I was working with a customer today to create OMS alerts utilizing the recommendations provided by the OMS AD Assessment solution. During this working session, the customer requested a list of all AD Assessment recommendations so they could choose which individual workflows they wanted to configure for alerting. After a few minutes of query design, the following query will accomplish this task.
I recently opened the OMS Log Search page to demonstrate a few queries and noticed that the page has changed quite a bit. My first thought was, where did my saved queries go? However, after a few seconds of browsing around, I was able to display all of my previously created saved queries by simply selecting the Favorites icon at the top left corner of the Log Search page. Once you select this icon, the Saved Queries window will open on the right side of the search page.
A few notes about this new Log Search page layout:
With the recent release of View Designer in OMS, we now have the capability to use the power of log search to create our own custom solutions. This capability is very powerful and allows us to create single pane of glass dashboards across data sets for any technology for which we are collecting data. Nice!
For the purpose of this demo, I will create a custom Exchange solution, but it’s important to note that this same process can be used for any application or technology.
The OMS team released a new post yesterday on the #MSOMS blog which details how to set up monitoring for VMware using OMS syslog collection and custom fields, including query examples to help get you started! The setup appears to be quite simple and allows us to add even more data to the central OMS repository for root cause analysis, trending, correlation and alerting.
Visit the #MSOMS post here for much more detail!
I was recently working with a customer where I was engaged to assist with troubleshooting several errors that were occurring in the Operations Manager event log across a SCOM Management Group. Because there were multiple errors occurring across several agents, the customer was having a difficult time tracking down which errors were occurring and which server they were occurring on. It proved very difficult to parse alerts and log into individual servers and event logs to try and identify issues, much less correlate the issues across the environment. After taking some time to understand the challenge, it seemed to me like a great opportunity to use OMS!
OMS Log Search gives us the ability to 1) identify all error events occurring in the Operations Manager event log (or almost any other log) across all servers in the environment and 2) allows us to then show all computers where each error is occurring without ever logging into a server. Very cool!
An updated OMS agent has been released which enables the ability to send data from one OMS agent to multiple workspaces. One key capability that this new agent enables, amongst others, is the ability to segregate data for security purposes or by team. For example, if I want to segregate my Security and Audit data from data that my technology specific teams will utilize (performance, SQL, etc.), I can create a separate workspace for each classification. Very useful. If you are currently utilizing SCOM, the agent will automatically be upgraded when you upgrade your environment to System Center Operations Manager 2016. More details here.
A new Read Only user type was added to OMS today which prevents users from making administrative changes in the OMS workspace. In my opinion, this was a much needed addition which will give a customers deploying OMS in production environments some added user scoping capability.
Users with the ReadOnly user type will not be able to do the following:
- Add\remove solutions (solution gallery hidden)
- Add\modify\remove ‘My Dashboards’
- Setting page is hidden
- In the Search view, PowerBI configuration, Saved Searches and Alerts tabs are hidden