Home » Search results for 'rule performance data' (Page 2)

Search Results for: rule performance data

Monitor the internet connection as a client

“Hello, is it IT support? My Internet is slow”

Have you heard that before? Last week a customer asked me if we could monitor how long it takes to download a file from a client workstation, and present it in a nice performance view in the Operations Manager console. Of course we can, with a script in a rule. The script downloads a file from Internet, measure the time it takes and reports it back to Operations Manager as performance data. You can control which machines that runs the script, so you cant select some workstations or machines in remote offices. If it takes more then 3 seconds it will generate a local event. If there is a problem downloading the file it will also generate a local event. You can configure Operations Manager to pickup this event and generate an alert. Thanks to Patrik the script can detect if the file we are trying to download is missing or if there are any other download related problems. I have attached the script I used, and below is the steps that you need to take to implement it.

To use this script, follow these steps

  1. In the Operations Manager console, navigate to the Authoring workspace, right-click Rules and select Create New Rule
  2. In the Create Rule Wizard, select to create a Probe Based/Script (Performance) rule, select a suitable management pack for example Contoso – Internet Download
  3. On the Rule Name and Description page, input a rule name for example “Contoso – Internet Download – Download 20 Mb file”. Select a suitable target for example Windows Server. Uncheck the “Rule is enabled” box.
  4. On the Schedule page, input how often you want to script to run. For example every 10 minutes
  5. On the Script page, clear the script text box and paste the script from the attached file. Configure the timeout to 5 minutes. Change the script name to ContosoDownloadscript.vbs
  6. On the Performance Mapper page, input
    • Object: 20MB.zip
    • Counter: FileDownload_Time
    • Instance: select Netbios computer name from the menu
    • Value: $Data/Property[@Name=’Contoso_PerfValue’]$
  7. Create the rule

Now you have a rule target to all Windows Servers. But it is disabled. To control which machine that is running this, create a new group, save it in the same management pack (important!) and add some windows servers as explicit members. These machines will run the script and download the file.

  1. In the Operations Manager console, navigate to the Authoring workspace, right-click Groups and select Create a new Group
  2. In the Create Group Wizard, input a group name, for example “Contoso – Internet Download nodes”. Select the same management pack as you used before, in my case Contoso – Internet Download
  3. On the Explicit Member page, click Add/Remove Objects
  4. In the search for drop down menu, select Windows Server. Then in the name field input the machine or machines that you want to use as watcher node and add then under selected objects
  5. Click next a couple of times in the wizard and then save and close it

To enable the rule against the machines in this group,

  1. Find the rule again under Authoring and rules
  2. Right-click it and select Overrides, Override the Rule, For a group, select your group
  3. In the Override properties window, select enable and configure the override value to TRUE. Click OK to save.

The next step will be to configure a rule to pickup the event. These are the two events that you want to generate alert on

  1. Navigate to Authoring workspace, right-click Rules, select Create a new rule…
  2. In the Create Rule Wizard, select to create a Alert Generating Rule, Event Based, NT Event Log (Alert). Select the same MP again, in my case Contoso – Internet Download
  3. On the General page, input a name, for example Contoso – Internet Download – Event rule. Select “Windows Server” as rule target. Uncheck the “Rule is enabled” check box
  4. On the Event Log Type page, select Application
  5. On the Build Event Expressen, input
    • Event ID Equals 2
    • Event Source Equals WSH
  6. On the Configure Alerts page, click Alert suppression…
  7. In the Alert Suppression window, select Event ID, Logging Computer, Event Source, click OK
  8. On the Configure Alerts page, click Create

Now we need to enable this for the machines that we use as watcher nodes. As we created this rule with “Rule is enabled” unchecked, no machines is running it right now.

  1. Find the rule again under Authoring and rules
  2. Right-click it and select Overrides, Override the Rule, For a group, select your group
  3. In the Override properties window, select enable and configure the override value to TRUE. Click OK to save.

