Posts

Showing posts from 2022

Recording songs for playback

To record songs on your phone, just play the song thru the WonderBoom and record it with default recording app on your phone. Then you can slow it down with  Music Speed Changer  app.

Folder not visible in sealed mp

Another doozy. If you make a views  mp in SCOM and create a folder with nothing in it then seal it, you won't see it in the console. If you create an alert view or state view under it will work. Bizarrely, this doesn't happen to unsealed mps.

Set agent or gateway failover servers

This will setup an agent or gateway server to use a specified primary management server and failover server. Agent $Agent = Get-SCOMagent -Name "FQDN" $PrimaryServer = Get-SCOMManagementServer -Name "FQDN" $FailoverServer = Get-SCOMManagementServer -Name "FQDN" Set-SCOMParentManagementServer -Agent $Agent -PrimaryServer $PrimaryServer Set-SCOMParentManagementServer -Agent $Agent -FailoverServer $FailoverServer Gateway $GatewayServer = Get-SCOMGatewayManagementServer -Name "FQDN" $PrimaryServer = Get-SCOMManagementServer -Name "FQDN" $FailoverServer = Get-SCOMManagementServer -Name "FQDN" Set-SCOMParentManagementServer -GatewayServer $GatewayServer -PrimaryServer $PrimaryServer Set-SCOMParentManagementServer -GatewayServer $GatewayServer -FailoverServer $FailoverServer Add below line if you get this error: "The failover server xxx cannot be the same as the primary server." Set-SCOMParentManagementServer -Agent | $Gate

How to find the cluster that an AG database sits on

This explains how to find the name of the cluster that a SQL AG db sits on. This is always confusing because you need to sift through virtual names in Windows and SQL so I'm noting down for future reference: Go to Microsoft SQL Server > SQL Server Database Engines > Always On High Availability > Database Replicas Search for the db. You will get duplicates because that's how AG dbs work, there's multiple copies!  Select any db. Down below copy the Availability Group Name value. Note you can also get the SQL instance name from the Primary Replica field Go up to  Availability Groups and search for the AG name Select the AG name. Down below, copy the Cluster Name  value Go to Microsoft Windows Cluster > Cluster Service State and search for the cluster name Done. This is the cluster the AG db sits on. You can also can see the cluster nodes.

Management pack variables

I was having a problem importing a custom mp because the PowerShell discovery script I'd written had the reserved mp variable $Data in it. For background, the script queried a SQL table and the results populated a SCOM group. This was the error during import: Error 1: Found error in 1|TestA.SQL.Monitoring|1.0.0.0|SQL.Discovery.AgPrimaryDb/DS|| with message: The configuration specified for Module DS is not valid. : Incorrect expression specified: $Data baseReplica] ad on ar.MachineName_EA844CA4_B2CD_69E3_D8A9_C2E4489C53C7 = ad.MachineName_EA844CA4_B2CD_69E3_D8A9_C2E4489C53C7 AND ar.AvailabilityGroupName_2B65F5C7_DE13_BC25_C1EB_AA53047BB141=ad.AvailabilityGroupName_BE1A08AB_595A_3684_51F5_BDA703BC96C9 where ar.Role_52418D34_8CEA_2508_880C_DE9B8EE7DAB2 = 'Primary'" <# FOR TESTING #. Unable to resolve this expression. Check the expression for errors. (Hints: Check for correct character casing (upper case/lower case), mismatched "$" signs, double quotes(&

VSCode

Image
Shortcuts Task Shortcut Command palette Ctrl + Shift + P Word wrap Alt + Z Copy line Shift + Alt + Up Arrow / Down Arrow Delete line Ctrl + Shift + K Show/hide sidebar Ctrl + B Bookmark: jump next Ctrl + Alt + L Bookmark: toggle on/off Ctrl + Alt + K Extensions I use these extensions:

