SCOM: Dynamic Group MaxDepth

This blog shows a trick to retrieve the right query depth when using contains/contained expressions in group membership rules.

If you don't know how these expressions work: Raphael Burri has an excellent blog about Dynamic Group Population: http://rburri.wordpress.com/2009/01/14/dynamic-group-membership-authoring-and-performance-impact-on-rms/

Whenever you use Contains or Contained (or their compliments NotContains or NotContained), you should use the attribute MaxDepth to save I/O on the RMS.

But how do you know what the MaxDepth is???

You could find this info in the Service Model from the Management Pack Guide. But not every MP Guide is equiped with a Service Model.
To overcome this, you can use the Group membership rule wizard (Query Builder) in the Operations Console.

In this example I want to group all IIS 7.0 Application Pools which are hosted on computers with a specific Computer Description. In most cases MaxDepth 1 will do, but not in this case.

For the Computer Description attribute I created an extended class based on Windows Computer. The attribute is filled with the value of a registry key found locally on the agent.

Let's see.....

Start the Create Group Wizard and go the the Dynamic Members tab:

Click Create/Edit rules and select IIS 7.0 Application Pool class and click Add:

Select the property drop down list and go to the last entry, which shows the host class. This shows that the IIS 7.0 Application Pool Class is hosted by the IIS 7.0 Web Server class.





















In the next steps select the parent classes until you reach the host class Windows Computer. For every host step, maxDepth is incremented.






So now you know that you'll have to use maxDepth="3" in Contains/Contained expressions on the Windows Computer class (or in my case a class which derives from this class).
The membership rule would look like this:

  $MPElement[Name="Windows1!Microsoft.Windows.InternetInformationServices.2008.ApplicationPool"]$
  $MPElement[Name="MicrosoftSystemCenterInstanceGroupLibrary6172210!Microsoft.SystemCenter.InstanceGroupContainsEntities"]$
  
 
   $MPElement[Name="MyExtLib!MyExtLib.Windows.Computer.Extended"]$
   
  
    
   $MPElement[Name="MyExtLib!MyExtLib.Windows.Computer.Extended"]/Description$
    
    ContainsSubstring
    Web Server LOB1
  
   
 
  

Of course you can create groups based on the host properties, but sadly this doesn't work on derived classes.
If you do can work with the host properties, the membership rule can look like this:

  $MPElement[Name="Windows1!Microsoft.Windows.InternetInformationServices.2008.ApplicationPool"]$
  $MPElement[Name="MicrosoftSystemCenterInstanceGroupLibrary6172210!Microsoft.SystemCenter.InstanceGroupContainsEntities"]$
  
 
   
  
    $MPElement[Name="MicrosoftWindowsLibrary6172210!Microsoft.Windows.Computer"]$
    $MPElement[Name="MicrosoftWindowsLibrary6172210!Microsoft.Windows.Computer"]/OrganizationalUnit$
  
   
   ContainsSubstring
   Web Servers
 
  

SCOM: Get Nested Group Members (Powershell)

When you create nested groups in SCOM you have to use workarounds to view the actual group members of a specific type, e.g. Windows Computer. Using 'View Members' only returns the nested groups and not the contained objects.

One of the ways to view the actual members of a group, is to create a 'State View'.
As a "filter" you then change the class type to show the data related to the type you want to see and then you select the group for scoping the returned data.

So in short terms, to view the nested group members
- Create a state view
- Change "Show data related to" to a class like 'Windows Computer'
- Change "Show data contained in a specific group" to the group of which you want the members.

But, there's quicker way to achieve this. Using Powershell you can retrieve the members of a nested group in a couple of seconds. I found out about 'Recursive' using the SCOM SDK.