The last step could be to create the performance view

  1. In the console, navigate to the Monitoring workspace
  2. Select the folder for your MP, in my case “Contoso – Internet download”. Right-click it and select New > Performance View
  3. In the Properties window input
    • Name: Contoso - Download speed
    • Show data contained in a specific group: Select your group, in my case “Contoso – Internet download nodes”
    • Object: 20MB.zip
    • Counter: FileDownload_Time
  4. Click Ok to save you diagram view

If you want to change the file that we download, or the destination folder, you need to modify the script and the lines highlighted below

If you want to change the default 5 seconds threshold on the download, you need to modify the following line

Download the script here, Internetdownload

Logfile Check on Linux

In Operations Manager 2007 R2 we have the possibility to monitor Linux and UNIX machines. There are among with other new features two new management pack templates:

  • Unix/Linux LogFile (monitor a logfile for a specified entry)
  • Unix/Linux Service (monitor a service with a standalone process)

In this post I will show some ideas how to monitor file size on a linux machine. File size monitoring is not a default feature in R2, not on Windows or on Linux machines. On Windows machines I use a two state monitor and a script, describe in this post.

The first step is to create a script on the Linux side. This script checks how big the file is, and if the file is bigger then 100 it will write a warning to a logfile (scriptlog.log).

#!/bin/sh
find /load.sh -printf ‘%s %p\n’ | while read size name; do
if [ “$size” -gt 100 ]; then
echo $(date) WARNING the file is $size >> scriptlog.log
fi
done

The next step is to get Linux to run it automatically, we can do that with cron. Cron is a time-based job scheduler in Linux. Cron is driven by a crontab, a configuration file that specifies what to run and when. My crontab looks like

* * * * * / root/script.sh

It is very simple, I run the script every minute. Configure it with

crontab -e

The next step is to configure a management pack template for the Linux logfile to trigger on WARNING in the scriptlog.log file, configure it to trigger on WARNING. It is also important to keep track of the cron process, fortunately that is monitored with the default SUSE management pack.

You are now monitoring if there is a problem with the file size. The next step is to get the size of the file as performance data in Operations Manager. This can also be done with a script and a collection rule. Create a Collection Rule (Probe Based/Script (Performance)) and run the following script with the rule:

Set objShell = WScript.CreateObject(“WScript.Shell”)
Set objExecObject = objShell.Exec(“cmd /c C:\plink.exe user@192.168.0.71 -pw password stat -c%s / root/script.sh”)
Do While Not objExecObject.StdOut.AtEndOfStream
strText = objExecObject.StdOut.ReadLine()

Dim oAPI,oBAG
Set oAPI = CreateObject(“MOM.ScriptAPI”)
Set oBag = oAPI.CreatePropertyBag()
Call oBag.AddValue(“PerfValue”, 10)
Call oAPI.Return(oBag)
Loop

This script runs plink.exe. Plink (PuTTY Link) is a command-line connection tool. We will use that to execute commands on the Linux side. The script will then collect the result of the command, the file size, and send it back as a performance data value (PerfValue). I have the same kind of script for Windows here.

The next thing we might want to check is if the file exists. We can do that with a two state monitor. In this post you can read how to configure a two state monitor with a script. Use the script below in your monitor

Dim oAPI, oBag
Set oAPI = CreateObject(“MOM.ScriptAPI”)
Set oBag = oAPI.CreatePropertyBag()
Set objShell = WScript.CreateObject(“WScript.Shell”)
Set objExecObject = objShell.Exec(“cmd /c C:\plink.exe user@192.168.0.71 -pw password [ -f / root/thefile.log ] && echo ok || echo bad”)
Do While Not objExecObject.StdOut.AtEndOfStream
strValue = objExecObject.StdOut.ReadLine()

If instr(strValue, “ok”) Then
Call oBag.AddValue(“Status”,”OK”)
Call oAPI.Return(oBag)
End If

If instr(strValue, “bad”) Then
Call oBag.AddValue(“Status”,”Bad”)
Call oAPI.Return(oBag)
End If

Loop

That script checks if thefile.log exists in the root directory. If it does it will send back “ok” else “bad”.

Summary: We use a couple of different scripts and forwards the result to Ops Mgr. One script echo to a logfile that we then pickup with default a Logfile management pack template. Another script is run from inside a two state monitor with the plink.exe tool. In this post I wanted to give you some ideas to get info into Operations Manager 2007 from your Linux machines.

