Many IT professionals use Microsoft® System Center to monitor applications and servers, however they often lack network health visibility. While they may not be directly responsible for monitoring network devices, the additional network information can dramatically enhance their troubleshooting capability by checking if network problems are impacting their servers and applications.

Now SolarWinds Orion Management Pack can deliver detailed network health information to System Center from Orion Network Performance Monitor (NPM), a powerful network fault and performance management solution. The result is unprecedented visibility into the health of your IT infrastructure from within System Center.

Register for download at the source.

• Updated monitoring logic and a fully parameterized Multi-host Ping Rule with 6 overridable parameters that allows the user to specify a number of options, including a comma-separated list of IP addresses, NetBIOS and FQDN host names to be tested for ICMP echo (Ping) connectivity.
• Six overridable parameters are now exposed individually, much like in MS and commercial MPs (see figure 2 below).
• The ability to generate custom performance data allowing ping reponse time (in ms) to be automatically displayed in the included performance view (see figure 3)

Instructions for Use

For detailed configuration instructions, please view the readme.rtf included with the MP. MP features reviewed below.

Rules

There are three (3) rules in the MP, all targeted at the Windows Operating System and all DISABLED by default. This allows the end user to apply overrides to enable the monitoring, alert and event collection rules for the desired group of watcher nodes (servers running the rule to ping remote hosts).

Overridable Parameters

Parameters are now displayed individually as standard overridable parameters as in MS and commercial MPs, as shown below.

Figure 2 - Overridable parameters for Multi-host Ping Rule

The monitoring rule has six (6) overridable parameters (also pictured in figure 2)

• Enabled – Sets the enabled / disabled status of the rule. Default value is false (disabled)
• TimeOutSeconds – Seconds the monitoring script is allowed to run. Default value is 120 seconds, but can be increased for pinging longer lists of hosts if necessary. Note the ping operation on the list is serial in nature (1 host at a time).
• DeviceList – Comma-separated list of devices you wish to ping. The default value is www.google.com. This can be a mixture of IP addresses, FQDNs and NetBIOS names.
• LogPerfData - If 1, a performance data stream is logged and presented in the Performance View. Zero (0) disables this function. Default value is 1 (enabled).
• IntervalSeconds – Indicates the frequency with which the rule will run. Default value is 900 seconds (15 minutes).
• LogSuccessEvent – if 1, a success event is logged to the Operations Manager Event Log for each host pinged successfully. Zero (0) disabled this function. Default value is 0.

Views

The Multi-host Ping Management Pack has three views:

• An Alert View
• An Event View (showing failure, and optionally, success events)
• A Performance View displaying ping response for hosts targeted by the rule.

Figure 3 - Views in Multi-host Ping MP

Feedback

Please send feedback, errata and suggestions to administrator [AT] systemcenterforum.org

Registry value Check script - This script facilitates checking the value of a user-defined registry key to update a 2-state monitor in Operations Manager 2007. Error checking ensures state is updated in the event the registry key is not found.

Windows Process Check script - This script facilitates checking to ensure a given Windows process is running, and that the desired number of instances of the process are running.

Update your MOM skills to Operations Manager 2007 at the Operations Manager 2007 Bootcamp! Check the 2008 Bootcamp Schedule and request pricing and availability HERE.

Download the Operations Manager Infrastructure Design and Planning Guide HERE.

Revisions:

• 6/28/2008 - Added link to Timothy McFaddens Powershell group maint mode script that handles nested groups.
• 5/7/2008 - Added link to Andrzej version of group maintenance mode that provides up to 10 maintenance schedules through the rules in the console UI.

1. Put a computer in maintenance mode - To truly silence an agent management computer, you must put the computer, health service and health service watcher in maintenance mode. This script does exactly that. Boris put some Powershell together to make that happen, and then Timothy quickly packaged it into a .ps1 file with the appropriate connection string.

Get the classic maintenance mode Powershell script HERE.