Monitoring last backup on SQL availability group database

Image
Problem I wanted to monitor database backup age on SQL Availability Group (AG) databases, but only on the primary replica, not secondary replicas as they weren't being backed up. Here's a summary of my experience for future reference. I  think  I got there in the end - still testing - but this was harder than I thought it would be. First, here's the monitor that does the job, we don't need to build one! Name: Microsoft.SQLServer.Windows.Monitor.AvailabilityDatabaseHealth.BackupStatus MP: Microsoft.SQLServer.Windows.Monitoring It's disabled by default and doesn't generate an alert (which will cause us headaches later). There's also an interesting override called Track 'Availability Group Backup Preferences' that looks like it might do what you want. I tested it and it still generated duplicate alerts. Solution Write a PowerShell discovery that runs a SQL query to return all dbs hosted by the primary replica and add them to a group then enable the moni

Monitoring CPU on workstations

This article explains how to monitor CPU usage on Windows 10 computers and generate an alert and process dump when it exceeds 80%. First, I had to import these MPs: Name Version Sealed Microsoft.Windows.Client.Win10 10.0.0.2 True Microsoft.Windows.Client.Win10.Aggregate 10.0.0.2 True Microsoft.Windows.Client.Win10.BusinessCritical 10.0.0.2 False Microsoft.Windows.Client.Win10.Monitoring 10.0.0.2 True I didn't have a lot of time to test this but in a nutshell some things don't work out-of-the-box as you'd expect. There's a thing called Business Critical client monitoring  that involves adding computers to a group. I tried that and got weird results and because of time, I just ended up enabling the  Microsoft.Windows.Client.Win10.Processor.CPUUt

Scratch

Function Write-Log {     Param ($ScriptState)     Switch ($ScriptState) {         "Information" {             $EventId = 17623             $EventLevel = 0 # 0=Info, 1=Error, 2=Warning         }         "Warning" {             $EventId = 17624             $EventLevel = 2 # 0=Info, 1=Error, 2=Warning         }         "Error" {             $EventId = 17625             $EventLevel = 1 # 0=Info, 1=Error, 2=Warning         }     }     $End = Get-Date     $TimeCount = (New-TimeSpan -Start $StartTime -End $End)     $MomApi.LogScriptEvent( "$ScriptName executed in $( $TimeCount.Minutes ) `m $( $TimeCount.Seconds ) `s $( $TimeCount.Milliseconds ) `ms" , $EventId, $EventLevel, "`nRunning as: $Account`nWorkflow Name: $WorkflowName`nManagement Pack: $( $MPName ) $( "($MpVersion)" ) `nPowerShell Version: $PSVersion`nScript output: $Message" ) } Function Set-TerminatingError {     $ScriptState = "Error"     $Message += &

Lepinja

Makes 1 loaf. Takes 1 day. Ingredients The recipe usually has sugar but we think it's too sweet so don't add it. 250gm water 2 tbsp milk 385gm flour 1 tsp salt 7gm yeast Method Add water and milk to bowl and microwave to room temp (~10-15 secs) Add yeast and mix Add flour then salt, coat salt with flour Mix with scraper until combined, don't knead it Put dough in bowl and wait till it doubles in size (1hr) Put dough on table and knead for 8 mins. It will be very sticky, use the spray bottle to keep it lubed Put dough in bowl and wait till it doubles in size (1hr) Flour surface well and tip dough onto it Ball it up (Jack method) then flour it all over and place on baking paper, DON'T USE A TRAY Flatten and shape into oval/rectangle about 12mm thick Rest for 30 mins or till it's puffed up nicely Put baking stone on middle rack Add seeds and salt as needed Transfer to stone using pizza spade Bake 20 mins @ 200c rotating mid way Notes Update 11/3/2023 -  Followed recipe

Custom reports - general info

I used this article to learn about custom reports. It's an excellent source of information and is the key to getting started. Performance Information here is summarised from  this article and is really just a memory jogger. There are 3 main views to get perf data from: vPerfDaily vPerfHourly vPerfRaw You typically use vPerfDaily and vPerfHourly as they contain (not only) these columns: SampleCount AverageValue MinValue MaxValue StandardDeviation vPerfRaw (not only) contains: SampleValue The main thing to note here is that hourly/daily datasets contain more info - but it's less granular due to aggregation? - while the raw dataset contains the value the rule collected each time it ran.  vPerfRaw  data is also kept for a shorter time - I don't know how long.