Author Custom Reports in Ops Mgr 2007

Operations Manager 2007 collects large amounts of data from your environment. By using the Reporting feature, you can create reports based on this data that provide additional information about the health of your environment. Operations Manager can have four types of reports

  • Published reports, automatically available in the console after ops mgr reporting installation
  • Linked reports, based on existing reports
  • Custom reports, authored from queries that you build in Visual Studio
  • Report solution, defined with Visual Studio and are available in a  management pack 

I always try to solve the new report request with a linked report if possible. The next step is to use the built-in SQL Report Builder, which you find under the Reporting workspace. But when using that you will need a report model. A report model is a description of an underlying database that is used for building reports in Report Builder 1.0. For example in this post I use the ACS db (Audit Collection) report model to build custom ACS reports. In Ops Mgr there are report models for ACS, performance and event reports. But there are scenarios that you can´t solve with linked reports or SQL Report Builder, and then Visual Studio is a great tool to build reports with.

The first thing you need to do in Visual Studio when you start a new reporting project is to add a data source. A data source represents a connection to an external data source. The second thing is to add a report and a data set. A data set retrieves rows of data from a data source based on an SQL query. You can for example the query string below when working with performance reports. As you can see it looks for performance counters including Available MBytes in the name.

SELECT
vManagedEntityTypeImage.Image,
vPerfHourly.DateTime,
vPerfHourly.SampleCount,
vPerfHourly.AverageValue,
vPerfHourly.StandardDeviation,
vPerfHourly.MaxValue,
vManagedEntity.FullName,
vManagedEntity.Path,
vManagedEntity.Name,
vManagedEntity.DisplayName,
vManagedEntity.ManagedEntityDefaultName,
vPerformanceRuleInstance.InstanceName,
vPerformanceRule.ObjectName,
vPerformanceRule.CounterName
FROM
Perf.vPerfHourly INNER JOIN
vManagedEntity ON Perf.vPerfHourly.ManagedEntityRowId =
vManagedEntity.ManagedEntityRowId INNER JOIN
vManagedEntityType ON vManagedEntity.ManagedEntityTypeRowId =
vManagedEntityType.ManagedEntityTypeRowId LEFT OUTER JOIN
vManagedEntityTypeImage ON vManagedEntityType.ManagedEntityTypeRowId =
vManagedEntityTypeImage.ManagedEntityTypeRowId INNER JOIN
vPerformanceRuleInstance ON
vPerformanceRuleInstance.PerformanceRuleInstanceRowId =
Perf.vPerfHourly.PerformanceRuleInstanceRowId INNER JOIN
vPerformanceRule ON vPerformanceRuleInstance.RuleRowId =
vPerformanceRule.RuleRowId
WHERE
(vPerformanceRule.CounterName LIKE N’%Available MBytes%’)
ORDER BY vPerfHourly.DateTime

 There are a number of good query strings at this TechNet page. The next thing to do is to start designing your report. You can drag and drop report objects from the toolbox. Report items add data, structure, and formatting to a report and come in two varieties; data regions and independent items. A data region renders data from an underlying data set.Independent report items are items that are not associated with a data set, for example a line or a rectangle. If we continue with the available Mbytes example a chart would be a good start. By drag and dropping a chart from the toolbox and then fields from the dataset you can easily create a chart. But it is not that easy-to-read.


To make the report more precise we could start by adding a drop down menu to select which machine to look at performance data from. To do that we first need to create a new dataset. You can use the same SQL query as before, but in this dataset only

select DISTINCT vManagedEntity.Path

, as we only want machines in the drop down menu. Then go to the Report menu and select to add a report parameter. Select to create a report parameter with a query based value and then select your new dataset and the path field. Then you need to add this parameter to your first dataset, as you want to only see performance data for the selected machine. To do that add vManagedEntity.Path and your parameter to the SQL query.

(vPerformanceRule.CounterName LIKE N’%Available MBytes%’) AND (vManagedEntity.Path = @Server)

If we now preview the report there is a drop down menu with all machines where the chart only show data shows data related to the selected machine.

The next think would be to change the time range. You can do that with report parameters and then add them to your SQL query. If you want to add a dynamic time range, for example NOW minus 7 days you can use the DateAdd command in your SQL query.

If you then right-click the chart there are a number of settings, for example change the scale, change chart type, enable 3-D and add a title to the chart. Other things that you might want to add is a header and some text to your report, then a table with details about the data in the chart. You can drag and drop both text box and matrix from the toolbox.