2. Put a group of computers in maintenance mode - Putting a group of computers into maintenance mode is an obvious timesaver. Timothy McFadden put a nice script together to put a group of computers into maintenance mode, and Boris created a similar script several months later.

• Get Timothy’s group maintenance mode script HERE.
• June 28th, 2008 - Timothy updated his group maintenance mode Powershell script to handle nested groups, HERE.
• Get group maintenance mode, Boris flavor HERE
• However, Brian Wren’s treatment of group maintenance mode (wrapped in an MP) is not to be missed when you’re learning about maintenance, Powershell or MP authoring. Check it out HERE.
• May 7th, 2008 - Andrej posted an updated version of Brians MP that allows up to 10 maintenance mode schedules for groups of computers, configurable through the UI. It can be found HERE.

Target this to the ‘Agent Managed Computer Group’ and you can put just about everything Windows into maintenance mode all at once.

3. Put an object type (other than a computer) in maintenance mode - This puts an instance of any object type you specify into maintenance mode. This allows you to put an object, such as a web application, into maintenance mode while monitoring of the computer and its other components remains active.

See the code snippet for maintenance mode for any object class HERE or HERE.

4. AgentMM Command Line Utility - Written by Clive Eastwood, this command line tool puts Ops Mgr 2007 agents into maintenance mode (all 3 object classes necessary).

Download Clive’s tool HERE.

5. Putting agents in maintenance mode remotely - Andrzej has a nice walkthrough incorporating Clive’s AgentMM.exe maintenance mode CLI tool for a scheduled batch job or ad-hoc execution.

Find a description and link HERE.

“Customers have told us that they appreciate the innovation behind our enterprise management systems connectors to VMware. We’ve also heard that you sometimes wish we had more developers to devote to continuing enhancement of these products. With today’s announcement of nworks’ acquisition by Veeam Software, that wish has come true.

nworks is now part of Veeam Software, an award-winning provider of systems management tools for VMware infrastructures. Like nworks, Veeam is known for its innovation, but Veeam is a larger organization, with nearly 50 developers focused on VMware.

Veeam is best known for its FastSCP freeware, and the company also offers Veeam Backup, the 2-in-1 backup and replication solution; Veeam Reporter, an automated way to discover and document VMware virtual server environments; Veeam Configurator, a simple way to configure and provision ESX servers; and Veeam Monitor, for a bird’s-eye view of key performance metrics across the entire VMware infrastructure. “

Learn more by reading the news release and the FAQ.

Speaker topics:
*Bruce Payette (Microsoft): PowerShell v2 modules.
*Wassim Fayed (Microsoft): PowerShell v2 remoting.
*Hal Rottenberg: Managing VMware Infrastructure using PowerShell.

On, June 26th at noon CDT (1pm New York time), the 1st online meeting of the System Center Virtual User Group takes place, with topics including ACS internals, the new cross-platform feature in OpsMgr 2007 SP2, as well as OpsMgr Powershell tips from MVP Marco Shaw.

• 12:00PM-12:10PM: Introduction
• 12:10PM-12:40PM: Anders Bengtsson (OpsMgr MVP) - Cross-PLatform Monitoring in Operations Manager 2007 SP2.
• 12:40PM-1:10PM: Ryan Brennan (SecureVantage) - ACS Best Practices & Configuration Tips
• 1:10PM-1:40PM: Marco Shaw (Powershell MVP) - PowerShell within System Center Operations Manager 2007
• 1.40PM-1:50PM: Closing

The IBM Director 5.2 MP listed in the System Center Pack Catalog has a new name (as shown in figure 1) and updated functionality on the IBM Website. After exporting the MP and looking through the discoveries and monitoring, it appears several changes have taken place. I’ll talk more about what I see under the hood later.

Figure 1. IBM Management Pack downloads on IBM Site.

WHERE TO GET THEM:

To get the new IBM Hardware MPs, go to the following URL (requires login)

https://www14.software.ibm.com/webapp/iwm/web/reg/pick.do?lang=en_US&source=dmp

Incidentally, the IBM BladeCenter management pack appears to have received a MAJOR update over the last version I downloaded.

