnum = 777980008, @msgtext = N'Health service ( %s ) should not generate data about this managed object ( %s ).', @severity = 16, @lang = 'us_english', @with_log = false, @replace = 'REPLACE'
GO

-- Health service should not generate data about this relationship object.
EXECUTE sp_addmessage @msgnum = 777980009, @msgtext = N'Health service ( %s ) should not generate data about this relationship object between ( %s and %s ).', @severity = 16, @lang = 'us_english', @with_log = false, @replace = 'REPLACE'
GO

---------------------------------------------------------------------
-- Availability & Maintenance Mode range: 77798-0050 to 77798-0099 --
---------------------------------------------------------------------

-- Can not set availability on a health service that doesn't exist.
EXECUTE sp_addmessage @msgnum = 777980050, @msgtext = N'Cannot set availability on a health service that doesn''t exist.', @severity = 16, @lang = 'us_english', @with_log = false, @replace = 'REPLACE'
GO

-- Managed entity is not currently in maintenance mode
EXECUTE sp_addmessage @msgnum = 777980051, @msgtext = N'Managed entity is not currently in maintenance mode.', @severity = 16, @lang = 'us_english', @with_log = false, @replace = 'REPLACE'
GO

-- End time has to be greater than start time
EXECUTE sp_addmessage @msgnum = 777980052, @msgtext = N'The maintenance mode scheduled end time has to be greater than the start time.', @severity = 16, @lang = 'us_english', @with_log = false, @replace = 'REPLACE'
GO

-- ScheduledEndTime can't be in the past
EXECUTE sp_addmessage @msgnum = 777980053, @msgtext = N'Cannot set scheduled end time to a time in the past', @severity = 16, @lang = 'us_english', @with_log = false, @replace = 'REPLACE'
GO

-----------------------------------------------
-- UserRole range: 77798-0100 to 77798-0199 --
-----------------------------------------------

-- UserRoleAdministratorAlreadyExistsException
EXECUTE sp_addmessage @msgnum = 777980100, @msgtext = N'A user role with the administrator profile already exists. Cannot create another user role with the same profile.', @severity = 16, @lang = 'us_english', @with_log = false, @replace = 'REPLACE'
GO

-- UserRoleSystemDeleteException
EXECUTE sp_addmessage @msgnum = 777980101, @msgtext = N'Cannot delete system user roles.', @severity = 16, @lang = 'us_english', @with_log = false, @replace = 'REPLACE'
GO

-- UserRoleSystemException
EXECUTE sp_addmessage @msgnum = 777980102, @msgtext = N'Cannot create user roles with IsSystem specified.', @severity = 16, @lang = 'us_english', @with_log = false, @replace = 'REPLACE'
GO

-- NULL is not a valid Group Id for the Scope specified
EXECUTE sp_addmessage @msgnum = 777980103, @msgtext = N'NULL is not a valid GroupId for the Scope specified.', @severity = 16, @lang = 'us_english', @with_log = false, @replace = 'REPLACE'
GO

-- NULL is not a valid TypeId for the Scope specified
EXECUTE sp_addmessage @msgnum = 777980104, @msgtext = N'NULL is not a valid TypeId for the Scope specified.', @severity = 16, @lang = 'us_english', @with_log = false, @replace = 'REPLACE'
GO

------------------------------------------------------
-- Operational Data range: 77798-0200 to 77798-0299 --
------------------------------------------------------

-- Invalid Timestamp
EXECUTE sp_addmessage @msgnum = 777980200, @msgtext = N'Request to update alert ignored due to invalid TimeModified', @severity = 16, @lang = 'us_english', @with_log = false, @replace = 'REPLACE'
GO

-- Invalid Timestamp
EXECUTE sp_addmessage @msgnum = 777980201, @msgtext = N'Request to update alert ignored due to mismatch in BaseManagedEntityId', @severity = 16, @lang = 'us_english', @with_log = false, @replace = 'REPLACE'
GO

-- Invalid MonitorId
EXECUTE sp_addmessage @msgnum = 777980202, @msgtext = N'Cannot create Alert. Invalid MonitorId.', @severity = 16, @lang = 'us_english', @with_log = false, @replace = 'REPLACE'
GO

-- Invalid RuleId
EXECUTE sp_addmessage @msgnum = 777980203, @msgtext = N'Cannot create Alert. Invalid RuleId.', @severity = 16, @lang = 'us_english', @with_log = false, @replace = 'REPLACE'
GO

-- NULL category in Monitor
EXECUTE sp_addmessage @msgnum = 777980204, @msgtext = N'Cannot create Alert. Monitor Category cannot be NULL', @severity = 16, @lang = 'us_english', @with_log = false, @replace = 'REPLACE'
GO

-- NULL category in Rule
EXECUTE sp_addmessage @msgnum = 777980205, @msgtext = N'Cannot create Alert. Rule Category cannot be NULL.', @severity = 16, @lang = 'us_english', @with_log = false, @replace = 'REPLACE'
GO

-- Trying to update Alert that doesn't exist in the table.
EXECUTE sp_addmessage @msgnum = 777980206, @msgtext = N'No alert matches the given AlertId.', @severity = 16, @lang = 'us_english', @with_log = false, @replace = 'REPLACE'
GO

-- Alert resolution state shortcut key has to be unique.
EXECUTE sp_addmessage @msgnum = 777980207, @msgtext = N'Alert resolution state shortcut key has to be unique.', @severity = 16, @lang = 'us_english', @with_log = false, @replace = 'REPLACE'
GO

-- A predefined alert resolution state can not be updated.
EXECUTE sp_addmessage @msgnum = 777980208, @msgtext = N'A predefined alert resolution state can not be updated.', @severity = 16, @lang = 'us_english', @with_log = false, @replace = 'REPLACE'
GO

-- Only the action account secure data type can be associated with the action account secure reference.
EXECUTE sp_addmessage @msgnum = 777980209, @msgtext = N'Action account secure data must be paired with the action account secure reference.', @severity = 16, @lang = 'us_english', @with_log = false, @replace = 'REPLACE'
GO

-- Cannot associated a health service with a credential that has no password. This happens when the secure data object was inserted by a health service.
EXECUTE sp_addmessage @msgnum = 777980210, @msgtext = N'-- Cannot associated a health service with a credential that has no password. This happens when the secure data object was inserted by a health service.', @severity = 16, @lang = 'us_english', @with_log = false, @replace = 'REPLACE'
GO

------------------------------------------------------
-- ManagementPack Data range: 77798-0300 to 77798-0399 --
------------------------------------------------------

-- Duplicate Name For ManagedType
EXECUTE sp_addmessage @msgnum = 777980300, @msgtext = N'ManagementPack cannot be imported because it contains a Managed Type with the same name as an existing type: %s', @severity = 16, @lang = 'us_english', @with_log = false, @replace = 'REPLACE'
GO

-- Duplicate Name For RelationshipType
EXECUTE sp_addmessage @msgnum = 777980301, @msgtext = N'ManagementPack cannot be imported because it contains a Relationship Type with the same name as an existing type: %s', @severity = 16, @lang = 'us_english', @with_log = false, @replace = 'REPLACE'
GO