Exchange queues

There doesn't seem to be any queue monitors in the  Microsoft.Exchange.15  sealed mp from Microsoft. This was the last mp they made that monitors on-prem Exchange 2013/2016. To address this, I think it was Kevin Holman who made the  Exchange.Queues (15.0.669.23) mp. The monitors in the mp are listed in Table 1.0 and they all have these settings in common: Target:  Exchange.Queues.Server Parent Monitor: System.Health.PerformanceState Category: PerformanceHealth Object: MSExchangeTransport Queues Counter:  see Table 1.0 Instance:  _Total Frequency: 60 seconds Threshold: 5000 Monitor type:  System.Performance.ConsecutiveSamplesThreshold Table 1.0 Counter Name External Aggregate Delivery Queue Length (All External Queues) External Retry Remote Delivery Queue Length Internal Aggregate Delivery Queue Length (All Internal Queues) Internal Retry Remote Delivery Queue Length Retry Mailbox Delivery Queue Length Retry Non-Smtp Delivery Queue Length Submission Qu

700 gm white loaf

Makes 1 loaf. Takes 1 day. Ingredients 448gm water 10gm yeast 700gm flour (white or stone ground) 12gm salt 21gm olive oil Method Use the big loaf tin and follow the method in Jack's book, just roll into sausage instead To seed, sprinkle seeds on bench, spray dough and roll in seeds then do 3 deep slashes Bake 45 mins @ 180c Notes 26/01/2023 I baked 40 mins @ 200c and the top was a little brown. 45 mins @ 180c seems fine.

Approve pending agents from file

First dump pending agents to file: Get-SCOMPendingManagement | sort AgentName | select -ExpandProperty AgentName | Out-File C:\Temp\agents.txt Remove any agents you don't want from the file then run this to approve them: $a=gc C:\Temp\agents.txt foreach ($i in $a) {Get-SCOMPendingManagement | where {$_.AgentName -eq $i} | Approve-SCOMPendingManagement}

DHCP monitoring

When I initially implemented my framework I disabled a lot of rules and monitors for DHCP management packs. At the time I did this I used these management packs: Microsoft.Windows.DHCPServer.2012 - 6.0.7309.0 Microsoft.Windows.DHCPServer.2012.R2 - 6.0.7309.0 Microsoft.Windows.DHCPServer.Library - 10.1.0.1 Microsoft.Windows.DHCPServer.2016 - 10.1.0.1 I used these for scope monitoring: Microsoft.Windows.DHCPServer.2012.AllIndScope.IPV4.FreeScopeAddresses.Percentage.Monitor Microsoft.Windows.DHCPServer.10.0.AllIndScope.IPV4.FreeScopeAddresses.Percentage.Monitor The classes for the 2 monitors are respectively: Microsoft.Windows.DHCPServer.2012.IPv4ScopesRuntime Microsoft.Windows.DHCPServer.10.0.IPv4ScopesRuntime If you do a get-scomclassinstance on these you'll probably find there aren't any, making this monitoring useless. To confirm this go to  Microsoft Windows Server DHCP > Scope Health  in the console and you'll see all health states are not monitored. So, we need to d

