If you name your runbooks including a info if they should be running or not it is easy to monitor this. Lets say we include “ON” in runbook names for all runbooks that should always be running. We can then use a SQL query to verify the status of these runbooks.

SELECT UniqueID, Name
FROM POLICIES
WHERE (Deleted = ’0′) AND (Name LIKE ‘%-ON-%’)
AND UniqueID NOT IN (SELECT RunbookId FROM [Microsoft.SystemCenter.Orchestrator.Runtime].Jobs WHERE Status = ‘RUNNING’)

The query will show you all runbooks with a name including -ON- which don’t have a running job (status equals 1). If all your monitor runbooks are running, then there should be no result. You can then use a rule or monitor in Operations Manager to monitor this, like I do in this blogpost and you can add this to your Orchestrator dashboard.

In the Service Manager self-service portal I have a request offering named Restore Database.

• Restore to Original Location. If this checkbox is enabled the database will be restored to original instance. In most cases I restore to a network folder. Network Folder is used in this integration pack in the same way that it is used in the Data Protection Manager user interface. Choosing Network Folder recovers to a local path on a server that have the DPM agent installed. I have configured my runbook (also included in this blog post) to always recover to C:\RESTORE on the target machine
• Target server. If I select to restore to a network folder, default, I input a server name. For example if I want to restore the Orchestrator database to my Orchestrator database server I input SCO12SP1-SQL01 in the Target Server text box. The database backup will then be restored to C:\RESTORE in the SCO12SP1-SQL01 server.
• Recovery Point to Restore. In this query based list I can select which DPM recovery point to restore. I have a runbook (also included in this blog post) that create CI of each recovery point.

Service Manager invokes the “1.2 Restore” runbook in Orchestrator. The runbook is divided into two tracks depending if restoring to a network folder or to original location. Both Data Source ID and Recovery Source ID, used to recover the SQL database, is stored on the Backup CI in Service Manager so we dont need to get them from DPM within the runbook. In general the runbook restore the database and updates the service request.

Runbook “1.1 Create Backup CIs” is the second runbook in this example. It is used to create backup CI objects in Service Manager. The backup class is a custom class that I have created with the Service Manager authoring tool. The runbook runs every hour and creates new/updates/deletes CIs of the backup class.

• Every hour.  Invokes the runbook every hour
• Get Existing Backup. Gets all objects of the backup class in Service Manager. If there are any objects the “Set Verified to FALSE” activity change the verified property of all the backup CIs to FALSE.
• Junction. Used to merge possible multiple threads to one
• Get Data Source for System Center DBs. In my DPM server I have a protection group named “System Center Databases”, this activity gets all data sources for that protection group
• Get All Recovery Point. This activity gets all recovery points for the data sources returned by the “Get Data Sources for System Center DBs” activity
• Check if Backup Exist. This activity checks in Service Manager if there is a backup CI, with Active status, for the current BackupID. BackupID is a property of the backup class that I use to give all recovery points a unique ID, the backup ID contains of <Protection Group Name>.<Production Server Name>.<Recovery Time Point in Time>.<Data source Name>
• If a backup CI object already exist the runbook change the verified property of the backup CI object to TRUE
• If no backup CI object exist a new backup CI is created and a relationship to the server is created
• Junction. Used to merge possible multiple threads to one
• Get Non Verified Backups. This activity gets all backup CIs that has not been verified (verified property equals FALSE) and deletes them with the “Delete Backup” activity

Backup CIs listed in the Service Manager Console

Backup CI

Relationship between windows server and backup CI

When the runbook is done the service request is updated with some information, which can be read from the Service Manager self-service portal. As you can see the database has been restored to C:\RESTORE on the SCO12SP1SQL-01 server. A very Quick and easy way to roll back a database.

You can download my example files here, 20130103_DPM. Note that this is provided “AS-IS” with no warranties at all. This is not a production ready management pack or solution for your production environment, just a idea and an example.

Next I have create a small runbook that generates a platform event saying which runbook server it ran on and the local time of that runbook server. I have configured the runbook with the new schedule too.