-- Update specified, but no prior version of Management Pack exists
EXECUTE sp_addmessage @msgnum = 777980302, @msgtext = N'ManagementPack cannot be updated because it has not installed', @severity = 16, @lang = 'us_english', @with_log = false, @replace = 'REPLACE'
GO

-- Update specified, but no ManagementPack is sealed
EXECUTE sp_addmessage @msgnum = 777980303, @msgtext = N'ManagementPack cannot be updated because it is sealed', @severity = 16, @lang = 'us_english', @with_log = false, @replace = 'REPLACE'
GO

-- Update specified, but Timestamp is too old
EXECUTE sp_addmessage @msgnum = 777980304, @msgtext = N'ManagementPack cannot be updated because TimeModified is not the latest', @severity = 16, @lang = 'us_english', @with_log = false, @replace = 'REPLACE'
GO

-- Update specified, but Timestamp is too old
EXECUTE sp_addmessage @msgnum = 777980305, @msgtext = N'TypeCacheSelect failed due to update of data during transaction', @severity = 16, @lang = 'us_english', @with_log = false, @replace = 'REPLACE'
GO

-- Update specified, but Timestamp is too old
EXECUTE sp_addmessage @msgnum = 777980306, @msgtext = N'ManagementPack cannot be updated because %s has been modified more recently.', @severity = 16, @lang = 'us_english', @with_log = false, @replace = 'REPLACE'
GO

------------------------------------------------------
-- Connectors & MCF range: 77798-0400 to 77798-0449 --
------------------------------------------------------
-- Connector not initialized
EXECUTE sp_addmessage @msgnum = 777980400, @msgtext = N'Cannot perform operation: Connector does not exist or is not initialized', @severity = 16, @lang = 'us_english', @with_log = false, @replace = 'REPLACE'
GO

-- Connector does not own object
EXECUTE sp_addmessage @msgnum = 777980401, @msgtext = N'Cannot perform operation: Connector does not own object', @severity = 16, @lang = 'us_english', @with_log = false, @replace = 'REPLACE'
GO

-- Connector is alredy in given IsInitialized state
EXECUTE sp_addmessage @msgnum = 777980402, @msgtext = N'Connector is already the given IsInitialized State', @severity = 16, @lang = 'us_english', @with_log = false, @replace = 'REPLACE'
GO

-- Connector is not unitialized
EXECUTE sp_addmessage @msgnum = 777980403, @msgtext = N'Cannot perform operation: Connector does not exist or is not Uninitialized', @severity = 16, @lang = 'us_english', @with_log = false, @replace = 'REPLACE'
GO

-- Collision in setting the connector id.
EXECUTE sp_addmessage @msgnum = 777980404, @msgtext = N'A collision happened while setting the connector id of alerts.', @severity = 16, @lang = 'us_english', @with_log = false, @replace = 'REPLACE'
GO

------------------------------------------------------
-- Agent management: 77798-0450 to 77798-0499 --
------------------------------------------------------
-- Connector not initialized
EXECUTE sp_addmessage @msgnum = 777980450, @msgtext = N'There is an existing pending action for agent %s. You must process this pending action before a new pending action can be inserted.', @severity = 16, @lang = 'us_english', @with_log = false, @replace = 'REPLACE'
GO

I've taken these fixes from Madd Goedtel blog

In my case it is 777980450 error.

I fixed it by running the following query to Operations Manager db:

-- Connector not initialized
EXECUTE sp_addmessage @msgnum = 777980450, @msgtext = N'There is an existing pending action for agent %s. You must process this pending action before a new pending action can be inserted.', @severity = 16, @lang = 'us_english', @with_log = false, @replace = 'REPLACE'
GO

Altiris 7.1 Suites and Solutions documentation

2011-04-15T15:05:00.006+02:00

It will be the place for all actual documentation for Altiris 7.1.

Here's the list of available documentation(direct links to files):

Release notes:

Symantec Management Platform 7.1 Release Notes

Altiris Client Management Suite 7.1 from Symantec Release Notes

Altiris Server Management Suite 7.1 from Symantec Release Notes

Design and implementation guides:

Altiris IT Management Suite 7.1 from Symantec Planning and Implementation Guide

Symantec Management Platform 7.1 Database Schema

User guides:

User guide for Symantec Management Platform 7.1

Altiris Client Management Suite 7.1 from Symantec User Guide

Altiris Server Management Suite 7.1 from Symantec User Guide

Altiris Deployment Solution 7.1 from Symantec User Guide

Migration guides:

Altiris IT Management Suite from Symantec Migration Guide version 6x to 7.1

Altiris IT Management Suite from Symantec Migration Guide version 7.0 to 7.1

I'm going to update this post after any new documentation appears.

All official documentation can be found here:

http://www.symantec.com/business/support/index?page=content&key=55274&channel=DOCUMENTATION
http://www.altiris.com/Support/Documentation.aspx

Installing Altiris IT Management Suite(ITMS) 7.1

2011-04-08T15:59:00.002+02:00

My experience of installation ITSM 7.1 in test environment. It was not so easy as it could be.

At first, I tried to find any demo VHDs or other stuff to take a look at this solution. But... I couldn't.

So what we have:

- supported configurations guide

- 30 days trial copy of this solution which can be found here (it's only an installer for it)

- implementation guides and other documentation here

My configuration:

- 4 Windows 2008 R2 Standard - DC(domain controller), DB(database for ITMS), NS(Notification server), Member server for Server Management tasks

- 1 Windows 7 client for Client Management tasks

- Notification server should be 2x2Ghz, 4Gb RAM(recommended)

I have no direct access to internet. DC has 2 NICs (local and internet via proxy) and RRAS role installed.

Steps:

- download and install SQL Server 2008 R2 Express on your DB server(you cannot do it with Symantec installer as he can't work with proxy at this stage)

- download and install any Mail-server(it will be needed for some reporting and administrative notifications),

I've used SmarteMail for mail server(it's free up to 10 users), as Windows 2008 R2 has no internal POP3 and IMAP components. And a thunderbird client(also free)

- create a service account, grant sysadmin role to your SQL instance. Notification server will be run with this credentials and it needs ability to create database(during installation) and read/write permissions(future activities). In testlab you can put this account into domain admin group, but not forget about SQL security

- download xml installation configuration file, I had to do it because installer can't access to internet on this stage too(internet via proxy server that needs authentication), you can read more about it here

- run installer, give him the local copy of the configuration XML file, make it primary, and only then you can type your proxy settings! BINGO!!!

- accurately install all prerequisites needed(Silverlight, IIS, .Net, JRE, ... etc.)

- pass several configuration questions and then it begins to download lots of packages

Here's my installation summary(2.68 GB to download!):

Products to be installed (70 products):

Symantec Management Platform MP1 (7.1.6797)
Altiris IT Analytics (7.1.1013)
Altiris IT Management Suite (7.1.0)
Altiris Asset Management Suite (7.1.0)
Altiris CMDB Solution (7.1.1227)
Altiris Asset Management Solution (7.1.1216)
Altiris Barcode Solution (7.1.1050)
Altiris IT Analytics Client Server Management Pack (7.1.1021)
Symantec ServiceDesk Solution (7.1.0)
Wise Connector (7.1.1011)
Altiris IT Analytics ServiceDesk Pack (7.1.1015)
Altiris Client Management Suite (7.1.0)
Symantec Management Agent for UNIX, Linux and Mac MP1 (7.1.6797)
Altiris Pluggable Protocol Architecture MP1 (7.1.6797)
Altiris Network Discovery MP1 (7.1.6797)
Altiris Event Console MR1 (7.1.5419)
Altiris Inventory Solution (7.1.1043)
Altiris Software Catalog Data Provider (7.1.1012)
Altiris Inventory for Network Devices (7.1.1082)
Altiris Out-of-Band Management (7.1.1109)
Altiris Patch Management Solution (7.1.1213)
Altiris Patch Management Solution Core Services (7.1.1213)
Altiris Patch Management Solution for Windows (7.1.1212)
Altiris Patch Management Solution for Linux (7.1.1213)
Altiris Patch Management Solution for Mac (7.1.1212)
Altiris Software Management Solution (7.1.1294)
Altiris Power Scheme Task (7.1.1036)
Symantec pcAnywhere (12.6.65)
Altiris Real-Time Console Infrastructure (7.1.1046)
Altiris Real-Time System Manager (7.1.1046)
First Time Setup Portal (7.1.75)
Altiris Client Management Suite Portal Page (7.1.1005)
Symantec Endpoint Protection Integration Component (7.1.1022)
Altiris IT Analytics Symantec Endpoint Protection Pack (7.1.1011)
Altiris Deployment Solution Complete Suite (7.1.1374)
Altiris Deployment Solution Linux Support (7.1.1374)
Altiris Deployment Solution WinPE Support (7.1.1374)
Altiris Deployment Solution Core (7.1.1374)
Activity Center (7.1.127)
Altiris Server Management Suite (7.1.0)
Altiris Inventory Pack for Servers (7.1.1033)
Altiris Monitor Solution for Servers MR1 (7.1.7113)
Altiris Monitor Pack for Servers (7.1.1085)
Altiris Virtual Machine Management (7.1.1016)
Altiris Server Management Suite Portal Page (7.1.1036)
Altiris Network Topology Viewer (7.1.1043)
Altiris Server Management Suite Documentation (7.1.1012)
Symantec Management Platform Documentation MP1 (7.1.6797)
Altiris Out-of-Band Management Documentation (7.1.1015)
Altiris Software Management Solution Documentation (7.1.1019)
Altiris Deployment Solution Documentation (7.1.1028)
Symantec Endpoint Protection Integration Component Documentation (7.1.1002)
Altiris Inventory Solution Documentation (7.1.1012)
Altiris Asset Management Solution Documentation (7.1.1014)
Altiris Inventory for Network Devices Documentation (7.1.1006)
Altiris Real-Time System Manager Documentation (7.1.1004)
Altiris Barcode Solution Documentation (7.1.1010)
Wise Connector Documentation (7.1.1002)
Altiris Virtual Machine Management Documentation (7.1.1009)
Altiris Patch Management Solution for Linux Documentation (7.1.1011)
Altiris IT Analytics Documentation (7.1.1005)
Altiris CMDB Solution Documentation (7.1.1006)
Altiris Client Management Suite Documentation (7.1.1007)
Enhanced Console Views Documentation (7.1.1012)
Altiris Patch Management Solution for Mac Documentation (7.1.1009)
Symantec Service Desk Solution Documentation (7.1.1009)
Altiris Real-Time Console Infrastructure Documentation (7.1.1005)
Symantec pcAnywhere Documentation (12.6.1007)
Altiris Monitor Solution for Servers Documentation (7.1.1011)
Altiris Patch Management Solution for Windows Documentation (7.1.1008)
Notification Server configuration information:

Application identity: testlab\altiris-ns-service
Web site: Default Web Site
Fully Qualified Domain Name: NServer.testlab.local
Use SSL to access the Management Platform: No
Email information:

To address: bob@testlab.local
From address: AltirisServer@do-not-reply.com
SMTP Server: nserver2.testlab.local
Database configuration:

SQL Server name: SQL01\SQLEXPRESS
Authentication type: Windows authentication
Database name: Symantec_CMDB (Create new)
Database timeout: 600 Seconds
Installation destination: E:\Program files\Altiris\Symantec installation Manager\Installs\Altiris\

SCOM 2007 R2 Exchange 2010 SP1 MP

2011-04-07T09:19:00.003+02:00

Exchange Server 2010 Monitoring Management Pack was released 6th April 2011(version 14.02.0071.0).

Download link: http://www.microsoft.com/downloads/en/details.aspx?FamilyID=7150bfed-64a4-42a4-97a2-07048cca5d23

Update notes:

Updates were added throughout this guide to make it more comprehensive and to make it apply to the code changes in Exchange 2010 Service Pack 1 and the latest version of the Exchange 2010 Management Pack. Capacity planning and performance reports New reports dig deep into the performance of individual servers and provide detailed information about how much capacity is used in each site
SMTP and remote PowerShell availability report The management pack now includes two new availability reports for SMTP client connections and management end points
New Test-SMTPConnectivity synthetic transaction In addition to the inbound mail connectivity tasks for protocols such as Outlook Web App, Outlook, IMAP, POP, and Exchange ActiveSync, the Management Pack now includes SMTP-connectivity monitoring for outbound mail from IMAP and POP clients
New Test-ECPConnectivity view
Views for the Exchange Control Panel test task are now included in the monitoring tree
Cross-premises mail flow monitoring and reporting The Management Pack includes new mail flow monitoring and reporting capabilities for customers who use our hosted service
Improved Content Indexing and Mailbox Disk Space monitoring New scripts have been created to better monitor context indexing and mailbox disk space. These new scripts enable automatic repair of indexes and more accurately report of disk space issues
The ability to disable Automatic Alert Resolution in environments that include OpsMgr connectors When you disable Automatic Alert Resolution, the Correlation Engine won't automatically resolve alerts. This lets you use your support ticketing system to manage your environment
Several other updates and improvements were also added to this version of the Management Pack, including the following
Suppression of alerts when the alerts only occur occasionally was added to many monitors
Most of the event monitors in the Exchange 2010 Management Pack are automatically reset by the Correlation Engine. Automatic reset was added to those event monitors so that issues aren't missed the next time they occur. For a list of the event monitors that are not reset automatically
Monitoring was added for processes that crash repeatedly
Additional performance monitoring was added for Outlook Web App
Monitoring of Active Directory access was improved
Monitoring of anonymous calendar sharing was added
Reliability of database offline alerts was improved
Monitoring for the database engine (ESE) was added

Note:

During the installation correlation service will be installed, so you'd better install it on RMS.

UAC trouble: run this management pack installation via cmd runned as Administrator.

Read management pack guide, there're lots of interesting things.

Induction to Symantec Altiris Solutions

2011-04-07T08:45:00.001+02:00

Altiris Inc. is a subsidiary of Symantec specializing in service-oriented management software which allows organizations to manage IT assets. They also provide software for web services, security, and systems management products. Established in 1998, Altiris is headquartered in Lindon, Utah, United States. Altiris has over 20,000 customers managing more than 3 million servers and 60 million desktops and laptops.