Cluster disk monitoring

When I initially implemented my framework I disabled a lot of rules and monitors for cluster disks because honestly, I don't know if they are useful. At the time I did this I used these management packs: Microsoft.Windows.Cluster.Library - 7.0.8437.17 Microsoft.Windows.2012.Cluster.Management.Library - 10.0.6.6 Microsoft.Windows.2008.Cluster.Management.Library - 10.0.6.6 Microsoft.Windows.2008.Cluster.Management.Monitoring - 10.0.6.6 Microsoft.Windows.2012.R2.Cluster.Management.Monitoring - 10.0.6.6 Microsoft.Windows.2012.R2.Cluster.Management.Library - 10.0.6.6 Microsoft.Windows.2012.R2.Cluster.Management.Monitoring.Overrides - 10.0.6.6 Microsoft.Windows.2012.Cluster.Management.Monitoring - 10.0.6.6 Microsoft.Windows.2016.Cluster.Management.Library - 10.1.0.0 Microsoft.Windows.Cluster.Management.Library - 10.1.0.0 Microsoft.Windows.Cluster.Management.Monitoring - 10.1.0.0 Microsoft.Windows.2016.Cluster.Management.Monitoring - 10.1.0.0 Microsoft.Windows.Server.ClusterSharedVolumeMo

Using a Run As account for a rule

Here's an MP that demonstrates how to run a rule with a VBScript using a specific Run As account in SCOM.

Create discovery override with PowerShell

This is a quick & dirty to create the overrides that disable the failover check for agents from my SCOM Admin mp. $output_overrides="" $a=gc C:\temp\file.txt foreach ($i in $a) { $GUID=[guid]::NewGuid().ToString("N") $Id="OverrideForDiscoverySCOMDiscoveryWindowsComputerClassForContextMicrosoftSystemCenterHealthService$GUID" $output_overrides+="<DiscoveryConfigurationOverride ID=""$ID"" Context=""SystemCenter!Microsoft.SystemCenter.HealthService"" ContextInstance=""$i"" Enforced=""false"" Discovery=""Admin!SCOM.Discovery.WindowsComputerClass"" Parameter=""IgnoreAgentMgmtGroups"" Module=""DS""><Value>MG_group</Value></DiscoveryConfigurationOverride>" } $output_mp=$output_overrides $output_mp | Out-File "_Overrides.xml"

Get health service IDs from file

This reads in a list of computer names and gets the health service ID for each one and writes the output to screen and file. [int]$count="" # need to declare or $count gets weird. $fqdn="" $file="" $file+="FQDN,ID`r" $a=gc C:\temp\file.txt | sort $output="c:\temp\HealthServiceIDs.csv" foreach ($i in $a) { $b=Get-SCOMClass -Name Microsoft.SystemCenter.HealthService | Get-SCOMClassInstance | where {$_.displayname -eq $i} $fqdn=$b.displayname $id=$b.id write-host "$fqdn, $id" $file+="$fqdn,$id`r" } write-host "Exporting output to $output" $file | out-file $output

Load balance agents

This will setup new primary and failover servers for agents reporting to a gateway. It assumes you only have 1 failover server and you can filter for the agents you want by domain name. Change  Get-SCOMGatewayManagementServer to  Get-SCOMManagementServer for agents reporting to management servers. $Server1=" GW1_FQDN " $Server2=" GW2_FQDN " $Primary= Get-SCOMGatewayManagementServer -Name $Server1 $Failover= Get-SCOMGatewayManagementServer -Name $Server2 $Agents=Get-SCOMAgent | where {$_.PrincipalName -match " AGENT_FQDN "} | sort PrincipalName foreach ($Agent in $Agents) { $Count+=1 $Fqdn=$Agent.DisplayName $AgentName=Get-SCOMAgent -Name $Fqdn if($Count %2 -eq 0) { write-host "$Count, Agent: $Fqdn, Primary: $Server1, Failover: $Server2" Set-SCOMParentManagementServer -Agent $AgentName -FailoverServer $NULL # Need this or you get error "The failover server xxx cannot be the same as the primary server." Set-SCOMParentManagementServer

Reset monitor

This example shows how to reset the Windows Inventory Script monitor. You first need to get the dot name of the monitor and the class the monitor targets. To get the class run this: (get-scommonitor -name SCOM.Monitor.WindowsInventoryScript).target.Identifier.path You also need to confirm the severity of the monitor or it won't work – sometimes alert severity does not match severity in health explorer. Important: This can be slow. I am not sure it is the best way to reset monitors, but it works. $Monitor="SCOM.Monitor.WindowsInventoryScript" $Class="Microsoft.Windows.Computer" $Severity="Warning" # Must match health state of the monitor (Success, Error, Warning) $MonitorToReset = Get-SCOMMonitor -Name $Monitor $Monitoringclass = Get-SCOMClass -Name $Class $Monitoringclass | Get-SCOMClassInstance | where {$_.HealthState -eq $Severity} | foreach {$_.ResetMonitoringState($MonitorToReset) | select Status} This is something I was messing around with when I

