Searching for Management Pack authoring

Today I came accross a blog post of Brian Wren from Microsoft.
They're working on a better search solution for finding information focussed on System Center technologies.

Now information and examples are scattered around the internet on forums, blogs, technet, community sites and you name it.

The solution Microsoft is working on is called 'System Center Cloud Search'. It's using the Bing search engine with selected data sources to search in.

For now, the beta is focussed on Management Pack Authoring.

See the whole story here: http://blogs.technet.com/b/mpauthor/archive/2011/04/15/cloud-search-for-management-pack-authoring.aspx

Give it a shot to see if this works for you and help making it better!

SCOM: CU4 and Microsoft.SystemCenter.Library.mp 6.1.7221.61

This blog post is for those who updated SCOM with CU4 and have issues with the Authoring Console and Microsoft.SystemCenter.Library.mp version 6.1.7221.61.
-----------------------------
** Update: 08/09/2011 **
Microsoft published a KB-article which resolves this problem:
http://support.microsoft.com/kb/2590414
-----------------------------

After applying CU4, Microsoft.SystemCenter.Library management pack is updated.
When using the Authoring Console on MP's created in a CU4 Management Group, you are prompted for Microsoft.SystemCenter.Library.mp 6.1.7221.61.

But, the MP file is not available from the CU4 installation sources.

The management pack is updated trough the sql batch on the OperationsManager database, CU4_Database.sql.

DECLARE @ver nvarchar(25)

DECLARE @compare int

SET @ver = (SELECT Mpversion FROM ManagementPack WHERE MPName = 'Microsoft.SystemCenter.Library')

-- Update Microsoft.SystemCenter.Libarary MP directly via SQL

A thread about this is going on at the Microsoft forums: http://social.technet.microsoft.com/Forums/en-US/operationsmanagermgmtpacks/thread/45d6bac1-4b10-4f36-86de-2efea895fc94

There is an easy workaround mentioned on the forum by dbabob56:
After exporting you can change the version number.

FROM

      

        Microsoft.SystemCenter.Library

        6.1.7221.61

        31bf3856ad364e35

      

TO

      

        Microsoft.SystemCenter.Library

        6.1.7221.0

        31bf3856ad364e35

      

SCOM: Account specified in the Run As Profile cannot be resolved - Troubleshooting using SSID

Update for SCOM 2012: SCOM 2012 does have a cmdlet for getting RunAs profiles: Get-SCOMRunAsProfile. As one of the commenters below added, if you want to get the SSID's in SCOM 2012, then use the cmdlet 'Get-SCOMRunAsAccount'.

Get-SCOMRunAsAccount | Sort Name | % {$string = $null;$_.SecureStorageId | % { 
 $string = $string + "{0:X2}" -f $_}
 $_.Name;" $string"
}

Written for SCOM 2007...
Update:

#Don't forget to add the OM2007 snapin
add-PsSnapIn "Microsoft.EnterpriseManagement.OperationsManager.Client" 
New-ManagementGroupConnection -ConnectionString:"scommssrv"
set-location "OperationsManagerMonitoring::" 

Some management packs require configuration of Run As Profiles.
This means that you configure associations between classes/objects and Run As Accounts. Whenever a workflow from a management pack is instructed to use a Run As Profile it will only work when the targeted class or object of the workflow is associated with an account. And last but not least, the Run As Account should be distributed to the servers on which that class exists.

This blogs shows you some tips on how to troubleshoot alerts associated with these kind of things.

When you misconfigure the Run As Profile, the following alert can popup in your console:
Account specified in the Run As Profile ">RunasAccountProfile<" cannot be resolved.

With some extra info:

Management Group: ###
Run As Profile: Company.Product.Role.Application.ActionAccountProfile
Account SSID: 0025F224C5251A6F4EEE112ACD9F0EB07D9178AFB500000000000000000000000000000000000000

This alert tells you that you associated the runas account, but the agent that tries to use the account, did not actually receive the account credentials.
So either you add the server to the distribution list, or you reconfigure the runas profile associations with beter classes/objects.