On January 29, 2007, Symantec announced plans to acquire Altiris and on April 6, 2007 the acquisition was completed.

Until recently 7.1 version was released these solutions had no support of 64-bit systems. So, it was not very popular as a new implementation to a new infrastructure.

But on March 7, 2011 Altiris 7.1 Suites and Solutions were release to general availability.
Not it can only be installed on Windows Server 2008 R2(except Core Editiion) and have no support of Windows 2000 as a client and server support system. I'd like to mention that it's announced that this solution supports all Apple Mac OS X computers from 10.2 to 10.6.

The whole list of supported configurations can be found here.
Documentation for all components and solutions can be found here.
Altiris blog.

MMS 2011 - Key notes

2011-04-02T12:38:00.007+02:00

Microsoft Management Summit(MMS) 2011 has finished not long ago. As you know it's a summit where new products and updates for existing products are announced. I'd like to write about news and update that were interesting for me.

1. SCOM 2012 Beta will be available soon for public download(Q2 2011)

- more supported configurations: application based on Java EE(WebSphere,WebLogic, JBOSS, Tomcat)

- RMS is not a bottleneck for your monitoring, MS can easily be added and removed because there’s a automatic failover between all the MS which are in the management pool

- new network monitoring features:

a) a complete new way of discovering new devices which are in your environment

b) added support for SNMP v3, IPV6

c) MSFT plans to support roughly ~90 vendors out of the box so not much customization needed

d) monitoring includes all the small bits and bolts of your network like Network Port monitoring, memory counters, VLAN health, HSRP health, connection health at end points

e) much better visualization (this is not just network monitoring through) with vicinity maps and gauges

- updated reporting and dashboards views

2. SCCM 2012 Beta 2 is available for public download.

I've already written a post about it. Here.

3. System Center Opalis was renamed to System Center Orchestrator

Here you can find more information about this product.

4. System Center Virtual Machine Manager Beta

You can download it here.
More information: http://technet.microsoft.com/ru-ru/evalcenter/gg670988.aspx

5. Microsoft BitLocker Administration and Monitoring (MBAM) Beta

A very interesting product. It helps to automate the volumes encryption on client machines.

Here it's available for download: https://connect.microsoft.com/site1115/Downloads (Registration needed)

6. System Center Advisor

System Center Advisor (formerly Microsoft codename Atlanta) is a cloud service that enables IT professionals to assess their server configuration and proactively avoid problems.

More information here.

Official site

7. System Center Concero

The initial release of “Concero” will enable customers to deploy, manage and control applications and services deployed on private clouds built using System Center Virtual Machine Manager 2012 and in the public cloud offering of Windows Azure. This provides a consistent and simple user experience for service management across these clouds.

More info.

Here you can find MMS videos:
MMS 2011 Day 1 Keynote video

MMS 2011 Day 2 Keynote video

SCOM 2007 R2 How to start

2011-04-01T09:04:00.003+02:00

Several times I was asked "What to do first to learn how to work with SCOM". Basing my experience I can suggest the following list of actions to do first:

- First of all you should make a decision for yourself if are you interested in such part of IT-infrastructure as monitoring, operating, making decisions on statistics, creating maintenance plans and creating proactive actions that should be done basing on alert/performance/events trends. If you are interested in working as SCOM administrator, remember, that there's always a place for analysis and logic chains.

- I'd like to advise to watch some kind of CBT Nuggets videos about SCOM infrastructure, take a particular attention to SCOM design and implementation phase. Basing on this knowledge you can understand its architecture, internal mechanisms of data transfer, how it works in overall.

- The next phase is to move your energy to virtual test lab. In one of my previous posts there's a link for SCOM vhd files that are 180-trial free, you should download it to learn interface, try basic functions, import several management packs, run console and agent tasks, make some overrides.

- The next step in to install the SCOM to bare metall. There're implementation and design guides with several implementation scenarios available at Microsoft site(links can be found here). Please be patient on this step, implement SCOM carefully, don't use the "enterprise admin" account to install everything. Try to use the SCOM accounts matrix to give only needed permissions to accounts for your actions.

- After all previous steps, it's a time for a "heavy artillery". At this step I advise you to read the following books:
System Center Operations Manager 2007 Unleashed
System Center Operations Manager (OpsMgr) 2007 R2 Unleashed: Supplement to System Center Operations Manager 2007 Unleashed

- Test your SCOM skills by passing the 70-400 Microsoft exam (you shouldn't use testkings and other stuff if your aim is to test your knowledge of a product)

- Practice, practice and practice... and reading SCOM blogs like Kevin Holman's, Cameron Fuller's and http://sys-man.blogspot.com/ blogs :)

SCOM 2007 R2 How to unseal a management pack

2011-03-31T12:02:00.003+02:00

There're lots of situations when you need to view the source code of discoveries/overrides/rules/monitors to troubleshoot your SCOM related issues in your production. Or maybe to change some parameters that are not overridable by default.

You can run the following powershell script to get the XML output of a sealed MP:

param($mpPath,$outputPath)
$assembly = [System.Reflection.Assembly]::LoadWithPartialName("Microsoft.EnterpriseManagement.OperationsManager")
$mp = new-object Microsoft.EnterpriseManagement.Configuration.ManagementPack($mpPath)
$mpWriter = new-object Microsoft.EnterpriseManagement.Configuration.IO.ManagementPackXmlWriter($outputPath)
$mpWriter.WriteManagementPack($mp)

You can "hardcode" the values in the script, but better, you should save this script to file(convert.ps1) and the example of execution:

c:\convert.ps1 -mppath 'c:\sealed.mp' -outputpath 'c:\' 

SCCM 2012 Beta 2 Available for download

2011-03-30T12:29:00.006+02:00

Microsoft announced that the System Center Configuration Manager v.Next has moved its official product name to "System Center Configuration Manager 2012".

System Center Configuration Manager 2012 Beta 2 - download link (Registration Required on Microsoft site) March 2011

Supported Operating Systems:Windows Server 2008

Minimum System Requirements:

Site servers and site roles require 64-bit OS (distribution points are an exception)
- Branch distribution points have been deprecated and replaced with standard distribution points that can be hosted on Configuration Manager 2012 client operating system platforms, with the exception of Windows XP Professional Service Pack 3 and Windows XP Tablet PC SP3
- Standard DPs can run on Windows Server 32-bit but will not support advanced functionality
Windows Server 2008 (64-bit)
- Distribution points can run on Windows Server 2003
SQL Server 2008 SP1 with CU10 (64-bit)
SQL Reporting Services is ONLY reporting solution

Supported Configurations (link to: http://download.microsoft.com/download/5/4/5/54508737-EB00-4B65-8DB3-F0D810FA3A9F/Configuration Manager 2012 Beta 2 Supported Configuration.pdf)

SCCM 2007 R2 VHD download

2011-03-30T11:46:00.001+02:00

VHD Test Drive – System Center Operations Manager 2007 R2.

SCCM 2007 official documentation in PDF, DOC(X) etc.

2011-03-30T11:37:00.004+02:00

Here's the place for links to official SCCM 2007 documentation in pdf, doc(x), chm, etc. formats.

