In the Notification and reporting for maintenance mode post we created a report for every object that is in maintenance mode. I did a update to that script today, instead of showing all objects that are in maintenance mode the report now only show computer objects. You can download the script MMReport.txt (rename to .ps1). As you can see on the last two lines in the script, the script is stopping it self. These lines are needed it you want to run the script from Orchestrator and the “Run Program” activity, else the activity will not finish and move on in the runbook.

$objCurrentPSProcess = [System.Diagnostics.Process]::GetCurrentProcess();
Stop-Process -Id $objCurrentPSProcess.ID;

If you want to run this in Orchestrator, for example every 15 minutes to generate a update maintenance mode report, you can use a “Monitor Date/Time” activity and then a “Run Program” activity. You can configure the “Run Program” activity with the following settings

•  Program execution
• Computer: FIELD-SCO01 (name of a suitable server with Operations Manager shell installed)
• Program path: powershell.exe
• Parameters: -command C:\scripts\MMreport.ps1
• Working folder: (no value)

Remember that your Orchestrator runbook server service account needs permissions in Operations Manager to get the info. With this sample script the output file will be C:\temp\MMreport.htm. Thanks to Stefan Stranger for PowerShell ideas.

Please note that this is provided “as is” with no warranties at all.

“Hello, is it IT support? My Internet is slow”

Have you heard that before? Last week a customer asked me if we could monitor how long it takes to download a file from a client workstation, and present it in a nice performance view in the Operations Manager console. Of course we can, with a script in a rule. The script downloads a file from Internet, measure the time it takes and reports it back to Operations Manager as performance data. You can control which machines that runs the script, so you cant select some workstations or machines in remote offices. If it takes more then 3 seconds it will generate a local event. If there is a problem downloading the file it will also generate a local event. You can configure Operations Manager to pickup this event and generate an alert. Thanks to Patrik the script can detect if the file we are trying to download is missing or if there are any other download related problems. I have attached the script I used, and below is the steps that you need to take to implement it.

To use this script, follow these steps

1. In the Operations Manager console, navigate to the Authoring workspace, right-click Rules and select Create New Rule
2. In the Create Rule Wizard, select to create a Probe Based/Script (Performance) rule, select a suitable management pack for example Contoso – Internet Download
3. On the Rule Name and Description page, input a rule name for example “Contoso – Internet Download – Download 20 Mb file”. Select a suitable target for example Windows Server. Uncheck the “Rule is enabled” box.
4. On the Schedule page, input how often you want to script to run. For example every 10 minutes
5. On the Script page, clear the script text box and paste the script from the attached file. Configure the timeout to 5 minutes. Change the script name to ContosoDownloadscript.vbs
6. On the Performance Mapper page, input
   • Object: 20MB.zip
   • Counter: FileDownload_Time
   • Instance: select Netbios computer name from the menu
   • Value: $Data/Property[@Name=’Contoso_PerfValue’]$
7. Create the rule

Now you have a rule target to all Windows Servers. But it is disabled. To control which machine that is running this, create a new group, save it in the same management pack (important!) and add some windows servers as explicit members. These machines will run the script and download the file.

1. In the Operations Manager console, navigate to the Authoring workspace, right-click Groups and select Create a new Group
2. In the Create Group Wizard, input a group name, for example “Contoso – Internet Download nodes”. Select the same management pack as you used before, in my case Contoso – Internet Download
3. On the Explicit Member page, click Add/Remove Objects
4. In the search for drop down menu, select Windows Server. Then in the name field input the machine or machines that you want to use as watcher node and add then under selected objects
5. Click next a couple of times in the wizard and then save and close it

To enable the rule against the machines in this group,

1. Find the rule again under Authoring and rules
2. Right-click it and select Overrides, Override the Rule, For a group, select your group
3. In the Override properties window, select enable and configure the override value to TRUE. Click OK to save.