But he! I can't find the specified Run As Profile 'Company.Product.Role.Application.ActionAccountProfile'. That's right. That's the Name property shown in the description. If you want to find the Run As Profile as it's showed in the Operations Console, you will need the DisplayName. For that we could use the Operations Manager Shell:

Get-RunAsProfile ... oh, that cmdlet does not exist :(

What more does the alert message say? This is interesting:
Note: you may use the command shell to get the Run As Account display name by its SSID"

We could use the SSID from the alert message. The Ops Mgr Shell does have a cmdlet for showing the Run As Accounts.
The only problem we have here, is that the SSID mentioned in the alert description is a string type value. Cmdlet Get-RunAsAccount shows us that the SSID is stored as a byte array in the property SecureStorageId. So we can't compare these types.

For that i've created this script. It gets all Run As Account, formats the byte array SecureStorageId property to a readable string, and show the Run As Account DisplayName with it's SSID.

Get-RunAsAccount | Sort Name | % {$string = $null;$_.SecureStorageId | % { 
 $string = $string + "{0:X2}" -f $_}
 $_.Name;"  $string"
}

PowerShell does not have built-in functions for formatting numbers, therefore you can use the .Net formatting methods.

With this in mind you could add a string comparison to only show a match when the Alert Message SSID correspands with the SecureStorageId string ($string).
If you need help with that, leave a message.

SCOM: Find Notification Subscriptions for Subscriber

What to do when you want to delete a subscriber in SCOM, but you can't because get an error like this:

The notification recipient is subscribed to at least one notification subscription.
Please remove it from all notification subscriptions before deleting it.
.....cannot be deleted as its currently in use.

To solve this you would have to browse manually through all your notification subscriptions. But how much time would that take.
With this PowerShell script it takes 2 seconds!

Get-NotificationSubscription | foreach {
 $ns = $_.DisplayName
 $_.ToRecipients | foreach { 
  If ($_.Name -match "John") {
   Write-Host $ns
  }
 }
}

SCOM: Find Specific Members in User Roles (PowerShell)

Last week I was doing some User Role testing with a test account of mine. Normally I always use Active Directory groups for adding and removing members of a user role.
But for quick testing with some views I added my test account directly to several user roles.

I wanted to know in which user roles my test account was added.
Beneath is a PowerShell script to find members of a user role which name contains the given search criteria. The name is usually a (AD) User Account or Group, like Admin1234@domain.local or DOMAIN\Admin123.

#Find member of userrole which contains a specific text
#The search criteria is case-sensitive

$searchtext = "Admin"
Get-Userrole | Sort DisplayName | % { $userrole = $_.DisplayName;$_.Users | % { If($_.Contains("$searchtext")){ Write-Host -foregroundcolor yellow $userrole;Write-Host "  $_"} }}

SCOM: Get Nested Group Members (Powershell)

When you create nested groups in SCOM you have to use workarounds to view the actual group members of a specific type, e.g. Windows Computer. Using 'View Members' only returns the nested groups and not the contained objects.

One of the ways to view the actual members of a group, is to create a 'State View'.
As a "filter" you then change the class type to show the data related to the type you want to see and then you select the group for scoping the returned data.

So in short terms, to view the nested group members
- Create a state view
- Change "Show data related to" to a class like 'Windows Computer'
- Change "Show data contained in a specific group" to the group of which you want the members.

But, there's quicker way to achieve this. Using Powershell you can retrieve the members of a nested group in a couple of seconds. I found out about 'Recursive' using the SCOM SDK.

$group = Get-MonitoringObject | Where { $_.DisplayName -eq "YourGroupName"}
$MonitoringClass = Get-MonitoringClass -Name "Microsoft.Windows.Computer"
$group.GetRelatedMonitoringObjects($MonitoringClass,"Recursive") | Select DisplayName

SCOM 2007 R2 Core MP Update & Guide Inconsistency

Last week Microsoft published a new version of the Core MP for SCOM 2007 R2, version 6.1.7695.0, see Kevin Holman's blog.

The MP Guide showed 3 new rules that where added with this version as a substitution for two monitors which you could enable and disable, respectively.

However after loading the MP in my test environment, it showed that the new rules are already enabled and the substituted monitors disabled.









