I was helping an administrator troubleshoot SCOM WMI alerts for a server the other day utilizing the wbemtest tool and was a bit surprised that he had never heard of the utility. I personally use this tool quite often to test WMI connectivity, namespaces, queries, etc. for both SCOM and SCCM issues and find it quite useful, so I decided to do a quick post in case anyone else is not familiar with the tool.
There have been more than a few times when I have been working to tune “noisy” alerts where I have run into custom console created script based monitors as the main culprits. This is not surprising, as the console script based monitor template does not offer the consecutive threshold functionality. With this being the case, we end up with scenarios where a script based monitor for the monitored KPI is alerting based on one sample, which is not ideal and can be VERY noisy. So…I decided to create my own.
Let’s use a physical memory monitor as the example for this post as it seems to be a fairy regular requirement. In most cases I have seen, a script based monitor is configured using a simple WMI based VB or PowerShell script that collects a data sample and alerts if the value is greater than x threshold. In other cases the consecutive sample logic is in the script itself, but this can get a bit complicated. I prefer to have the consecutive sample logic in the management pack code. Let’s move on!
I recently received a request for a daily report to show “Login Failed:” alerts for SQL servers in the environment. I thought…no problem, we have an “Alerts” report out of box that should meet this requirement quite nicely. Unfortunately, it does not. The report is very handy for most circumstances, but it does not provide the functionality to specify specific alerts for a server/group. There are some other ways to do this (Advanced Alert Search, query, view, etc.), but in this case the customer wanted a scheduled daily report, so it’s time for some report development!
There have been many scenarios where a customer has asked what query is being used in a report, dashboard, view, etc. in the SCOM console. This information can be useful for many reasons, but in particular, I find that I often utilize it for reverse engineering reports and queries and for troubleshooting. There is a fairly simple way to obtain this information using SQL Server Profiler traces…
Sometimes the simplest solutions are the most effective. I was on site a few months ago and was asked by a fellow engineer whether I knew of an easy way to test SCOM console permissions without having to log into the local computer as each user. Sounds like an opportunity to script something up to me!
I recently worked on a customer request for a daily SCOM System Uptime report for all servers in their environment. The customer had been using a 3rd party MP, but although the functionality worked they were unable to get accurate data and the System Uptime performance counter did not provide them with data in the format they were looking for.
SO…off to SQL Management Studio!
After playing around with some queries, I came up with a pretty cool query and created a report that met the customers requirement successfully. The customer currently has the report scheduled daily as a CSV file, which works great for their needs.
For the purpose of this post, let’s take a look at the SQL query…
1. Overrides from sealed MPs create dependencies/references in the unsealed MP:
For example, I have created a new unsealed management pack named TEST which contains overrides from the SQL Server 2012 MP. Configuring these overrides creates a reference in the TEST MP for the SQL Server 2012 MP. To test, I navigate to the “Administration” view and find the SQL Server 2012 MP in the “Management Packs” section and attempt to delete it, resulting in the error below: