David Allen - OpsMgr MVP

Creating a Repeat Event Detection Rule

David Allen MVP — Thu, 10 Mar 2011 10:53:50 GMT

I had a requirement to create a repeat event detection rule the other day, and I thought to myself that it would be very easy. As it turns out though, it is not as easy to create a repeat event detection rule as it is a monitor. When creating a new monitor you have an option to select a Repeat Event monitor type, but when creating a rule there is no such option. I the set about looking for a way to solve this issue as I needed to alert on repeated events but I didn’t want to affect the state of any object.

After 30 minutes or so, I found the Consolidator module which sounded like it could provide me with the functionality I needed. After further digging, I managed to confirm that I could indeed use this module as a condition detection on the rule to perform the repeat count. So, by building a custom rule in the Authoring Console or in the XML, you can manually specify a data source module, a condition detection module, and a write action module to create an alert generating rule based on repeat events.

I’ll demonstrate how to build an alert generating repeat event detection rule using the authoring console. I know many of you also work directly in the XML, as I am one of them, but I don’t think think that is the most common way of authoring; but to satisfy you XML geeks out there, I will also provide the XML.

1. Create a new custom rule.

2. Provide an ID, Name, Description and Target.

3. Select the Modules tab.

4. Create a New data source.

5. Select Microsoft.Windows.EventProvider, enter a module ID, click OK.

6. Create a New condition detection.

7. Select System.ConsolidatorCondition, enter a module ID, click OK.

8. Create a New write action.

9. Select System.Health.GenerateAlert, enter a module ID, click OK.

10. Your rule modules should now look like this.

11. Now to configure the modules.

12. Edit EventProvider, then select Configure to configure the events you want to monitor for. Click OK to get back to the modules.

13. Edit Consolidator, then select Configure to set the repeat detection requirements. Click OK to get back to the modules.

14. Edit Alert, then select Configure to specify the alert information required. Click OK to get back to the modules.

20. Update Product Knowledge and rule Options as you require.

21. Click OK and you’re Done!

And, as promised here is the XML.

<Rule ID="TEST.NewRule" Enabled="true" Target="Windows!Microsoft.Windows.Server.OperatingSystem" ConfirmDelivery="true" Remotable="true" Priority="Normal" DiscardLevel="100">
        <Category>Custom</Category>
        <DataSources>
          <DataSource ID="EventProvider" TypeID="Windows!Microsoft.Windows.EventProvider">
            <ComputerName>$Target/Host/Property[Type="Windows!Microsoft.Windows.Computer"]/NetworkName$</ComputerName>
            <LogName>Application</LogName>
            <Expression>
              <And>
                <Expression>
                  <SimpleExpression>
                    <ValueExpression>
                      <XPathQuery Type="UnsignedInteger">EventDisplayNumber</XPathQuery>
                    </ValueExpression>
                    <Operator>Equal</Operator>
                    <ValueExpression>
                      <Value Type="UnsignedInteger">1234</Value>
                    </ValueExpression>
                  </SimpleExpression>
                </Expression>
                <Expression>
                  <SimpleExpression>
                    <ValueExpression>
                      <XPathQuery Type="String">PublisherName</XPathQuery>
                    </ValueExpression>
                    <Operator>Equal</Operator>
                    <ValueExpression>
                      <Value Type="String">TEST</Value>
                    </ValueExpression>
                  </SimpleExpression>
                </Expression>
              </And>
            </Expression>
          </DataSource>
        </DataSources>
        <ConditionDetection ID="Consolidator" TypeID="System!System.ConsolidatorCondition">
          <Consolidator>
            <ConsolidationProperties />
            <TimeControl>
              <WithinTimeSchedule>
                <Interval>300</Interval>
              </WithinTimeSchedule>
            </TimeControl>
            <CountingCondition>
              <Count>10</Count>
              <CountMode>OnNewItemTestOutputRestart_OnTimerRestart</CountMode>
            </CountingCondition>
          </Consolidator>
        </ConditionDetection>
        <WriteActions>
          <WriteAction ID="Alert" TypeID="Health!System.Health.GenerateAlert">
            <Priority>1</Priority>
            <Severity>2</Severity>
            <AlertMessageId>$MPElement[Name="AlertMessageID916c4011bf974c688031509e9d09a120"]$</AlertMessageId>
            <AlertParameters>
              <AlertParameter1>$Data/Count$</AlertParameter1>
              <AlertParameter2>$Data/Context/DataItem/EventDescription$</AlertParameter2>
            </AlertParameters>
          </WriteAction>
        </WriteActions>
      </Rule>

I think this does highlight that there are a number of modules that we could be making better use of, but we just don’t know about them.