Core documentation:

Configuration Manager 2007 Documentation Library (technet):
http://technet.microsoft.com/en-us/library/bb680651.aspx

System Center Configuration Manager 2007 Operating System Deployment Guide: Healthcare(pdf):
http://www.microsoft.com/downloads/en/details.aspx?displaylang=en&FamilyID=defbf5ab-7d60-402b-a58e-5cccc4932a12

System Center Configuration Manager 2007 Software Distribution Guide: Healthcare(pdf) :
http://www.microsoft.com/downloads/en/details.aspx?FamilyID=0A4A62EB-4335-4847-B22F-BAEB915F3E24

System Center Configuration Manager 2007 Deployment Guide: Healthcare(pdf):
http://www.microsoft.com/downloads/en/details.aspx?FamilyID=8B635615-B368-4E98-A4B3-D779611ECED4

System Center Configuration Manager Software Update Management Guide: Healthcare(pdf):
http://www.microsoft.com/downloads/en/details.aspx?FamilyID=27C44801-0D99-48A1-B371-56E27099C5D2

System Center Operations Manager 2007 SP1 Documentation(doc):
http://www.microsoft.com/downloads/en/details.aspx?FamilyID=d826b836-59e5-4628-939e-2b852ed79859

Features and guides:

Manage, Monitor, and Report: Implementing a Power Management Strategy with System Center Configuration Manager 2007 R3(docx):
http://www.microsoft.com/downloads/en/details.aspx?FamilyID=7b31a05f-379a-4a09-9c81-4e48c2c45681

Deploying Windows 7 Using System Center Configuration Manager 2007 and OSD(docx):
http://www.microsoft.com/downloads/en/details.aspx?FamilyID=db124318-666d-49fe-a71c-992760ef9c1b

Deploying the Core Optimized Desktop Using System Center Configuration Manager 2007 R2(doc):
http://www.microsoft.com/downloads/en/details.aspx?FamilyID=4d7c7fe8-e2ee-48c4-bf6e-2b316b44427d

SCCM 2007 List of log files

2011-03-30T10:04:00.003+02:00

List of Log Files in Configuration Manager 2007 can be found here(useful for troubleshooting):

http://technet.microsoft.com/en-us/library/bb892800.aspx

SCOM 2007 R2 Official Documentation

2011-03-30T09:50:00.002+02:00

Here's the link to Microsoft SCOM 2007 R2 product official documentation(documentation is being updated but link is permanent):

http://technet.microsoft.com/en-us/systemcenter/om/bb498235.aspx

SCOM 2007 R2 maintenance mode history

2011-03-25T12:15:00.001+01:00

Maintenance mode history/report for the defined server can be viewed by Powershell script or Sql query to OperationsManagerDW.

By SQL query:

USE OperationsManagerDW
SELECT ManagedEntity.DisplayName, MaintenanceModeHistory.*
FROM ManagedEntity WITH (NOLOCK)
INNER JOIN
MaintenanceMode ON ManagedEntity.ManagedEntityRowId = MaintenanceMode.ManagedEntityRowId
INNER JOIN
MaintenanceModeHistory ON MaintenanceMode.MaintenanceModeRowId = MaintenanceModeHistory.MaintenanceModeRowId
where DisplayName Like '%servername%'

By Powershell script:

$mc = get-monitoringClass -name Microsoft.Windows.Computer
$mo = get-monitoringObject -monitoringClass $mc | where {$_.name -eq 'servername'}
$mo | get-maintenanceWindow -history

Notice that Powershell script is rather slow in large environments.

SCOM 2007 R2 Subscriptions based on custom fields as criteria

2011-03-25T08:40:00.000+01:00

There's a known bug of SCOM 2007 R2, when you're trying to create a subscription based on the value in any Custom field of alert.

This subscription won't work. Because when you save it, it is being saved as:

<ValueExpression>
<Property>Custom2</Property>
</ValueExpression>
<Operator>Equal</Operator>
<ValueExpression>
<Value>Critical Alert</Value>

in Notifications Internal Library management pack.

The solution is to export, update and import this management pack again as I did it in my previous post.

You should replace Custom2 to CustomField2 (in my example) and increase the version of management pack:

...

<ValueExpression>
<Property>CustomField2</Property>
</ValueExpression>
<Operator>Equal</Operator>
<ValueExpression>
<Value>Critical Alert</Value>

Notice that if you do any change in this subscription in future, you have to do the same operation, because it always been saved in wrong way :)

SCOM 2007 R2 Subscriptions getting automatically disabled

2011-03-24T12:46:00.002+01:00

Subscriptions getting automatically disabled every 30 minutes because of internal Microsoft.SystemCenter.ValidateAlertSubscription validation that runs every 30 minutes!

Open Operations Manager log on your RMS server and filter it to find only 11452 events. Here's the text of the event:

Log Name:      Operations Manager
Source:        Health Service Modules
Event ID:      11452
Task Category: None
Level:         Warning

Validate alert subscription data source module encountered an alert subscription data source with configuration that has gone out of scope. Disabling the alert subscription data source module.

Alert subscription name: Subscription2ea14c42_4648_46f0_8d74_135223f637b1

One or more workflows were affected by this.
Workflow name: Microsoft.SystemCenter.ValidateAlertSubscription

The root cause of the problem was the creator of this subscription, the user that was in SCOM administrators group, but then his account was moved to a different role.

Two possible solutions:
- add this user again to SCOM administrators group and reenable subscriptions
- export internal notifications management pack, update SIDs of users and reimport it again

The first method is not interesting at all.

The second method should be done in the following way:

Create a new subscription, do not enable it. It will be needed to get a "good" SID for an old one which doesn't work
Export "Notification Internal Library" management pack to a temporary folder
Edit this .xml file:

find string with <UserSid></UserSid> tags for a new subscription
copy the value of the user SID
update <UserSid>...</UserSid> for old subscriptions with this value
update the version of this management pack(in my case it's 6.1.7221.0, I've set 6.1.7221.1)
4. Import it back to SCOM

upd. The best solution is to place there any service account, for example SDK service account. That will solve this problem permanently.

SCOM 2007 R2 Manually installed agents

2011-03-24T09:58:00.000+01:00

Sometimes it is needed to change status of manually installed agents in SCOM.
This change(to "automatically installed") gives possibilities to auto-update agents in future, repair, uninstall and to change/add management server/failover server.

Getting list of all manually installed agents(Powershell):

Get-Agent | where {$_.ManuallyInstalled -match ‘true’} | ft name,ManuallyInstalled
Getting list of all manually installed agents(SQL query for DB):

SELECT bme.DisplayName FROM MT_HealthService mths 

INNER JOIN BaseManagedEntity bme ON bme.BaseManagedEntityId = mths.BaseManagedEntityId 

WHERE IsManuallyInstalled = 1

IsManuallyInstalled field is for installation status of an agent. We can change with the following query:  

UPDATE MT_HealthService
SET IsManuallyInstalled=0
WHERE IsManuallyInstalled=1

Changing the status of a direct agent:

UPDATE MT_HealthService 

SET IsManuallyInstalled=0 

WHERE IsManuallyInstalled=1 

AND BaseManagedEntityId IN 

(SELECT BaseManagedEntityID FROM BaseManagedEntity 

WHERE BaseManagedTypeId = ‘XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX′ 

AND DisplayName = ‘agentname.domain.local’)

SCOM 2007 R2 VHD download

2011-03-23T11:44:00.002+01:00

SCOM 2007 R2 Cumulative update 4

2011-03-23T11:23:00.002+01:00

The hotfix is about 1.26GB in size.