Make sure to register for the first meeting of the System Center Virtual User Group on Thursday, June 26th at 12pm CDT.

• Fixes to noisy rules / monitors
• Resource utilization and cluster discovery issues  resolved (in part through the 3 related hotfixes below)
• There is now an MP Guide for Exchange 2007.

Get the MP and the hotfixes at the links  below

The Exchange 2007 MP has been updated and is available from : http://www.microsoft.com/downloads/details.aspx?FamilyId=1A83E112-8677-4E03-83C3-F1B7EBFC3A4B&displaylang=en&displaylang=en

This MP release has dependencies on some recent hotfixes released :Including KB950853, KB951979, KB951380

Here are the one-liners for a quick-and-easy inventory of Jalasoft-managed servers. (Watch the line wrap below)

Red Hat

get-monitoringclass -name “Jalasoft.Xian.SmartManagementPacks.LinuxServers.DeviceGroup” | get-childitem | ft DisplayName

AIX

get-monitoringclass -name “Jalasoft.Xian.SmartManagementPacks.AIXServers.DeviceGroup” | get-childitem | ft DisplayName

Careful, those -name values seem to be case sensitive!

Check out Vin’s blog at http://scomnivore.wordpress.com/

Also, Vin wrote an interesting 4-part developer-centric series on Workflows in Operations Manager. Check it out at the URL below:

http://scomnivore.wordpress.com/special-series/workflow-tracer-1-of-4-workflow-primer/

Meeting and Registration Details

Date: June 26th

Time: 12:00 p.m. Central Standard Time (6pm GMT)

Agenda

• 12:00PM-12:10PM: Introduction
• 12:10PM-12:40PM: Anders Bengtsson (OpsMgr MVP) - Cross-Platform Monitoring in Operations Manager 2007 SP2.
• 12:40PM-1:10PM: Ryan Brennan (SecureVantage) - ACS Best Practices & Configuration Tips
• 1:10PM-1:40PM: Marco Shaw (Powershell MVP) - PowerShell within System Center Operations Manager 2007
• 1.40PM-1:50PM: Closing

Event Registration

To sign up for this event, register at the following URL:

https://www.clicktoattend.com/invitation.aspx?code=129503

• In the Authoring space, browse to Groups.
• Create a group and provide desired name. On the Explicit Members screen, leave blank and click Next.
• On the Dynamic Members screen, set the following formula, setting the object display name to meet your needs.
• From the Class drop-down, choose Windows Logical Hardware Component, then click the Add button (as shown in the figure below).
• Choose the Display Name field from the drop-down, and set it’s value equal to the display name of the drive you wish to group, such as C:.

TIP: Find your drive display names by viewing the properties of objects from the various default State Views or using the object picker in the Distributed Application Designer.

• In the second dropdown, choose Windows Computer NetBIOS name. Set comparison operator to matches wildcard, and then type a wildcard representing the naming convention you want to match. Just a word of warning - this comparison seems to be case sensitive.

For example, to match the computer name OPSMGR, I used a formula value of *PSMG*|*psmg*, which would match the upper case or lower case versions of the string. (The pipe symbol | represents the OR operator in a wildcard comparison such as this).

The resulting formula looks something like this:

When finished, click OK. Right click the group and select View Membership to see the results of your work.

I’d talked in the past about the issues with the Exchange 2003 queue monitoring focused on the fact that the default monitors (shown in figure 1) are 2-state baselining threshold monitors, which, after 7 days of good Exchange performance, raise alerts too quickly when the queue values move from zero (0).

I propose that these should be replaced in most environments with a recurring threshold monitor to provide a more predictable notification pattern in conditions of Exchange queuing.Shown in figure 1 are the queue monitors I have found to be the noisiest of the lot. When you target your view to the Exchange Queue class, you’ll see more than just these – let the alert noise in your environment guide your decisions in disabling any self-tuning monitors in favor of the recurring threshold monitor.