If we run the following SQL query in the Orchestrator database we can take a look at all schedules

SELECT OBJECTS.Name, SCHEDULES.DaysOfWeek, SCHEDULES.DaysOfMonth, SCHEDULES.Monday, SCHEDULES.Tuesday, SCHEDULES.Wednesday,
SCHEDULES.Thursday, SCHEDULES.Friday, SCHEDULES.Saturday, SCHEDULES.Sunday, SCHEDULES.First, SCHEDULES.Second, SCHEDULES.Third,
SCHEDULES.Fourth, SCHEDULES.Last, SCHEDULES.Days, SCHEDULES.Hours, SCHEDULES.Exceptions
FROM SCHEDULES INNER JOIN
OBJECTS ON SCHEDULES.UniqueID = OBJECTS.UniqueID
WHERE (OBJECTS.Deleted = 0)

For the “22-23 SWE” schedule we can see in the database  the Hours column looks like “000000000040000040000040000040000040000000″. Hours are configured for any day that the schedule permit or deny. The Hours field contains in 7 parts, one for each day of a week. Each part contains of six characters, where the day is divided into 8 hours pieces, so 2 characters represent 8 hours of the day.

• The week = 000000000040000040000040000040000040000000
• Sunday and Saturday = 000000 = No hours permitted
• Monday-Friday = 000040
• 00 = hours 00-08 (no hours permitted)
• 00 = hours  09-16 (no hours permitted)
• 40 = hours 17-23
• 40 is hex, equals to 01000000 binary = penultimate hour in that time frame is permitted (if it was 23-00 it would look like 10000000)

If I start my runbook 11.32 PM Swedish time it will only run on the Swedish runbook (SCO12SP1-02) server as on the runbook server in the USA local time right now is 1.32 PM.

If I change the schedule to allow only 1-2 PM it will only run on the runbook server in the US.

That means that if you build you schedule for 1-2 AM in Sweden and trigger it on a runbook server in the USA, 1-2 AM is still 1-2 AM local time, no translation between time zones. The evaluation of the schedule is done local on the runbook server. If a runbook server is not allowed to run a runbook due to the schedule the runbook server will still download the runbook and then check the schedule locally.

If a runbook is scheduled to start during an hour that is skipped, due to daylight saving, when the system clock is adjusted forward by one hour, that starting time is skipped, and the runbook starts at the next scheduled time. If a runbook is scheduled to start during an hour that occurs twice because the system clock is adjusted backwards by one hour, the runbook launches twice.

In previous posts I showed how to handle overwrites and groups in Operations Manager with self-service in Service Manager and a bit Orchestrator. In this post I want to share a idea how to handle new monitoring, for example creating new rules from the Service Manager self-service portal.

My example starts with a service request in the Service Manager portal. A engineer goes in a request a new Windows event rule in Operations Manager. The engineer fills in event ID, rule name, which Windows Log, service/system and also alert name. A service request is created and in the service request there is a runbook activity.

The runbook activity trigger a “master runbook”. The runbook first invoke a runbook that will find a suitable management pack, then invoke a runbook to create a new monitor or rule (I have only included the rule part so far), then it invokes a runbook to import the management pack into Operations Manager and finally it invokes a runbook to update the service request.

The 60.3 Find MP runbook will find and return the management pack to use. It use the service parameter from the service request to select management pack. All management packs that are in products are stored in a “production” folder. The “Check if MP exists” activity checks if there is a management pack in that folder for the selected service. If there is, it makes a copy of it to a “archive” folder and returns the file path. If there is not a management pack it will write a new management pack file and return the path of that file. The “Write new MP file” activity will write all the needed XML code to a new XML file, it includes a number of input parameters.

The 60.2 Create Rule runbook will first translate targeting between the service parameter and the target parameter needed in the management pack. In my example I only have one target there, that is Windows 2008 Computer. The runbook then finds the <Rules>,<DisplayStrings> and the <StringResources> sections of the management pack and then adds the new rule. We use “Find” to know where in the management pack, on which line, to insert the new configuration. Each “Add Rule -” activity use input parameters when writing the new rule.

The 60.5 Import MP runs a Powershell script to import the management pack into Operations Manager. The last runbook, 60.4 Update Service Request, will update the service request with some information about the new management pack.

This example shows a way to use the self-service portal in Service Manager to order a new event rule in Operations Manager. Orchestrator builds the new rule in a management pack and import it into Operations Manager. A engineer that don’t know much about Operations Manager can still “author” a new rule and import it into Operations Manager. You could include approval step in the process and you can also include a check on the Orchestrator side to make sure the management pack and the new rule is according to best practices.

You can download my example runbooks here, 60 Create OM Rule , please note that this is provided “as is” with no warranties at all. This is not a production ready management pack or solution for your production environment, just a idea and an example.

vNext of this example could include version handling in each MP, should be easy to build with a couple of counters. Also information about the service request requesting the new management pack version could be included in the management pack description, shown in the Operations Manager console.

