Posts

Showing posts from 2018

IIS 2016 MP version 10.0.9.0 busted

Version 10.0.9.0 of the IIS MP for Windows Server 2016 doesn't discover the IIS role properly. I was troubleshooting this on a lab server and was running out of ideas when I found they released 10.0.9.1 literally a day later. As soon as I imported the new MP it worked.

Build a lab CA to generate certificates for SCOM agents

I had to test adding a gateway to SCOM that was in a workgroup. I installed a CA on my DC so I could generate certs to install on the mgmt server and gateway. I used these articles to do it. To make the DC an enterprise root CA follow this: https://gallery.technet.microsoft.com/Installing-the-Root-CA-db1c6200 You'll get an error when you hit the certsrv website coz you need to add a cert to the IIS website first. This article helped with that: https://social.technet.microsoft.com/wiki/contents/articles/12039.active-directory-certificate-services-ad-cs-error-in-order-to-complete-certificate-enrollment-the-web-site-for-the-ca-must-be-configured-to-use-https-authentication.aspx You should see event id 20053 (source= OpsMgr Connector) in Ops log to say "The OpsMgr Connector has loaded the specified authentication certificate successfully."

Weird "clr enabled" error launching SCOM 2016 console

Image
Launching the SCOM 2016 console you might get this: This event will be logged on the server you're connecting to: Log name: Operations Manager Source: DataAccessLayer Event ID: 33333 Level: Warning Message: Data Access Layer rejected retry on SqlError: Request: ManagedTypeByCriteria -- (LanguageCode1=ENA), (LanguageCode2=ENU), (Id0=16781f33-f72d-033c-1df4-65a2aff32ca3) Class: 16 Number: 6263 Message: Execution of user code in the .NET Framework is disabled. Enable "clr enabled" configuration option. To fix this, first run this query against the SQL instance for SCOM. The number 1 should be in the value column: SELECT * FROM sys.configurations WHERE name = 'clr enabled' If it isn't, run this: sp_configure @configname=clr_enabled, @configvalue=1 GO RECONFIGURE GO Update 24/01/2023 - I need to confirm the sp_configure query as it's always been a DBA that runs it.

SQL instance and port syntax during install

During the SCOM install you get to 2 screens asking for the Ops db and DW location. There's a certain syntax to use depending on the SQL instance. SQL type: Standalone with standard port (1433) Change DatabaseServerName to computer\<instance> followed by a comma, and then the SQL Server port number ie. computer\instance,portNumber SQL type: Cluster Replace computer with the virtual network name of the cluster. SQL type: AlwaysOn Availability Group Replace computer\instance with the availability group listener name ie.  AvalabilityGroupListnerName,portNumber

Perf counter alert shows sample count instead of sampled value

I made a unit monitor to alert when the  Hyper-V Hypervisor Logical Processor \ % Total Run Time  counter exceeded a certain threshold. I used the  System.Performance.ConsecutiveSamplesThreshold unit monitor type and noticed that when it alerted the alert parameter for  $Data[Default='']/Context/Value$ was showing the number of samples instead of the threshold value that was sampled. Oddly, the  $Data[Default='']/Context/Value$ value in System.Performance.ThresholdMonitorType works correctly. Alert description example: Hyper-V server %hostname% is using too much CPU. Counter: Hyper-V Hypervisor Logical Processor \ % Total Run Time Value: 2 << this is the sample number, not the sampled value. To fix this use $Data[Default='']/Context/ SampleValue $ instead. Refer to this article for more: http://www.systemcentercentral.com/system-performance-consecutivesamplesthreshold-monitor-gives-a-wrong-alert-description/

VScript

XML Query XML file Link Link Set xmlDoc = CreateObject("Microsoft.XMLDOM") xmlDoc.Async = "False" xmlDoc.Load("C:\temp\OpsMgrConnector.Config.xml") Set colNodes = xmlDoc.selectNodes ("/Message/State/Parents/Added/Item/(AuthenticationName | IsPrimary)") For Each objNode in colNodes    Wscript.Echo objNode.Text Next

Event IDs

ID: 1102 Log: Operations Manager Source: HealthService Description: Rule/Monitor "Microsoft.SystemCenter.DataWarehouse.Deployment.Report" running for instance "Data Warehouse Synchronization Service" with id:"{EA0B5D81-9F4F-9C47-8286-0B6549506B22}" cannot be initialized and will not be loaded. Management group "C03MWSSCOM" I got this when the scom reader account wasn't allowed to log on to the mgmt servers. They'd done this in 2 ways; firstly they denied "Allow log on locally" in group policy to the reader account, secondly, in AD they locked down which computers the reader account could log in to. When both these issues were resolved you'll start seeing 31568, 31570 (Type=Information, Source=Health Service Modules) and the reports starting being populated in the Reporting pane in the console.

How to monitor SQL without Run As accounts

The original article explaining this is here: https://blogs.technet.microsoft.com/kevinholman/2016/08/25/sql-mp-run-as-accounts-no-longer-required-2/ Environment: My SCOM 2012 R2 lab. I had already installed SQL MP version 7.0.2.0 which covers SQL 2005 - 2012 [need to confirm versions] Steps in order: The only instance I had to test with was my SCOM one running SQL 2014 so I had to install version 7.0.2.0 of the 2014 mp. I installed these MPs (the others were already installed or weren't needed) Microsoft.SQLServer.2014.Discovery Microsoft.SQLServer.2014.Monitoring Microsoft.SQLServer.2014.Presentation Microsoft.SQLServer.2014.Views I didn't have to bounce the HealthService and the SQL instance appeared straight away in SCOM. It seemed to be monitored OK too. I'm guessing it's because it's the SQL instance for SCOM therefore has more access? I would think on a normal SQL server this wouldn't happen. I got this alert: SQL Server cannot authenticate using Kerberos

Exchange mp install experience

Some notes on what I had to install the Exchange mp for Exchange Server 2016 CU8 in a SCOM 2016 UR4 mgmt group. You can use the Exchange 2013 mp (I used 15.0.668.20) to monitor Exchange 2016. Microsoft didn't make one specifically for 2016. Read more here: https://blogs.technet.microsoft.com/exchange/2016/06/13/monitoring-exchange-server-2016-with-system-center-operations-manager/ In brief follow these steps: Import the Windows server mp first (MS best practice) Install SCOM agent on all Exchange servers (duh) Enable proxy on all of them. I didn't have access to the Exchange servers and they weren't being discovered so I ran the Reload Configuration  task against the agents and they popped up 5 minutes later. Create AD user account called  Exchange2013SDKUser  and make it a domain user only. (I don't know if you need to do this but the mp guide & forums say you do it as it's used for some synthetic transactions) Add the  Exchange2013SDKUser  user account to loca

Where did my view go?

I made a custom mp to do some basic service monitoring. I sealed it, installed it and it worked beautifully. Then I thought it'd be a good idea to make a "Views" mp so I could easily see discovered objects & alerts etc so I made a group and stored it in the Views mp. The group dynamically added custom classes that were from the initial sealed monitoring mp. My Views mp was unsealed so that I could setup the Dashboard just how I wanted. All was going well and it displayed discovered objects and alerts as I expected. Thinking all was good I sealed the mp and deleted the unsealed one then imported the sealed one and surprise surprise, one of the panes in the dashboard was blank (the other two were fine). These 3 panes in the dashboard target 1 single group that contained three different classes and it was stored in my sealed monitoring mp. I tried recreating the views mp, upping the version etc but every time I imported the final mp I got the same result. Knowing how muc

MPSeal fails with mp bundles

While trying to seal a 'views' only mp, MPSeal kept on failing. The command I was running was: MPSeal.exe AirWatch.Views.xml /I C:\Build\MPseal\RefMP /Keyfile C:\Build\MPseal\PairKey.snk /Company "blah company name" Errors returned: : Verification failed with 2 errors: ------------------------------------------------------- Error 1: Found error in 2|AirWatch.Views|1.0.0.0|AirWatch.Views|| with message: Could not load management pack [ID=Microsoft.SystemCenter.Library, KeyToken=31bf3856ad364e35, Version=7.0.8433.1]. The management pack was not found in the store. Microsoft.EnterpriseManagement.Common.ObjectNotFoundException: An object of class ManagementPack with name Microsoft.SystemCenter.Library was not found.    at Microsoft.EnterpriseManagement.AggregateStoreManagementPackManagement.GetManagementPack(String name, String keytoken, Version version)    at Microsoft.EnterpriseManagement.Configuration.ManagementPackReference.GetManagementPack() ------------------------

Agent patch install fails

I had a strange issue on a Windows 2012 R2 server where the agent installed fine but when I went to apply the KB3183990-amd64-Agent.msp patch it bombed out with this error: Product: Microsoft Monitoring Agent -- Error 25211.Failed to install performance counters.. Error Code: -2147024809 (The parameter is incorrect.) I installed the agent from the command line with this: msiexec.exe /i MOMAgent.msi /qb /l* %temp%\MOMAgentinstall.log USE_SETTINGS_FROM_AD=0 MANAGEMENT_GROUP=blah-name MANAGEMENT_SERVER_DNS=blah-server ENABLE_ERROR_REPORTING=0 ACTIONS_USE_COMPUTER_ACCOUNT=1 USE_MANUALLY_SPECIFIED_SETTINGS=1 NOAPM=1 AcceptEndUserLicenseAgreement=1 The problem is when you specify NOAPM=1 some performance counters will be missing. To fix just run this: msiexec /p KB3183990-amd64-Agent.msp NOAPM=1