Happy rule building!

David

IMPORTANT NEWS – AuthorMPs.com is Moving

David Allen MVP — Fri, 25 Feb 2011 19:15:11 GMT

Big news – www.authormps.com is being retired and all its content is being moved to TechNet blogs. The new location for AuthorMPs will be http://blogs.technet.com/b/authormps/.

Add this to your list of resource sites now, as if you do any level of MP authoring, this site is of great use to you!

If you use RSS, the new feed address is http://blogs.technet.com/b/authormps/rss.aspx.

David

AVIcode Forum on TechNet

David Allen MVP — Mon, 17 Jan 2011 23:35:00 GMT

There is now a new AVIcode forum on TechNet which is available here, http://social.technet.microsoft.com/Forums/en-US/category/systemcenteroperationsmanager.

Justin Incarnato from the OpsMgr Product Team just announced this latest forum on the OpsMgr Product Team blog, http://blogs.technet.com/b/momteam/archive/2011/01/17/new-avicode-forum-on-technet.aspx.

So, if you're using AVIcode, or thinking of using AVIcode, ask your questions there!!

David

Hanging Opalis Console

David Allen MVP — Thu, 13 Jan 2011 16:39:00 GMT

I have been using Opalis constantly since it became available from Microsoft and I think it is an absolutely great application. The ability to integrate, automate and orchestrate virtually anything is awesome and I am now always finding myself saying "Opalis could do that".

When using Opalis this week though, I noticed that Integration Server console kept hanging for 2-3 minutes every time I tried to access certain policies. After trying the usual reboot step to no avail, I went digging a bit deeper and found this MS article, http://support.microsoft.com/kb/2104676.

Basically, Opalis keeps historical data of policies in Policy logs and over time these logs can grow and grow and grow until eventually you start experiencing performance issues in the console. The solution is to simply purge the policy logs and all is good again. And, to prevent the same thing happening in the future, you can schedule the purge of these logs.

To manually purge the policy logs:

Open the Opalis Integration Server console and connect to a management server.
Right-click the management server and select Log Purge....
Click Purge Now.

To automatically purge the logs, simply follow the steps above, enable and configure a log purge schedule, and hit Finish.

As easy as that!!!

David

MDT 2010: Johan Arwidmark at a Windows Management User Group event

David Allen MVP — Thu, 06 Jan 2011 13:08:00 GMT

Check out this video of Johan Arwidmark presenting at a WMUG event last year.

http://www.myitforum.com/absolutevc/avc-view.aspx?videoid=2062&categoryid=0

Johan gives a demonstration of MDT 2010 and ConfigMgr SP2 working together. In this video, Part 1, Johan covers MDT 2010, and in Part 2 of the video he moves on to cover the integration of MDT 2010 into and use of ConfigMgr SP2 Site for deployment purposes.

A very good presentation, as it always is from Johan!!

David

System Center MS Blogs

David Allen MVP — Thu, 06 Jan 2011 12:33:00 GMT

Hi All,

Thought I would post this list of useful MS System Center blogs. With the new recent additions to the System Center suite, namely Opalis and AVICode, there is now a significant number of products in the suite and each product has its own MS blog.

Team

Blog

RSS

App-V

WSUS

MDM

ConfigMgr

OpsMgr

VMM

MED-V

DPM

OOB

Opalis

Service Manager

AVIcode

http://blogs.technet.com/appv/

http://blogs.technet.com/sus/

http://blogs.technet.com/mdm/

http://blogs.technet.com/configurationmgr/

http://blogs.technet.com/operationsmgr/

http://blogs.technet.com/scvmm/

http://blogs.technet.com/medv/

http://blogs.technet.com/dpm/

http://blogs.technet.com/oob/

http://blogs.technet.com/opalis

http://blogs.technet.com/b/servicemanager

http://blogs.technet.com/b/avicode

http://blogs.technet.com/b/appv/rss.aspx

http://blogs.technet.com/sus/

http://blogs.technet.com/b/mdm/rss.aspx

http://blogs.technet.com/b/configurationmgr/rss.aspx

http://blogs.technet.com/b/operationsmgr/rss.aspx

http://blogs.technet.com/b/scvmm/rss.aspx

http://blogs.technet.com/b/medv/rss.aspx

http://blogs.technet.com/b/dpm/rss.aspx

http://blogs.technet.com/b/oob/rss.aspx

http://blogs.technet.com/b/opalis/rsscomments.aspx

http://blogs.technet.com/b/servicemanager/rsscomments.aspx

http://blogs.technet.com/b/avicode/rss.aspx

I would recommend adding them all to your favourites now.