$group = Get-MonitoringObject | Where { $_.DisplayName -eq "YourGroupName"}
$MonitoringClass = Get-MonitoringClass -Name "Microsoft.Windows.Computer"
$group.GetRelatedMonitoringObjects($MonitoringClass,"Recursive") | Select DisplayName

SCOM: Get-UserRole Group Scope (PowerShell)

Recently I wanted to document all the User Roles from a specific Management Group with their Group Scope and Views. Because their is no UI to see this quickly, besides scrolling through a list of disabled and enabled groups, I created this script.

SCOM PowerShell script for listing a User Role with it's Group Scope.
It returns all non-system* User Roles with a (sorted) list of groups from the Group Scope.
Stay tuned because i'm working on the 'Views' part.

Get-UserRole | Sort-Object DisplayName | foreach {If($_.IsSystem -ne $true){Write-Host "--" $_.DisplayName "--";If($_.Scope.MonitoringClasses -ne $null){$_.Scope.MonitoringClasses | foreach {Get-MonitoringClass -Id $_} | Sort-Object DisplayName | foreach {Write-Host "  "$_.displayName}}else{$_.Scope.MonitoringObjects | foreach {Get-MonitoringObject -Id $_} | Sort-Object DisplayName | foreach {Write-Host "  "$_.displayName}}}}

For better readability:

Get-UserRole | Sort-Object DisplayName | foreach { 
  If($_.IsSystem -ne $true)
  {
    Write-Host "--" $_.DisplayName "--"
    If($_.Scope.MonitoringClasses -ne $null){
      $_.Scope.MonitoringClasses | foreach {Get-MonitoringClass -Id $_} | Sort-Object DisplayName | foreach {Write-Host "  "$_.displayName}
    } else {
      $_.Scope.MonitoringObjects | foreach {Get-MonitoringObject -Id $_} | Sort-Object DisplayName | foreach {Write-Host "  "$_.displayName}
    }
  }
}

For SCOM 2012

#SCOM 2012
Get-SCOMUserRole | Sort-Object DisplayName | foreach { 
  If($_.IsSystem -ne $true)
  {
    Write-Host "--" $_.DisplayName "--"
    If($_.Scope.Objects -ne $null){
      $_.Scope.Objects | foreach {Get-SCOMClass -Id $_} | Sort-Object DisplayName | foreach {Write-Host "  "$_.displayName}
    }
    If ($_.Scope.Classes -ne $null) {
      $_.Scope.Classes | foreach {Get-SCOMClass -Id $_ -Id $_} | Sort-Object DisplayName | foreach {Write-Host "  "$_.displayName}
    }
  }
}

* = These roles are specified as System Roles:
Operations Manager Administrators
Operations Manager Advanced Operators
Operations Manager Authors
Operations Manager Operators
Operations Manager Read-Only Operators
Operations Manager Report Security Administrators

For exporting and importing complete user roles, see http://blogs.msdn.com/b/rslaten/archive/2008/11/03/exporting-and-importing-user-roles.aspx

SCOM: Creating and Using Dynamic Groups

Today i stubled upon a, somewhat older, but rather interesting blog post of Raphael Burri. He wrote an extensive article about creating dynamic groups in Operations Manager and what the impact is on the Root Management Server (RMS).

Raphael created some pdf's with examples of how you can create more advanced membership rules for dynamic groups.

When you use the Operations Manager Console for creating groups you may find that you're pretty limited in using more complex constuctions, like using contains/not contains expression in the membership element clauses.

Instance and Computer Groups

When you look closer to the XML code that is created when exporting a MP with a 'OC'-created Group in it, you will notice that those groups are always instanced from the InstanceGroup class.

Taking a peek at all your groups in the OC, shows Computer Groups besides the Instance Groups. What's the difference? The icon :P and the relationship type. A Computer Groups only contains computer whereas an Instance Group can contain all types of objects.
Micrsoft uses both Group type in various management packs, like the IIS and Exchange 2007 MP.

Asking around gives me the impression almost everybody is just using Instance Groups. But DO know that other group types (classes) are available.

Link to Raphael Burri's post: http://rburri.wordpress.com/2009/01/14/dynamic-group-membership-authoring-and-performance-impact-on-rms/