New to ACS in the SP1 release will be Dynamic Access Control as enabled by Windows Server 2012.  Windows Server 2012 enables business data owners to easily classify and label data allowing access policies to be defined for data classes that are critical to business. Compliance management in Windows Server 2012 becomes more efficient and flexible because access and audit policies can be based not only on user and group information but a richer set of user, resource and environmental claims, and properties from Active Directory and other sources. User claims such as roles, projects, organization, resource properties such as secrecy, and device claims such as health can be used in defining access and audit policies.

Windows Server 2012 enhances the existing Windows ACL model to support Dynamic Access Control where customers can define an expression based authorization access policy that includes conditions using user and machine claims, as well as resource (for example, file) properties. The following illustration is descriptive, and not an actual representation of an expression:

• Allow Read and Write access if User.Clearance >= Resource.Secrecy and Device. Healthy
• Allow Read and Write access if User.Project any_of Resource.Project

System Center 2012 SP1 contributes to the fulfilling these scenarios by providing enterprise-wide visibility into the use of the Dynamic Access Control, leveraging Operations Manager’s Audit Collection Services to collect events from the relevant machines (file servers, domain controllers) and providing reporting to enable auditors and compliance officers to report on the use of Dynamic Access Control – for example, audit changes in policies, object access (success and failure), and “what-if” assessment of what would happen if a certain policy were applied.

The three roles you want to install for ACS are:

• ACS database, where all security event data is collected for a period of time. Make sure you have a good understanding of how much data you want to collect and what the retention time over you data will be. The ACS database can quickly grow to an enormous unhand able size.
• ACS collector, The ACS collector receives and processes events from ACS forwarders and then sends this data to the ACS database.
• ACS forwarder, is the node where you are collecting you events from an operations manager agent must be installed on the machine.

For the complete install have a look at the installation and configuration video below:

Note: No configuration to ACS handling Dynamic Access Control information is required by the customer. The only interaction with this feature is through a set of reports. No additional monitoring is required.

Regards,
Walter Eikenboom
http://systemcenterdynamics.wordpress.com

• Design and Deploy System Center
• Configure System Center Infrastructure
• Configure the Fabric
• Configure System Center Integration
• Configure and Deploy Virtual Machines and Services

I recommend everyone working with System Center 2012 and private cloud to take the training and do the exam. Microsoft Certification helps you stand out, you demonstrate your expertise to customers and employers, special these really deep certifications.

Why another three months?

• We include information on System Center 2012 Operations Manager Service Pack 1, which is currently in beta. The information in the book will be accurate as of the beta version of the service pack.
• The book is now in what is known as the “production cycle” (yes, boring information here), meaning that it is going through final edits, composition, and layout. With 24 chapters and 5 appendices, that takes a little while. Here is the current chapter list (titles could still be “tweaked”):

1. Operations Management Basics
2. What’s New
3. Looking Inside OpsMgr
4. Planning Your Operations Manager Deployment
5. Installing System Center 2012 Operations Manager
6. Migrating to System Center 2012 Operations Manager
7. Configuring and Using System Center 2012 Operations Manager
8. Installing and Configuring Agents
9. Complex Configurations
10. Security and Compliance
11. Dashboards, Trending, and Forecasting
12. Backup and Recovery
13. Administering Management Packs
14. Monitoring with System Center 2012 Operations Manager
15. Monitoring .NET Applications
16. Network Monitoring
17. Using Synthetic Transactions
18. Distributed Applications
19. Client Monitoring
20. Interoperability and Cross Platform
21. System Center Integration
22. Authoring Management Packs and Reports
23. PowerShell and Operations Manager
24. Operations Manager for the Service Provider

Appendices:

1. OpsMgr by Example
2. Performance Counters
3. Registry Settings
4. Reference URLs
5. Available Online (content from the book available for download)

Early work on this book began during the System Center 2012 release candidate cycle, realizing that much of the detail we wanted to include would not be available until the product was released. With Microsoft’s quick follow-up of Service Pack 1 to incorporate support for Windows Server 2012 and SQL Server 2012 and other updates, it made sense to incorporate that information in the book rather than having the content out of date shortly after the book was published.

We appreciate everyone’s patience and think you will find the wait worth it. Writing a book is a huge task, particularly when its projected to be about 1300 pages in length. We took into consideration comments on System Center Operations Manager 2007 Unleashed to reduce “fluff” and bring you in-depth content.

- Kerrie, Cameron, and John