David

AVIcode is available from Microsoft

David Allen MVP — Fri, 17 Dec 2010 14:42:21 GMT

It was announced a few months ago that Microsoft had acquired AVIcode. Since then, we have been wondering when Microsoft were going to release the product and how they were going to license it and today we have found out. Microsoft have released AVIcode as a product in the System Center suite and have added it to the SMSE/SMSD with SA licensing; this means that if you already license the System Center suite, you can get AVIcode now! And, from what I can gather the product isn’t much different from when it was available from AVIcode so it is an all round win/win situation if you use System Center.

Check out the AVIcode page here, http://www.microsoft.com/systemcenter/en/us/avicode.aspx, where there is more information and download links for the AVIcode trial and the full download for SMSE/SMSD customers.

If you don’t know what AVIcode is, here is an overview that I lifted straight from the MS site.

AVIcode delivers market-leading .NET application performance monitoring capabilities to help ensure the availability of business-critical applications and services, regardless of where they are deployed. End-user experience and application performance monitoring are critical in virtual datacenters and cloud environments. As more customers move to consuming cloud-based services, Microsoft will address concerns about the gap between existing applications and those designed for the cloud by providing unified management across physical, virtual, and cloud environments.

Today, you can benefit from AVIcode capabilities by:

Simplifying management with automatic discovery of application dependencies.

Addresses custom LOB monitoring without the need for extensive MP authoring

Graphical application topology view displays dependency between distributed components

Optimizing business productivity with always-on, real-time monitoring, and rapid error resolution of business critical applications

End-user experience and application performance monitoring are critical for virtual datacenter and cloud environments

Identifies precise cause of application error allowing delivery of actionable information to the proper support team for faster resolution

Lowering the cost of managing datacenter services by establishing enterprise-wide standards to manage custom and disparate applications

Distributed web services and outside-in monitoring

Monitor and measure service-level delivery (SLAs)

I am downloading AVIcode now and I think you should too.

Enjoy.

David

Which 3rd Party Opalis Integration Packs Are Important to You?

David Allen MVP — Thu, 02 Dec 2010 10:10:00 GMT

Hi All

The Opalis team are after your feedback on which 3rd Party integration packs should be updated first and what improvements they should include. Microsoft have committed to maintaining and growing the 3rd party IPs and this is the first step by MS to make good on that commitment; which is great!

To give your feedback visit the survey on Connect here, http://connect.microsoft.com/Opalis/Survey/Survey.aspx?SurveyID=11962.

Source: http://blogs.technet.com/b/systemcenter/archive/2010/12/01/opalis-3rd-party-integration-packs-help-us-prioritize-the-updating-process.aspx

David

Updated CleanMOM.exe

David Allen MVP — Tue, 16 Nov 2010 22:12:03 GMT

Back in January 2008 I blogged about the CleanMOM.exe tool (http://www.aquilaweb.com/blog/index.php?itemid=30) as I was finding it extremely useful and was sure many others would to. Gathering by the number of hits that post got, I’m guessing I was correct and that CleanMOM was very helpful.

Since that original blog post though there was a very significant new release of Operations Manager, namely System Center Operations Manager R2. This release, as we all know, resolved many of the issues in the previous version and must be upgraded to for far improved stability and performance. These improvements meant that there wasn’t such a need for a CleanMOM tool, which proved lucky as it didn’t work with R2 anyway.

Well now there is an updated version on CleanMOM.exe available. I know it’s a bit late but at least it’s here. To download it visit this post by Rob Kuehfus, http://blogs.technet.com/b/momteam/archive/2010/11/16/updated-momclean-reskit-tool-for-om2007r2.aspx.

All the parameters for running the tool remain the same. If you can’t remember what they are, here you go.

Possible usage:
- CleanMom.exe /c /(xml file name) = Produce inventory XML of installed SCOM components
- CleanMom.exe /a /(xml file name) = Process inventory XML of installed SCOM components
- CleanMom.exe /CleanAgents = Remove SCOM agent MSI information
- CleanMom.exe /CleanServers = Remove SCOM server MSI information

Enjoy!