Cumulative Update 4 for SCOM 2007 R2 includes all previous cumulative updates for SCOM 2007 R2 and includes all cross-platform updates.

KB: http://support.microsoft.com/kb/2449679

Great guide for installation from Kevin Holman's blog.

Grooming settings in the OperationsManagerDW Database

2011-03-23T11:14:00.000+01:00

There is no UI to configure the grooming settings of the Data Warehouse DB.

The settings are stored in the StandardDatasetAggregation table which you can view by running the following SQL query:

SELECT AggregationIntervalDurationMinutes,  BuildAggregationStoredProcedureName, GroomStoredProcedureName,  MaxDataAgeDays, GroomingIntervalMinutes FROM StandardDatasetAggregation

The column MaxDataAgeDays holds the data retention period (in days), obviously lowering this is a quick and easy way to reduce the size of the database.

Here's a script to update the data retention period for Event data:

UPDATE StandardDatasetAggregation SET MaxDataAgeDays = (retention period in days) WHERE GroomStoredProcedureName = 'EventGroom'
  

Set agent proxy enabled for all agents in SCOM

2011-03-22T13:14:00.005+01:00

Some customers prefer to enable agent proxy on all agents.

There are 2 possible solutions in this case:
- running powershell script by schedule, which will set agent proxy enabled
- configure default global setting to make all new agents proxy enabled

Here's the script:

param($RMS)
## prepare OpsMgr shell 
if ((Get-PSSnapin | Where-Object {$_.Name -eq 'Microsoft.EnterpriseManagement.OperationsManager.Client'}) -eq $null) 
{ 
   Add-PSSnapin Microsoft.EnterpriseManagement.OperationsManager.Client -ErrorAction SilentlyContinue -ErrorVariable Err 
   if ($Err) { $(throw write-Host $Err) } 
} 
if ((Get-ManagementGroupConnection | Where-Object {$_.ManagementServerName -eq $RMS}) -eq $null) 
{    
   New-ManagementGroupConnection $RMS -ErrorAction SilentlyContinue -ErrorVariable Err 
   if ($Err) { $(throw write-Host $Err) } 
} 
if ((Get-PSDrive | Where-Object {$_.Name -eq 'Monitoring'}) -eq $null) 
{ 
   New-PSDrive -Name: Monitoring -PSProvider: OperationsManagerMonitoring -Root: \ -ErrorAction SilentlyContinue -ErrorVariable Err 
   if ($Err) { $(throw write-Host $Err) } 
} 
Set-Location Monitoring:\$RMS

## connect to management group 
$ManagementGroup = New-Object Microsoft.EnterpriseManagement.ManagementGroup($RMS) 
$ManagementGroup.Reconnect()

## Script body(can be run from Operations Manager Shell directly)

## set proxy enabled for all agents where it is disabled
$NoProxy = get-agent | where {$_.ProxyingEnabled -match "false"}
$NoProxy|foreach {$_.ProxyingEnabled = $true}
$NoProxy|foreach {$_.ApplyChanges()}

Here's the global setting:

Set-DefaultSetting -Name HealthService\ProxyingEnabled -Value True

Monitoring Print Services on Server 2008 R2

2011-03-22T07:25:00.001+01:00

The current Print MP is 6.0.6392.0 which supports monitoring Print Services on Windows 2000, Windows 2003, and Windows Server 2008. But if you add Print Services role to Windows server 2008 R2, it won't be monitored.

The cause is that this role was renamed in Windows Server 2008 R2.

Windows Server 2008 - "Print Services"
Windows Server 2008 R2 - "Print and Document Services"

So, that's why the discovery from management pack doesn't find any 2008 R2 Print Servers.

Solutions:

- unseal management pack and update the code of discovery:

SELECT Name FROM Win32_ServerFeature WHERE Name = "Print Services"
to
SELECT Name FROM Win32_ServerFeature WHERE Name = "Print Services" OR Name = "Print and Document Services"

- download Kevin Holman's management pack where several updates were done.

Contains an override to disable the Microsoft.Windows.Server.2008.PrintServerRole.Discovery discovery in the 2008 Print MP.
Contains a modified discovery which will discover print services on 2008 or 2008R2.
Contains an override to disable the Printer Object discovery.
Contains an override to change Printer Object discovery from 900 seconds to 14335 seconds.

link

SCOM Notification to ... twitter!

2011-03-20T13:19:00.000+01:00

Walter Eikenboom, Dutch SCOM guru, published a good posting how to enable SCOM in order to twitter the Alerts using the Notification Model.

This method of notification is insecure, but it is still really great!

Posting can be found here.

Greatest book for HP Network Node Manager(NNM)

2011-03-20T12:54:00.001+01:00

Fognet's Field Guide to OpenView Network Node Manager.

I suggest this book as the best guide to HP NNM(up to 7.53 version).

You can buy it on Amazon

Also available(reading for free) at google books

Magic Quadrants for Systems Management solutions

2011-03-18T10:20:00.003+01:00

Interesting rating of Systems Management solutions from Gartner.

Magic Quadrant for IT Event Correlation and Analysis

http://www.gartner.com/technology/media-products/reprints/microsoft/vol2/article5/article5.html

Magic Quadrant for PC Configuration Life Cycle Management Tools

http://www.gartner.com/technology/media-products/reprints/microsoft/vol2/article6/article6.html

Powershell Cmdlets for SCOM 2007 R2

2011-03-18T10:05:00.003+01:00

PsSnapin is called: Microsoft.EnterpriseManagement.OperationsManager.Client

get-help * | where {$_.pssnapin -like "*Enter*"} | sort name | select name,synopsis | ft –auto