Install SCOM agent without APM

I've never had a need to install the APM component of an agent - it installs by default running it manually (and possible pushing from console?). This command will install without APM: msiexec.exe /i MOMAgent.msi /qb /l* LOG_FILE  USE_SETTINGS_FROM_AD=0 MANAGEMENT_GROUP= MGMT_GROUP_NAME  MANAGEMENT_SERVER_DNS= MGMT_SERVER  ENABLE_ERROR_REPORTING=0 ACTIONS_USE_COMPUTER_ACCOUNT=1 USE_MANUALLY_SPECIFIED_SETTINGS=1 NOAPM=1 AcceptEndUserLicenseAgreement=1

Use old SCOM 2007 dashboards

You can import old SCOM 2007 era dashboards in newer versions of SCOM. Download the mps here . I'm not sure which zip file it is but I imported the mp named OpsMgrR2Dashboards (version 1.0.0.2) into SCOM 2016 and they worked. After you import the mp it will create a folder structure in the Monitoring pane and you just copy the view you want into your folder.

SrvAny

This thing is great because it lets you run notepad as a service so you can stop and start it when testing service monitoring in SCOM. Stopping can be dodgy so just kill the process. Note: The old srvany.exe and instsrv.exe from the Win 2003 resource kit are hard to find now. Install a service Download  SrvAny.zip and extract contents. Open admin PowerShell and type this command to run notepad as a service (path may vary depending on OS version): SrvAny.exe -install ServiceShortName 1 c:\windows\notepad.exe I don't know what the 1 does but you need it. Set the service to auto start and you're done. Remove a service SrvAny.exe -remove ServiceShortName

Delete data from SCOM Ops db

Image
Had an issue with SCOM where an agent had been deleted but still appeared in the Windows Computers  view. I followed this article and ran all queries except 5. After a few minutes the computer disappeared. In brief you need to run these queries: First, get the BaseManagedEntityId of the computer: DECLARE @name varchar(255) = 'COMP_FQDN' SELECT BaseManagedEntityId, FullName, DisplayName, IsDeleted, Path, Name FROM BaseManagedEntity WHERE FullName like @name OR DisplayName like @name ORDER BY FullName Note: It's the row with  Microsoft.Windows.Computer:COMP_FQDN Change BaseManagedEntityId   to the ID of the invalid entity: DECLARE @EntityId uniqueidentifier = 'BaseManagedEntityId' DECLARE @TimeGenerated datetime;  SET @TimeGenerated = getutcdate(); BEGIN TRANSACTION  EXEC dbo.p_TypedManagedEntityDelete @EntityId, @TimeGenerated;  COMMIT TRANSACTION Run the first query again. This is to inspect the objects and see if their IsDeleted flag is now = 1. A few hours later

Reg.exe examples

Displays all subkeys and values reg query "HKLM\SOFTWARE\Wow6432Node\Network Associates\ePolicy Orchestrator" reg query "\\COMPUTER\HKLM\SOFTWARE\Wow6432Node\Network Associates\ePolicy Orchestrator" Show the value of InstallFolder reg query "\\COMPUTER\HKLM\SOFTWARE\Wow6432Node\Network Associates\ePolicy Orchestrator" /v InstallFolder

SCOM expired eval license

Image
You'll get this error when SCOM's eval license runs out. Event Id: 26319 Event Source: OpsMgr SDK Service You will also see the alert Product evaluation has expired which is generated by the monitor  Product Expiration - Error which looks for event id 26383. See  how to license SCOM . Once you have licensed it restart all services. I had some workflows not running because I didn't bounce the HealthService.