Yesterday I needed a Biztalk 2004 management pack for Ops Mgr 2007. The only Biztalk managamange pack available in the System Center Operations Manager 2007 catalog is for Biztalk 2006. I converted the MOM 2005 Biztalk 2004 MP to Ops Mgr 2007 format, according to Petes guide. But, when I tried to import the management pack into Ops Mgr 2007 I recived a error saying “XSD verification failed for management pack”. I then downloaded XML Notepad 2007 and took a look at the XML file. The NAME field included a lot of spaces, I removed them and wrote Biztalk2004 in the NAME field instead. After that there was no problem importing the Biztalk 2004 management pack into Ops Mgr 2007.

After you have implement Audit Collection Services in your environment you must start monitor the collector. There is a number of performance counters that can help you with this:

• Connected Clients
• Database Queue % Full
• Database Queue Backoff Threshold in %
• Database Queue Disconnect Threshold in %
• Database Queue Length
• DB Loader Event Inserts/sec
• DB Loader Principal Inserts/sec
• DB Loader String Inserts/sec
• DB Principal Cache Hit %
• DB Request Queue Length
• DB String Cache Hit %
• Event time in collector in milliseconds
• Incoming Events/sec
• Interface Audit Insertions/sec
• Interface Queue Length
• Registered Queries

If you want to collect this performance data and review it for analyse and plannig, you can first create a collection rule and then a performance view.

1. Start the console, click Authoring
2. Right-click Rules and choose to create a new rule
3. Rule Type: Choose to create a Collection Rules/Performance Based/Windows Performance. Click Next
4. General: Input a rule name, description and choose “Microsoft Audit Collection Services Collector” as rule target, then click next.
5. Performance Counter: input “ACS Collector” as object. If you want to collect for example number of events inserted in the database per second, select “DB Loader Event Inserts/sec” as counter. Select “Include all instances for the selected counter”. Configure the interval and then click Next
6. Optimized Collection: Choose to use optimization or not, click Create

If you want to view the collected data you can create a performance view, and configure it to show data related to “Microsoft Audit Collection Services Collector”.

In MOM 2005 we could add advanced criterias and for example check if a event description included a special word, “matches wildcard”. In this post I will show you how to get the same feature in Ops Mgr 2007. I want an alert when a event with “unsucessfully” is written in the local event log.

I have create a simple vbscript that writes two events to a local event log. The event ID and source are the same, and the description is almost the same, but one event includes “unsuccessfully” and the other one includes “sucessfully”. Now I want to get an alert only when events with “unsuccessfully” a written in the local event viewer.

1. Start Ops Mgr Console, click Authoring
2. Right-click Rules and choose to create a new Rule, create a Alert Generating Rules/Event Based/NT Event Log (Alert)
3. Rule Type: Choose a suitable management pack to store your new rule, click Next
4. General: Input a name, description and choose a suitable target, click Next
5. Event Log Type: Choose which log, in my example events will be generated in the Application Log. Click next
6. Build Event Expression: in my example
   Event ID. equals. 0
   Event Source. equals. WSH
7. Click Insert and choose then “…” in the new parameter box. In “Select an Event Property” choose “Use parameter name not specified above” and then insert EventDescription , click OK
   setup the last parameter as
   EventDescription. Contains. unsuccessfully  , click Next
8. Configure Alerts: Configure a suitable alert, with some description. If you want the entire event shown in the alert description you can add $Data/EventDescription$. Click Create

You sometimes gets something like this in for example an alert

Affected monitor ID: AE311D41-D0C4-31B3-B2A1-E503E7226F42 Instance ID: 54321668-EFFA-411D-A511-3C6D9E119294 Management Group ID: 17F3B66F-8597-7BB1-35EE-F382AAF6B299

You then want to know the name of the monitor. Unfortunately the built-in advanced search tool in the console dont support searching on Monitor ID.  But you can run this SQL query in your OperationsManager database, it will give you bot monitor name and managementpack

SELECT Monitor.MonitorName, ManagementPack.MPName FROM Monitor INNER JOIN ManagementPack ON Monitor.ManagementPackID = ManagementPAck.ManagementPackID WHERE MonitorID = ‘X’

Replace X with the Monitor ID.