Name	Synopis
Add-ConnectorToTier	Configures an Operations Manager Connector Framework connector for a specified tier.
Add-RemotelyManagedComputer	Adds a remotely-managed computer to an agent.
Add-RemotelyManagedDevice	Adds a remotely managed device to an agent.
Add-UserToUserRole	Adds the specified user to an Operations Manager role.
Approve-AgentPendingAction	Approves the specified agent pending action.
Disable-NotificationSubscription	Disables a notification subscription.
Disable-Rule	Disables a rule.
Enable-NotificationSubscription	Enables a notification subscription.
Enable-Rule	Enables a rule.
Export-ManagementPack	Exports a management pack to a file.
Get-Agent	Gets the agents associated with the specified management server.
Get-AgentPendingAction	Gets agent-pending actions.
Get-Alert	Gets the specified alerts.
Get-AlertDestinatin	Gets the connector to which the alert is forwarded.
Get-AlertHistory	Get the history for the specified alerts.
Get-Connector	Get the connectors for a management group.
Get-DefaultSetting	Gets the default settings for a management group.
Get-Diagnostic	Returns the available diagnostics.
Get-Discovery	Returns available discoveries.
Get-Event	Gets events.
Get-FailoverManagementServer	Returns the failover management servers.
Get-GatewayManagementServer	Returns the gateway management servers.
Get-MaintenanceWindow	Gets maintenance window information.
Get-ManagementGroupConnection	Gets all open Management Group connections.
Get-ManagementPack	Gets imported management packs
Get-ManagementServer	Gets management servers.
Get-Monitor	Gets management pack monitors.
Get-MonitorHierarchy	Retrieves the hierarchy of monitors for a particular monitoring object.
Get-MonitoringClass	Gets monitoring classes.
Get-MonitoringClassProperty	Gets the properties of a specified monitoring class.
Get-MonitoringObject	Gets monitoring objects.
Get-MonitoringObjectGroup	Returns the list of monitoring object groups.
Get-MonitoringObjectPath	Gets path to a monitoring object.
Get-MonitoringObjectProperty	Gets properties and associated values of monitoring objects.
Get-NotificationAction	Gets notification actions.
Get-NotificationEndpoint	Gets notification end points.
Get-NotificationRecipient	Gets notification recipients.
Get-NotificationSubscription	Gets notification subscriptions.
Get-OperationsManagerCommand	Returns all cmdlets that are provided by Operations Manager.
Get-Override	Gets management pack overrides.
Get-PerformanceCounter	Gets performance counters.
Get-PerformanceCounterValue	Gets data associated with a specified performance counter.
Get-PrimaryManagementServer	Returns the primary management server.
Get-Recovery	Returns available recovery objects.
Get-RelationshipClass	Gets monitoring relationship classes.
Get-RelationshipObject	Gets monitoring relationship objects.
Get-RemotelyManagedComputer	Gets remotely managed computers.
Get-RemotelyManagedDevice	Gets remotely managed devices.
Get-ResultantCategoryOverride	Gets resultant category overrides.
Get-ResultantRuleOverride	Gets resultant rule overrides.
Get-ResultantUnitMonitorOverride	Gets resultant monitor overrides.
Get-RootManagementServer	Returns the root management server.
Get-Rule	Gets monitoring rules.
Get-RunAsAccount	Gets run as accounts.
Get-State	Gets monitoring state for specified monitoring objects.
Get-Task	Gets monitoring tasks.
Get-TaskResult	Gets monitoring task results.
Get-Tier	Gets tiered management groups.
Get-UserRole	Gets user roles.
Install-Agent	Installs agents.
Install-AgentByName	Installs an Operations Manager agent on the specified computer.
Install-ManagementPack	Installs a management pack.
New-CustomMonitoringObject	Creates a custom monitoring object.
New-DeviceDiscoveryConfiguration	Creates an object that represents settings to use to discover devices.
New-LdapQueryDiscoveryCriteria	Creates a new LdapQueryDiscoveryCriteria object used to discover computers.
New-MaintenanceWindow	Puts the specified monitoring object into maintenance mode.
New-ManagementGroupConnection	Creates a new connection to a management group or tiered management group.
New-MonitoringPropertyValuePair	Creates a new monitoring property-value pair object.
New-Tier	Creates a new tier connection.
New-WindowsDiscoveryConfiguration	Creates an object that describes computers to discover.
Reject-AgentPendingAction	Rejects the specified agent pending action.
Remove-ConnectorFromTier	Removes an Operations Manager Connector Framework connector from a specified tier.
Remove-DisabledMonitoringObject	Removes all monitoring objects for which discovery is disabled.
Remove-ManagementGroupConnection	Removes a connection to a management group.
Remove-RemotelyManagedComputer	Removes a remotely managed computer from an agent.
Remove-RemotelyManagedDevice	Removes a remotely managed device from an agent.
Remove-Tier	Removes a tier.
Resolve-Alert	Resolves an alert.
Set-AlertDestination	Sets the Operations Manager Connector Framework connector to which the specified alert will be forwarded.
Set-DefaultSetting	Sets default settings.
Set-MaintenanceWindow	Sets properties of a maintenance window.
Set-ManagementServer	Sets the management server of an agent.
Set-ProxyAgent	Sets the proxy agent for a remotely managed computer or device.
Start-Discovery	Starts a discovery task for discovering devices or computers.
Start-Task	Starts a task.
Uninstall-Agent	Uninstalls the Operations Manager agent from managed computers.
Uninstall-ManagementPack	Uninstalls a management pack.

Operations Manager 2007 R2 Supported Configurations

2011-03-18T09:48:00.004+01:00

http://technet.microsoft.com/en-us/library/bb309428.aspx

SCOM and MOM Alerts Severities and Priorities

2011-03-18T09:40:00.002+01:00

It is quite difficult to find this information in documentation.

SCOM 2007

Severity

Critical = 2
Warning = 1
Information = 0

Priority

High = 2
Medium = 1
Low = 0

MOM 2005

Alert Level 70 Critical Alert Severity
Alert Level 60 Critical Alert Severity
Alert Level 50 Critical Alert Severity
Alert Level 40 Critical Alert Severity
Alert Level 30 Warning Alert Severity
Alert Level 20 Information Alert Severity
Alert Level 10 Information Alert Severity

Note that all alerts had low priority!

SCOM R2 versions numbers!

2011-03-16T13:09:00.004+01:00

Tables of SCOM Cumulative updates and Cross Platform Cumulative updates!

Here's the table with SCOM R2 version numbers and links for comulative updates:

Version Release Date KB
RTM 6.1.7221 20.08.2009

CU1 6.1.7221.13 15.01.2010 KB974144
CU2 6.1.7221.15 10.06.2010 KB979257
CU3 6.1.7221.49 01.10.2010 KB2251525
CU4 6.1.7221.61 31.01.2011 KB2449679

Here's the table of Cross Platform Cumulative updates for SCOM R2:

Version Release Date KB
RTM 1.0.4-248 20.08.2009

CU1 1.0.4-252 14.10.2009 KB973583
CU2 1.0.4-258 09.02.2010 KB979490
CU3 6.1.7000.277 01.10.2010 KB2222955
CU4 no info 31.01.2011 included in CU4

Note: Cross Platform CU3 and CU4 are integrated with overall SCOM updates. So you can't install them separately!

Alert table relationships in SCOM DW database

2011-03-16T12:44:00.000+01:00

Here's the alert schema in Operations Manager Data Warehouse database:

It can be very useful for custom reports.

For example report of alertname, raised time, userId. TicketId.

Why, when and who created a ticket.

use operationsmanagerdw
select AlertName, RaisedDateTime, DBLastModifiedByUserId, TicketId
FROM Alert.vAlertDetail INNER JOIN
Alert.vAlert ON Alert.vAlertDetail.AlertGuid = Alert.vAlert.AlertGuid
WHERE (TicketID > '0') AND (RaisedDateTime > '2011-02-01') AND (RaisedDateTime < '2011-03-01') AND (DBLastModifiedByUserId <> 'System')
Order by RaisedDateTime ASC

Troubleshooting WMI probe and Script related problems (part 1)

2011-03-16T10:30:00.000+01:00

In all SCOM implementations, even if you have installed all WMI&WSH fixes to managed systems there are always alerts like:

- Workflow Runtime: Failed to run a WMI query
Object enumeration failed
Query: 'SELECT xx FROM xx WHERE Name =xx
HRESULT: 0x800xxxxx

- Script or Executable Failed to run
- WMI Probe Module Failed Execution
- Failed to run a WMI query
- Failed to run a process or script
- Backward Compatibility Script Error

There're lots of possible causes of these alerts(see next parts).