Quote:

Manual Reset MonitorsThe Operations Manager Management Pack contains two monitors that require manual reset of health state, which are listed below. In version 6.1.7695.0 of the management pack, rules have been included that you can ??? enable in place of those monitors. The rules generate alerts for the same conditions as the monitors.

You can disable Alert Subscription Configuration Monitor and in its place, enable the following
rules:

• Alert Subscription Configuration Critical Notification Rule, which generates a critical alert on the same critical conditions as the monitor.
• Alert Subscription Configuration Warning Notification Rule, which generates a warning alert on the same warning conditions as the monitor.

You can disable the Alert Subscription Available monitor, and in its place, enable Alert Subscription Availability Critical Notification Rule, which generates a critical alert on the
same critical conditions as the monitor.

Just wanted to let you know.

SCOM: Deliver Reports to Sharepoint

Today I focussed on delivering SCOM reports to a Sharepoint document library with the File Share and e-mail delivery methods.

Most teams and departments have used file shares and network mappings to store their documents. These days more and more companies are using portal products for that purpose, like Microsoft Sharepoint.

In this blog I'll show you how you can deliver a report to a Sharepoint 2007 library. Although this is not difficult to setup, there are some things you need to know to get it working. In this setup SQL SRS 2005 and Sharepoint 2007 are used.

Note: SQL Reporting Services 2008 supports publishing reports directly in Sharepoint libraries, but SCOM 2007 does not support that. Atleast as far as I know. :)

Operations Manager supports two kinds of delivery, file and e-mail.
Both flavours can work, but it fully depends on how your Sharepoint implementation is setup.
There's a third but that's the Null Delivery Provider to cache reports.


E-mail delivery
For Operations Manager Reporting to deliver e-mail to a library the following has to be in place and configured.

Configure SQL Reporting Services

• Use the Reporting Services Configuration Manager
• Make sure the the Windows Service identity is configured with a domain user account and not with a local account (Data Warehouse Reader account).
• Configure the E-mail Setttings
• Make sure your SMTP server allows you to send e-mail

Configure you Sharepoint document library

• Make sure you have administrative rights on the document library
• Configure incoming e-mail settings on the library in which you want to deliver your reports
• Unfortunately you cannot change the name of the file SQL Reporting Services sends along with the e-mail message.
• As i want to archive all reports, I don't want them to be overwritten. In this case Sharepoint will create unique numbers as a postfix in the file name.
• If you don't want everyone to be able to send documents in to your library restrict access to specific users. In this case configure the SCOM Reporting Windows Service account to be allowed to send e-mail (Data Warehouse Reader account).
• Group items on the e-mail subject. This is the only configurable item when you schedule a SCOM report.

Schedule your reports

• Choose a naming convention for delivering your reports.
• Use that in naming your e-mail subjects, so they are neatly grouped in your Sharepoint library.
• Choose the right document format, e.g. PDF.

And the deliver!

Windows File Share (Sharepoint Library UNC path)

The other option is deliver the reports in to a file share. This is rather easy to setup when you're using ordinary File Shares, but as I sead earlier, more and more companies are using centralised documentation solutions like Sharepoint.
What I like about this delivery method is the possibility to give your reports a more understandable name. And more, SQL Reporting Services auto increments the new files which is more readable than the generated unique numbers when using incoming email on the Sharepoint library.

What you need:

• A domain account for authentication on the Sharepoint library. You could use "RDA" in the account name, as for Report Delivery Account.
• Configure the account to have enought privileges to add new items to that library
• Write down the Network UNC path of that library

Configure your Report Server

• On Windows Server 2003: Make sure the Web Client service is running and is started automatically. You need this to connect to a Sharepoint library with UNC.
• On Windows Server 2008: There's no Web Client in Windows Server 2008. For the UNC path to work you need to install a feature called, Desktop Experience. You can add this feature with the Server Manager > Features > Add Feature > Desktop Experience. Notice that you'll need to reboot the Reporting Server after the installation.
• Test the UNC path of the library from your Report Server

Schedule your report

• Select the File Delivery Method
• Choose a naming convention for delivering your reports.
• Use that in naming your report files (remember that file names of new items are autoincremented)
• Fill-in the UNC path of the library that you wrote down earlier
• Use the domain account with the necessary privileges (a.k.a. Report Delivery Account)

And then you can deliver your report.