David

MVP For Another Year!

David Allen MVP — Fri, 01 Oct 2010 15:59:00 GMT

Today I was pleased to receive an email from Microsoft stating that I have been presented with an MVP for award for another year. I have once again been presented with an MVP award for System Center Operations Manager, however I will still continue to work with all the products in the System Center suite!

Thanks to everyone who has supported me :-)

David

Licensing Changes Make DPM Even Cheaper!

David Allen MVP — Fri, 25 Jun 2010 07:53:21 GMT

I was informed recently by MS that the licensing of DPM had changed and I was getting some information together to write a post about it when Jason Buffington posted all the details on his blog yesterday. So rather than wasting my time writing up the same information as Jason, I might as well just point you at his licensing post.

http://blogs.technet.com/b/jbuff/archive/2010/06/23/dpm-2010-licensing-info.aspx

The major change is that you no longer need to purchase a license for your DPM server. With DPM 2007 you would have purchased your DPM management licenses for the computers you want to protect and you would have also have had to purchase a separate SKU for the DPM server software. Now, you no longer need to purchase the separate SKU for the DPM server software, purchasing one or more DPM management license will grant use rights for the DPM server software.

So if DPM was already cheap enough, especially if you purchase SMS-E/D, it's just got even cheaper!

The only thing I haven't I haven't had confirmed by MS is what happens if you had purchased the DPM 2007 server SKU with software assurance, as effectively you will get nothing for having spent the extra for SA. This might be dealt with on a per customer basis but if I find out anything concrete, I will let you know.

For full details of all the changes and licensing options though, check out Jason's blog post above.

David

Source: http://www.scdpmonline.org/licensing-change-make-dpm-even-cheaper.aspx

DPM vNext – Have Your Say!

David Allen MVP — Fri, 18 Jun 2010 15:46:28 GMT

DPM 2010 was only released earlier this month but the product team are already looking at the next version. They are currently scoping what should go into the next version of the DPM and they want to know what you want!

Follow the link below and complete the survey.

http://blogs.technet.com/b/dpm/archive/2010/06/18/dpm-what-s-next-let-your-voice-be-heard.aspx

This is your chance to be heard, so take the opportunity.

David

Management Group Check-up – A Database Perspective

David Allen MVP — Thu, 17 Jun 2010 10:31:35 GMT

On June 11th 2010, Kevin Holman presented a session to the System Center Virtual Users Group where he discussed management group health from a database perspective. Following from this presentation, Kevin has posted the slide deck he used with notes on his blog and a recording of the presentation can be viewed at SystemCenterCentral. This is a great presentation and well worth watching!

Slide deck: http://blogs.technet.com/b/kevinholman/archive/2010/06/16/management-group-checkup-a-database-perspective.aspx

Presentation: http://www.systemcentercentral.com/UserGroups/tabid/120/view/groupdetail/groupid/13/Default.aspx

Thanks Kevin and thanks to the System Center Virtual Users Group for putting on the virtual event. :-)

David

System Center Service Manager 2010 is on MSDN & TechNet

David Allen MVP — Fri, 11 Jun 2010 07:30:00 GMT

Microsoft System Center Service Manager 2010 is now available on both MSDN and TechNet for download!

I recommend you download and start looking at SCSM today, it’s a great product and is going to be a key part of the System Center suite.

Log into MSDN or TechNet, select “Downloads and Product Keys” followed by “Servers” and then click System Center Service Manager to view the download.

For more information on Service Manager, visit http://www.microsoft.com/systemcenter/en/us/service-manager.aspx.

Enjoy!

David

Free Hyper-V R2 Management Pack from BridgeWays

David Allen MVP — Mon, 07 Jun 2010 07:46:07 GMT

BridgeWays have released a free management pack for Operations Manager to monitor Hyper-V R2. The default MS management pack only provides you with basic state monitoring of the Hyper-V R2 server, virtual machines and virtual networks which is nowhere near the level detail you need or would expect considering it’s a Microsoft product. The BridgeWays management pack, however, will provide you with much more as you can see in the image below. There is much more information including performance and dashboard views which is very important to effectively monitoring Hyper-V R2.

I’m not usually one to advertise 3rd party management packs but as this one is free, I thought it would be worth letting everyone know.

You can download the free MP here, http://www.bridgeways.ca/downloads.php.

David