Sometimes they create much noise in "Active Alerts" view, and there's always a chance to miss really important alert because of the mess.

As they do not have a direct impact to monitoring, firstly I suggest to create a special view in SCOM operational console for such alerts. You can set security settings to enable only administrators and authoring teams to view these alerts.

Possible solutions:

- change severity of all rules and monitors that generate these alerts to "0"(information) and set severity filter in "Active Alerts" view properties.
- create a notification command channel that runs when any alert appear and changes the resolution state of WMI&Scripts related alerts. Set resolution state filter in "Active Alerts" view properties.

I'm not interested in first solution, because some information alerts are important. We can create an own severity value, f.e. 4 for such alerts, but then we'll have a problem with severity filter, from gui there can be chosen only 3 type of severities.
And I think there's no any difficulties to implement it.

The second solution is much more interesting.
I will use the following powershell script for automatic resolution change:

$rootms="Server.local"

#Initializing the Ops Mgr 2007 Powershell provider
     add-pssnapin "Microsoft.EnterpriseManagement.OperationsManager.Client" -ErrorVariable errSnapin ;
     set-location "OperationsManagerMonitoring::" -ErrorVariable errSnapin ;
     new-managementGroupConnection -ConnectionString:$rootMS -ErrorVariable errSnapin ;
     set-location $rootMS -ErrorVariable errSnapin ;

$Alerts = get-alert -criteria 'Name = ''Script or Executable Failed to run'' OR Name = ''WMI Probe Module Failed Execution'' OR Name LIKE ''%Run As Account%'' OR Name LIKE ''%Failed to run a WMI query%'' OR Name LIKE ''%Failed to run a process or script%'' OR Name LIKE ''%Backward Compatibility Script Error%'' OR Name LIKE ''%The Operations Manager%''' | Where {$_.ResolutionState -eq 0}
foreach($Alert in $Alerts)
{$Alert.ResolutionState = 20
$Alert.Update("Resolution State Changed")}

Here's a step-step instruction:

- create a new resolution state for these alerts("20" in my example)
- create a new notification command channel:

- create a subscriber for this channel
- create a subscription, don't forget to set the filter to New alerts only
- important this script will be run under action account of RMS server!(I don't know why SCOM is not using the notification account for command channel!)

Now you have a special alert view that's very useful for future investigation and these alerts won't annoy operators!

Revision	Version	KB
2007	4.00.5931.0000
2007 SP1	4.00.6221.1000	link
2007 SP1 (KB)	4.00.6221.1193	KB977203
2007 R2	no change
2007 SP2	4.00.6487.2000	link
2007 SP2 (KB)	4.00.6487.2111	KB977203
2007 R3	4.00.6487.2157

Version	Release Date	KB
RTM 6.1.7221	20.08.2009
CU1 6.1.7221.13	15.01.2010	KB974144
CU2 6.1.7221.15	10.06.2010	KB979257
CU3 6.1.7221.49	01.10.2010	KB2251525
CU4 6.1.7221.61	31.01.2011	KB2449679

Version	Release Date	KB
RTM 1.0.4-248	20.08.2009
CU1 1.0.4-252	14.10.2009	KB973583
CU2 1.0.4-258	09.02.2010	KB979490
CU3 6.1.7000.277	01.10.2010	KB2222955
CU4 no info	31.01.2011	included in CU4

Systems Management

Altiris - Best Practice references for Symantec Management Platform 7.1

Planning and Documentation

Installation and Migration

Backup and Recovery

Performance Tuning

Troubleshooting

SCOM 2007 R2 Comulative Update 5

Cumulative Update 5 for System Center Operations Manager 2007 R2 is available

SCOM 2007 R2 - Exchange 2010 Management Pack Tuning

SCOM 2012 BETA - Now available

SCCM 2012 Beta 2 VHD Download

SCOM 2007 R2 - Admin Resource Kit

SCOM 2007 R2 - New management packs portal

SCOM 2007 R2 SQL Server Monitoring MP

SCOM 2007 R2 - Pool NonPaged Bytes monitoring

One of the way to monitor Memory Leaks in the system is to monitor the NonPaged Pool Bytes performance counter.

This counter is not being monitored by default in SCOM. There're only performance collection rules for that(disabled by default) and self-tuned monitor for Exchange 2003 role servers(Exchange management pack).

But for some reason you maybe interested to monitor such counter with predefined threshold. In my case, it was needed to created a monitor disabled by default with threshold of 178257920 bytes.

You can access/download this management pack in XML format here.

p.s.

Excellent article about Paged and NonPaged Pool:

http://blogs.technet.com/b/markrussinovich/archive/2009/03/26/3211216.aspx

Troubleshooting WMI probe and Script related problems (part 3)

Troubleshooting WMI probe and Script related problems (part 2)

SCOM 2007 R2 - Email Scheduled Reports

SCCM 2012 technet documentation

SCCM 2007 versions numbers!

SCOM 2007 R2 - Counting Alerts from each management pack

SCOM 2007 R2 - The service threw an unknown exception

Altiris 7.1 Suites and Solutions documentation

Installing Altiris IT Management Suite(ITMS) 7.1

SCOM 2007 R2 Exchange 2010 SP1 MP

Induction to Symantec Altiris Solutions

MMS 2011 - Key notes

SCOM 2007 R2 How to start

SCOM 2007 R2 How to unseal a management pack

SCCM 2012 Beta 2 Available for download

p.s.

System Center Configuration Manager v.Next Beta 1 May 2010

SCCM 2007 R2 VHD download

Download.

SCCM 2007 official documentation in PDF, DOC(X) etc.

SCCM 2007 List of log files

SCOM 2007 R2 Official Documentation

SCOM 2007 R2 maintenance mode history

SCOM 2007 R2 Subscriptions based on custom fields as criteria

SCOM 2007 R2 Subscriptions getting automatically disabled

SCOM 2007 R2 Manually installed agents

SCOM 2007 R2 VHD download

VHD Test Drive – System Center Operations Manager 2007 R2.

Download.

SCOM 2007 R2 Cumulative update 4

Grooming settings in the OperationsManagerDW Database

Set agent proxy enabled for all agents in SCOM

Monitoring Print Services on Server 2008 R2

SCOM Notification to ... twitter!

Greatest book for HP Network Node Manager(NNM)

Fognet's Field Guide to OpenView Network Node Manager.

I suggest this book as the best guide to HP NNM(up to 7.53 version).

You can buy it on Amazon

Also available(reading for free) at google books

Magic Quadrants for Systems Management solutions

Powershell Cmdlets for SCOM 2007 R2

Operations Manager 2007 R2 Supported Configurations

SCOM and MOM Alerts Severities and Priorities

SCOM R2 versions numbers!

Alert table relationships in SCOM DW database

Troubleshooting WMI probe and Script related problems (part 1)