 

When you are satisfied with your report you can right-click the report project (top left side of visual studio) and deploy the report to your reporting server.

Schedule Report to Update Every Hour

I saw a question about generating a report every hour for “the hour before”, that you can´t do out of the box. But I have a idea, why dont generate a report every half hour, for the entire day? That would give you a updated report every half hour, including the hour before, or as far as the data warehouse has processed data.

In this example I will use a generic performance report

  1. Open the Ops Mgr 2007 Console
  2. Go to Reporting (Ctrl+3)
  3. Expand Reporting and click Microsoft Generic Report Library
  4. Click Performance and then choose Schedule from the action menu
  5. The Subscribe to a Report wizard starts, at the Delivery page, input a description and choose a delivery method. In this example I will choose Windows File Share as delivery method. That will store my report to a file share on the network.
    – File name, for example CPU Graph Today.pdf
    – Path, for example \\servername\share
    – Render Format, choose output format, PDF is nice
    – Write mode, choose Overwrite
    – User name and Password, inpute information about a account to use to write the report, then click Next
  6. At the Subscription Schedule page, choose how often the report should be generated. I will choose Hourly and every 0 hours and 30 minutes. Choose when the subscription should start and then click Next
  7. At the Report Parameters page, choose
    – Data Aggregation: Hourly
    – From: Today 00:00
    – To: 23:59
    – Histogram: Daily by hours
    – 3D Chart: True
  8. At the Report Parameters page, click Change…
  9. In the Settings box, click New Chart
  10. In the Settings box. input chart title, for example CPU Graph Today
  11. In the Settings box, click New Series
  12. In the Settings box, click Add Objects, in the Add Object box, choose a item of the Windows Operating System type, click Add and then OK
  13. In the Settings box, click Browse
  14. In the Select Rule box, search for “processor” and choose “Processor % Processor Time Total” from available items, click OK
  15. In the Settings box, click OK
  16. At the Report Parameters page, click Finish
  17. Back in the console reporting part, click Scheduled Reports to see your new subscription.

As you can see in the report, the report are about one hour behind. If you generate the report at 23:30 the report will include data to 22:30. If you need for example performance data quicker than that, you can create a new performance view.

Management Pack Objects OpsMgr 2007

Are you running OM 2007 yet? If you do, you have presumably noticed all new features.  When you look in the Authoring pane of the Operations Console you will see a number of new features under management pack objects. In this post I will try to explain some of the news regarding management packs.

 

Attributes
Attributes are almost the same as in MOM 2005, but here are a couple of news that you should know as a OM 2007 administrator. In MOM 2005 a attribute check one registry key or a registry value. In OM 2007 a attribute can check the registry or WMI query, this is controlled by the “Discovery Type”. When creating an attribute an object type must be selected as a target for it. A object type can include a number of attributes, for example a number of registry values. You can then create a group that has a dynamic inclusion rule for servers that only have that object type. In MOM 2005 you did this with a forumla at the computer group object.  

Monitors
What is the main diffrence between a rule and a monitor?

  • Monitors exists for every instance in the system, rules act independently of one another
  • Monitors are the only thing that can affect the state of an instance
  • For example, a monitor can be used to estimate the state of a event (if it exist) or the value of a performance counter. The result of that control the health state of a target and the alerts that are generated. There are three types of monitors:

  • Unit monitors (created to monitor specific part of a application, device or service)
  • Aggregate rollup monitors (this type of monitors roll up the health of monitors beneath them according to a defined algorithm.)
  • Dependency rollup monitors (roll up health state from targets linked by either a hosting or a membership relationship)
  • Object Discoveries
    Object Discoveries are used to find objects in the network that need to be monitored. In a management pack there are a number of types of objects that the management pack monitors. Every management pack also includes object discoveries to find the specific objects on the network that are of the types monitored by the management pack. Under the object discoveries node you will see a list of all object discoveries in the management group.