Figure 1. Exchange 2003 2-state baselining monitors for Exchange Queues

Recommended Alternate Configuration
I suggest using the recurring threshold monitor to setup two alert levels for each of the Exchange 2003 queues shown in figure 1 – one for warning and one for critical. I start with 25 (warning) and (50 critical) and adjust from there based on the environment. HOWEVER, let the needs of your situation rule in this regard
. 

Figure 2. Recurring threshold monitor in OpsMgr  

To Configure:

1. Begin by finding the problematic queue monitors shown in figure 1 and documenting the performance counters they use. In the Authoring space, scope your view to Exchange Queue and search on the word “queue”.

2. In the Operations console, browse to the Authoring space and select Monitors.

3. Right click and select New Monitor à Unit Monitor àWindows Performance Threshold à Single Threshold à Consecutive samples over threshold

4. Before clicking Next, make sure you select a custom management pack in which to save these monitors.

5. On the General Properties screen, provide a monitor Name and Description, and set the target to object type Exchange Queue.

6. On the Performance Object, Counter and Instance screen, enter the performance counter, object and instance you documented in step 1. Set the desired Object, Counter and Instance.

7. On the Threshold Comparison Settings screen, set the desired threshold that represents the warning or critical threshold in your environment. (Again, I suggest monitors for each – one with a warning level and the other with a critical based on what you feel is appropriate in your environment). See figure 3 below as an example.

8. On the Configure Health screen, set the Health State for condition true (which represents the threshold breach) to Warning or Critical as appropriate.

9. On the Configure Alerts screen, check the “Generate Alerts” option and set the appropriate severity based on your configuration on the previous screen.

10. Click Create and you’re done. If you created the monitor as disabled (MS best practice), then configure an override to enable for the group of Exchange servers as appropriate in your environment.The result should look similar to what you see in the example in figure 3. Adjust the number of samples and the threshold to suit your environment.

Figure 3. Threshold Comparison Settings

Customizing the Alert Description – IMPORTANT

There seems there may be a bug in the implementation of the recurring threshold monitor when you attempt to display the current queue value in the alert description. Normally when working with a Windows performance counter in a monitor, you would add the following xml string to the alert description field to present the current value of the counter:

$Data/Context/Value$

However, when we tried this in a recurring threshold monitor, the number returned was the number of polling samples (shown in figure 3) rather than the expected value of the performance counter we were sampling in the event. That being said, it may make sense to be sure there is a collection rule for each queue counter you update to present the value of the counter in a Performance View.

 Check out the System Center Solutions Contest now in progress at the System Center Virtual User Group for a chance to win an Xbox 360, Zune 2 or other great prizes.

1. If it’s defined as an object class, OpsMgr can discover the object on an agent-managed computer
2. If OpsMgr can discover it, we can determine the health state through monitors.
3. If we can determine the health state, OpsMgr can report on it’s Availability using the generic Availability reports

This includes your custom object classes as well!

Update your MOM skills to Operations Manager 2007 at the Operations Manager 2007 Bootcamp! Check the 2008 Bootcamp Schedule and request pricing and availability HERE.

Just run the following query in an instance of SQL Mgmt Studio connected to the server hosting your data warehouse.

use OperationsManagerDW
select ReportDefaultName, ReportDefaultDescription from report

Update your MOM skills to Operations Manager 2007 at the Operations Manager 2007 Bootcamp! Check the 2008 Bootcamp Schedule and request pricing and availability HERE.

Get-NotificationSubscription |where-object {$_.Enabled -eq $true}| Format-List DisplayName, ToRecipients
or
Get-NotificationSubscription |where-object {$_.Enabled -eq $true}| Format-Table DisplayName, ToRecipients

Check out the System Center Solutions Contest now in progress at the System Center Virtual User Group for a chance to win an Xbox 360, Zune 2 or other great prizes.

We’ve long known using the standard command line utilities certreq and certutil this is possible. You want to be careful from a security perspective not to leave anything behind on the file system from this process, but the steps are outlines at (more at source)

However, I did manage to locate the updated copies available for online reading (links below).

