Home » Articles posted by Anders Bengtsson (Page 53)

Author Archives: Anders Bengtsson


Welcome to contoso.se! My name is Anders Bengtsson and this is my blog about Azure infrastructure and system management. I am a senior engineer in the FastTrack for Azure team, part of Azure Engineering, at Microsoft.  Contoso.se has two main purposes, first as a platform to share information with the community and the second as a notebook for myself.

Everything you read here is my own personal opinion and any code is provided "AS-IS" with no warranties.

Anders Bengtsson

MVP awarded 2007,2008,2009,2010

My Books
Service Manager Unleashed
Service Manager Unleashed
Orchestrator Unleashed
Orchestrator 2012 Unleashed
Inside the Microsoft Operations Management Suite

SQL Management Pack

There is a new version of SQL Management pack for SQL 2000 and 2005 ready for download 

  • Support for SQL 2003 SP1 and database mirroring
  • Improved support for X64
  • Improved support for monitoring of database space
  • Improvied product knowledge

You can download it here

Windows Media Player 11 beta 2

You can now download Windows Media Player 11 beta 2 here
You can find a FAQ here

Monitor logfile

Do you have some strange application with a logfile? It is suitable to monitor that logfile with MOM. Below there is a short walkthrough how to do that. To get this to work you will need a new provider and a new rule.

Create a new provider.
You create provides in Administrator Console, Management Packs, Provides.
Right-click Provides and choose “Create Provide”, fill in information as below
Source of the provider: Application Log
Type: Application Log
Settings: Generic single-log file
Directory: for example C:\LOG
Format: Generic
File Pattern: for example system.log or log*
Click Finish when done

Create a new computer group, name it to some something suitable for example MyApp. Add all computers you want to monitor.

Create a new rule group. Associate the new computer group with your new rule group.

In you new rule group, right-click Event Rules and choose “Alert on or response to event…”
fill in information as below at Advanced on the Event Rule Properties – Criteria tab.
Provider Name: Choose the provider you created before
Field: Parameter 4
Condition: matches wildcard
Value: For example *warning* if we want an alert when that word is in the logfile.
                Click Add to list
                Click Close
Event Rule Properties – Criteria, click next
Event Rule Properties – Schedule, click next
Event Rule Properties – Alert, check “Generate alert, then click next
Event Rule Properties – Alert Suppression, click next
Event Rule Properties – Responses, click next
Event Rule Properties – Knowledge Base, click next
Event Rule Properties – General, input a name and click finished

That should do it!

Note that it can take some minutes before new rules is active. Also note that MOM will start “read” a line when the application has started on a new line. So when the application has start write to line 2 MOM will read line 1.

I have upload screenshots with all settings, you can find them under screenshots.

Remove management pack

I got a question a couple of days ago from my friend Christoffer Andersson:
“Is it possible to remove a management pack from SCOM 2007”?

Operations Manager 2007 also includes the ability to delete a management pack.
Deleting a management pack will remove all management pack objects and discovered data from the database.

source: Operations Manager 2007 Help

Virtual Appliances

A “virtual appliance” is a pre-installed and pre-conf application or IS running on a standard server or desktop computer in a virtual environment. There is a couple of hundreds   

There is a couple of hundreds virtual appliances ready for download at vmware.com. For example anti-spam servers, mailservers, proxy, firewalls and IDS servers. 

You will find Virtual Appliance here. 

You can download Vmware server for free here


Microsoft Certified Professional

During a short timeframe you will get a second shot for free on Microsoft cert. Take the chance and book a test before the offer ends. More information here.

Vista Beta 2

Vista Beta 2 is now published, you can download it here



Yesterday there was a new KB publish

How to add space to the Microsoft Operations Manager OnePoint Database

Mail notification based on computer groups

Billy Grind is administrator for a server named CONTOSOFILE01. Billy wants to get a e-mail if something happens with CONTOSOFILE01. This short instruction is based on a working MOM installation and that SMTP is already setup and working.

First we need to add Billy as a operator, we can do that under “Nofification” in Administrator Console

1.       Right-click “Operators” and choose “Create Operator…”

2.       Operator Properties – General” tab, input name of the operator, then click next

3.       Operator Properties – Email, Mark “Email this operator”, input the operator e-mail , then click next

4.       Operators Properties – Page, click next

5.       Operators Properties – Command, click finish

Then we need to create a notification group where the new operator will be member

1.       Right-click “Notification Groups” and choose “Create Notification Group…”

2.       Input a name, for example fileserver administrators

3.       Mark the operator you just created, and click left arrow, click finish

Then we need to create a new computer group where CONTOSOFILE will be member and a rule that will send e-mail to Billy Grind

1.       First create a new computer group and include CONTOSOFILE01

2.       Then create a new rule group

3.       Right-click the new rule group, choose “Associate with Computer Group…” choose the computer you just created, then close that window

4.       Right-click “Alert Rules” and choose “Create alert rule…”

5.       Alert Rule Properties – Alert Criteria”, click next (there will be no criterias)

6.        Alert Rule Properties – Schedule, click next7.       Alert Rule Properties – Responses, choose add and then “Send a notification to a Notification group”, choose you new operators group and then click OK

8.       Alert Rule Properties – Responses, click next

9.       Alert Rule Properties – Knowledge Base, click next

10.   Alert Rule Properties – General, input a name for your new rule, verify that “This rule is enable” is marked, then click finish.

Ok, now it’s done. Note that it can take some minutes before the new rule is active.

If you want to setup more criteria for e-mail notification I recommend you to install Notification Workflow. Another thing to thing about is which e-mail server you are running MOM alerts on, what happens if  that mailserver goes offline? It could be a good ideas to install a extra SMTP server for MOM.


KB article,  “Failed to send SMTP message” error when MOM 2005 tries to send SMTP e-mail notification response”


Rolebased security

There is a large number of operations in SCOM 2007 for example close alerts, run scripts and change rules. All these operations have been group in different profiles.  Every profile correspond to function or service. Below there is a explanation to every default role. A great news is that we finally got that true read-only operator role without multiple management groups.

  • Report Operator
    This profile is used to give permissions to reports. SCOM 2007 have integrated SQL Reporting service security into SCOM 2007 security. Only members or the Report Operators role can read reports.
  • Report Security Administrator
    This profiles is used between SQL Reporting services and SCOM 2007. The IIS application pool that run SQL Reporting Server is using this profile.
  • Read-Only Operator
    This profile is for persons who should only be enable to read alerts and views. What the persion can see is controlled by scope.
  • Operator
    This profile is for persons that need access to alerts, views and to be enable to run tasks. This profile is the same as MOM User group in MOM 2005.
  • Advanced Operator
    This profile is based on the operator profile, but this profile can also change a part of the configuration. Which part of the configuration is controlled by the running scope.
  • Author
    This profile is the same as the MOM Author group in MOM 2005. This profiles if for persons who will work with management packs and settings.
  • Administrator
    The Administrator profile is the most powerful profile. Administrators can do anything within the system. During the installation you will choose a group who will become SCOM 2007 Administrators. This profile is the same as MOM Administrators in MOM 2005.