    Rules
    Rules are like rules in MOM 2005, used to collect data and generate alerts. Rules can be used for a large number of reasons, the most common scenarios are:

  • Collect events from Windows event logs
  • Collect SNMP events, SNMP traps and SNMP Performance
  • Collect Windows performance data
  • Collect WMI performance data
  • Collect event and performance data from scripts
  • Alert on Windows events and/or SNMP traps
  • Tasks
    Tasks are used to run commands/action on managed machines. A great feature in OpsMgr 2007 is the possibility to combine run-as accounts with tasks. The default account for tasks are the action account.

    Views
    Views are groups of managed objects that have commonality, which is defined in the view properties. When you select a view a database query is made and the result of the query are displayed in the result pane. There are a number of views that you can access from the opertions console

  • Alert View (Display alerts that meet specific criteria, for example all SQL alerts)
  • Event View (Display events that meet specific cirtiera)
  • State View (Display relationship between components, computers and computer groups)
  • Performance View (View performance objects and counters, also historical operations data
  • Diagram View (View a praphical view of a set of objects and how they relate to each other)
  • Task Status View (Display tasks that meet specific criteria)
  • Web Page View (Displays a Web page)
  • Dashboard View (View any data that OpsMgr collect in two diffrent view types side by side on one window, for example logical disk state and logocal disk alerts.)
  •  

    Monitor file and directory size

    This script will monitor file and directory size. It will generate performance data back to the management server. You can view this information under performance view in Operators Console or/and in reports. This first example will monitor the size C:\pagefile.sys
    Set objFSO = CreateObject("Scripting.FileSystemObject")
    Set objFile = objFSO.GetFile("c:\pagefile.sys")
    CreatePerfData "File","File Size",objFile.Path,objFile.Size
    Sub CreatePerfData(strObjectName,strCounterName,strInstanceName,numValue)
        Set objPerfData = ScriptContext.CreatePerfData
        objPerfData.ObjectName = strObjectName
        objPerfData.CounterName =strCounterName
        objPerfData.InstanceName = strInstanceName
        objPerfData.Value = numValue
        ScriptContext.Submit objPerfData
    End Sub

    This example will monitor the size of all subfolders under C:\ 

    Set objFSO = CreateObject("Scripting.FileSystemObject")
    Set objFolder = objFSO.GetFolder("C:\")
    Set colSubfolders = objFolder.Subfolders
    For Each objSubfolder in colSubfolders
    CreatePerfData "File","File Size",objSubfolder.Path,objSubfolder.Size
    Next
    Sub CreatePerfData(strObjectName,strCounterName,strInstanceName,numValue)
                        Set objPerfData = ScriptContext.CreatePerfData
                        objPerfData.ObjectName = strObjectName
                        objPerfData.CounterName =strCounterName
                        objPerfData.InstanceName = strInstanceName
                        objPerfData.Value = numValue
                        ScriptContext.Submit objPerfData
    End Sub

    1. Insert the script as a new script in Administrator Console
    2. Create a event rule that run the script every X minute
    3. Commit configuration change and wait until the script has run
    4. Open Operator Console, click performance, click you server and choose your new FILE performance objects, click draw graph

    There is a guide about how to create performance data reports at momresources.org

    FAQ

    I have notice a couple of common questions in newsgroups and forums this week.

    Rule that will alert you if process X use more that Y % Processor Time
    In this example I will montor if iexplorer (Internet Explorer) takes more that 1 % processor time. Maybe not a very common scenario, but it will work to show you how to setup this for other processes and thresholds.

    First we need to create a new provider to collect the performance counter, and then an alert that will compare performance data and generates an alert. 

    1. Create a new provider in MOM 2005 Administrator Console
      Computer: or
      Object: Process (use “advanced” to enable this dropdown menu)
      Counter %Processor Time
      Instance: iexplorer (you might need to start that process before it shows up in the list)
    2. Create a new performance rule to compare performance data (threshold
      Provider:
      Schedule: Always process data
      Criteria: Leave default values
      Threshold: “Match when the threshold meet the following condition:” “greater than the following value: 1”
      Alert: Generate alert
      Alert suppression: Leave default settings
      Response: None
      Knowledge Base: Optional
      General: Input a name and verify that the rule is enabled 

    That should do it. Note that it can take a couple of minutes before the new rule is active.

     

    How do I see all members of a computer group?

    1. Start Operator Console
    2. Click public views
    3. Click computer groups
    4. Right-click a computer group and choose view -> computers

     

     

    Â