• OS MP Guides - Click HERE
• Server MP Guides - Click HERE

Update your MOM skills to Operations Manager 2007 at the Operations Manager 2007 Bootcamp! Check the 2008 Bootcamp Schedule and request pricing and availability HERE.

Read the full article at the source.

If you  did not catch part 1, you will find it HERE.

Download the SCW Roles and Security Hardening Guide HERE.

Where to get the fix:

The fix is described in KB951526. I do not see this KB on the MS support site yet, so call Microsoft support to obtain the fix.

NOTE: The patch applies to System Center Operations Manager 2007 SP1 only

Symptoms

You will see this event in the Operations Manager event log on the server that has the rule which is using our SNMP networking module in a discovery rule:

Event Type: Error

Event Source: HealthService

Event Category: Health Service

Event ID: 4000

Date: 4/22/2008

Time: 1:32:13PM

User: N/A

Computer: OPSMGRSRV1

Description:

A monitoring host is unresponsive or has crashed. The status code for the host

failure was 2164195371.

For more information, see Help and Support Center at

http://go.microsoft.com/fwlink/events.asp.

Affected Files

This hotfix impacts the following installed files: MomNetworkModules.dll (Version 6.0.6278.24)

Additional Information

For additional information about this issue, see KB article KB951526 at <http://support.microsoft.com/>. For additional information and downloads, see <http://www.microsoft.com/mom>.

I think it’s off to a good start. Follow the series on the System Center Virtual User Group site ( html | rss ) .

Here are the initial resource links:

• Series: 70-400 (Configuring Operations Manager 2007) Exam Study Notes
• 70-400 Exam Study Notes: Section 1a - Configure Notifications
• 70-400 Exam Study Notes Homepage

Check out the System Center Solutions Contest now in progress at the System Center Virtual User Group for a chance to win an Xbox 360, Zune 2 or other great prizes.

We’ve got the blog for the System Center Configuration Manager Unleashed book online at http://configmgr.spaces.live.com/.

Check out our first post, 10 Reasons to Use Configuration Manager 2007.

Update your MOM skills to Operations Manager 2007 at the Operations Manager 2007 Bootcamp! Check the 2008 Bootcamp Schedule and request pricing and availability HERE.

While we’re on the topic, MOM  2005 also made it possible to audit changes to MOM itself, as it logged the name of user who made the change in the database (this is no longer true in Opsmgr 2007). The MOM 2005 Audit MP audits changes to both MOM rules and global settings. Download it HERE.

Update your MOM skills to Operations Manager 2007 at the Operations Manager 2007 Bootcamp! Check the 2008 Bootcamp Schedule and request pricing and availability HERE.

The short version of the problem is:

1. You load Operations Manager 2007 SP1
2. You load the Opsmgr SP1 agent on an Exchange computer
3. A memory leak occurs on the Exchange 2007 computer.

Instructions on how to get the patch HERE.

Update your MOM skills to Operations Manager 2007 at the Operations Manager 2007 Bootcamp! Check the 2008 Bootcamp Schedule and request pricing and availability HERE.

Read the full article at the source

Where to get it:

http://systemcenterforum.org/wp-content/uploads/NotificationTestMP.zip

How it works:

This MP presents an agent task that can be executed against any agent-managed computer.

The task executes the following command, which logs an error event ID: 1000 from source: NotificationTest.

eventcreate.exe /T Error /ID 1000 /So NotificationTest /L Application /D “Testing Opsmgr notification”

If successful, output appears as follows

An associated Event Rule called ‘End-to-End Notification Test’ (shown below) raises a critical alert (medium severity), which should be delivered to any recipient with a notification subscription including critical alerts.

Targeting:

• The task is targeted to the Windows Computer class, which exposes the task in the Computer State View
• The rule is targeted at Windows Operating System. However, since EventCreate is not present on the Windows 2000 OS, the rule is only enabled for Windows XP and Windows 2003 Computer Groups

Update your MOM skills to Operations Manager 2007 at the Operations Manager 2007 Bootcamp! Check the 2008 Bootcamp Schedule and request pricing and availability HERE.

Question: I need to report on Disk Time, and can’t see this counter even under Performance reports. I see Disk Reads/Writes, but not Disk Time on one series. Even Disk Performance Analysis doesn’t contain it.

Answer: While this data could included in the Performance Report in the Opsmgr Generic report library, the data is not present in the data warehouse by default for a couple of reasons

Physical Disks are not discovered by default as of the current version of the Windows 2003 Performance Library. Start by enabling the Discover Windows Physical Disks object discovery. Once you do this, you will find disk per second read, write and transfers performance counters are tracked through monitors.

You’ll also see that a couple of these counters are not enabled by default (in particular, the disk per second read and disk per second write), and will need to be enabled via overrides. (You’ll notice that Enabled by Default is NO in the screen shot below).

Hopefully this clears up a potential point of confusion for some of you who have experienced this issue.

Check out the System Center Solutions Contest now in progress at the System Center Virtual User Group for a chance to win an Xbox 360, Zune 2 or other great prizes.

Space is limited.
Reserve your Webinar seat now at:
https://www2.gotomeeting.com/register/355396121

This presentation will focus on process considerations and how MP Studio features can function as the foundation for a repeatable process.

If you have multiple management packs, multiple management groups and multiple administrators working with Operations Manager, having a well defined process is critical to a successful implementation of Operations Manager 2007. Even with smaller implementations, having a defined process for handling change requests for management packs is critical to avoiding costly downtime and unnecessary errors.

If ITIL and MOF are important to you, if Change Management and Version control are important functions in your organization, if auditing changes in management packs is something you would like to be able to do, then this webcast could be the most important event you attend all year!

All participants who sign up for the presentation will receive a copy of the Implementation Guide v1.0 Quick Reference by email after the presentation.

Title:MP Implementation and Lifecycle Management

Date: Wednesday, May 28, 2008

Time:11:00 AM - 12:00 PM EDT

Check out the System Center Solutions Contest now in progress at the System Center Virtual User Group for a chance to win an Xbox 360, Zune 2 or other great prizes.

• The remote interactive command prompt we mentioned above  and

• A ‘Who’s logged on’ task that retrieves the interactively logged on user(s) on the remote computer

 The MP does require you to download the psexec and psloggedon PSTools from Microsoft. Read the Readme.rtf contained in the download for further instructions and description.

Where to get it: 

Download the PSTasks MP at the URL below:

 http://systemcenterforum.org/wp-content/uploads/PSTasks.MP.zip

NOTE: While it would seem easy to update this task for Operations Manager 2007, it turned out to be a bit of work, and required an assist from pros. Do not attempt to edit either task through the UI or it will break the tasks. Any edit through the Operations console UI causes a space to be inserted between the \\ and the computer name, thus breaking the task.

Check out the System Center Solutions Contest now in progress at the System Center Virtual User Group for a chance to win an Xbox 360, Zune 2 or other great prizes.

Download DWDATARP.EXE at the source.

Check out the System Center Solutions Contest now in progress at the System Center Virtual User Group for a chance to win an Xbox 360, Zune 2 or other great prizes.

Note: All script samples contain | export-csv c:\alerts.csv to export the results to a spreadsheet for easy reading. Just remove this if you want to echo results to the screen.

 # Most Common Among All Alerts (any resolution state)

# Most Common Among All Active Alerts Raised in Last 7 days

$targetdate = (get-date).AddDays(-7)

get-alert | where-object {($_.ResolutionState -ne 255) -and ($_.TimeRaised -gt $targetdate)} | Sort -desc RepeatCount | select-object -first 10 Name, RepeatCount, MonitoringObjectPath | export-csv c:\alerts.csv

Did you find these helpful, or perhaps lacking in some way? I would appreciate your feedback as a comment on this post or via the Contact page.

• For course syllabus, click HERE.
• For a list of dates and cities, click HERE.
• To request registration, click HERE.