The next step will be to configure a rule to pickup the event. These are the two events that you want to generate alert on

1. Navigate to Authoring workspace, right-click Rules, select Create a new rule…
2. In the Create Rule Wizard, select to create a Alert Generating Rule, Event Based, NT Event Log (Alert). Select the same MP again, in my case Contoso – Internet Download
3. On the General page, input a name, for example Contoso – Internet Download – Event rule. Select “Windows Server” as rule target. Uncheck the “Rule is enabled” check box
4. On the Event Log Type page, select Application
5. On the Build Event Expressen, input
   • Event ID Equals 2
   • Event Source Equals WSH
6. On the Configure Alerts page, click Alert suppression…
7. In the Alert Suppression window, select Event ID, Logging Computer, Event Source, click OK
8. On the Configure Alerts page, click Create

Now we need to enable this for the machines that we use as watcher nodes. As we created this rule with “Rule is enabled” unchecked, no machines is running it right now.

1. Find the rule again under Authoring and rules
2. Right-click it and select Overrides, Override the Rule, For a group, select your group
3. In the Override properties window, select enable and configure the override value to TRUE. Click OK to save.

The last step could be to create the performance view

1. In the console, navigate to the Monitoring workspace
2. Select the folder for your MP, in my case “Contoso – Internet download”. Right-click it and select New > Performance View
3. In the Properties window input
   • Name: Contoso - Download speed
   • Show data contained in a specific group: Select your group, in my case “Contoso – Internet download nodes”
   • Object: 20MB.zip
   • Counter: FileDownload_Time
4. Click Ok to save you diagram view

If you want to change the file that we download, or the destination folder, you need to modify the script and the lines highlighted below

If you want to change the default 5 seconds threshold on the download, you need to modify the following line

Download the script here, Internetdownload

I wrote a script to check only the last line of a file. The scripts checks the last line every time it run. If you search my blog you will find a number of script to read logfiles. Create a new two state script monitor where you include the script below.  In my example script I looks in the C:\temp\myfile.txt file for the word “Warning” ( varWarPos = Instr(strLine, “Warning”) )

• Unhealthy Expression
  • Property[@Name=’Status’] Contains warning
• Healthy Expression
  • Property[@Name=’Status’] Contains ok
• Alert description
  • You could write any alert description here, but if you include the following parameters you will see the whole line and the status in the alert description.
  • State $Data/Context/Property[@Name=’Status’]
  • Line $Data/Context/Property[@Name=’Line’]$

This is a script you can use to update resolution state. It will look at all new alerts (resolutionstate = 0) and see if the alert description contains “domain” or “AD”, if they do, the script will set a new resolution state. The ID for the resolution state can be found under alert settings in the administration workspace, in the Operations Manager console. You can schedule task to run this script every X minute to update all new alerts.

$RMS = “myRMSHost”

Add-PSSnapin “Microsoft.EnterpriseManagement.OperationsManager.Client”
Set-Location “OperationsManagerMonitoring::”
New-ManagementGroupConnection -ConnectionString:$RMS
Set-Location $RMS

$resState = 42 
$alerts = get-alert -criteria ‘ResolutionState =”0″‘ | where-object {($_.Description -match “AD”) -or ($_.Description -match “domain”)}
If ($alerts)  {
   foreach ($alert in $alerts)
   {
    $alert.ResolutionState = $resState
    $alert.Update(“”)
   }
  } 

The schedule task command can be

C:\WINDOWS\system32\windowspowershell\v1.0\powershell.exe -command C:\myscripts\change_resolutionstate.ps1

The following SQL queries can be used to first list which machine or path and then rules or monitors that generate most alerts in your environment. The first query will show you which computer or path that generate most alerts. The second query will show you which rule or monitor that generate most alerts on one singel machine or path. Run both queries against your data warehouse database (OperationsManagerDW).

 

 

You could also use these queries in a report, take a look at this post about author custom reports.

If you build a monitor to monitor a logfile, Operations Manager will remember which line it was reading last. Operations Manager will only look for new keyword below that line, it will not read the whole file again. I did a lot of tests with logfile monitoring, read more about them here. If you need to get Operations Manager to read the whole logfile each time, you can use a scrip like this:

 
Const ForReading = 1
Set oAPI = CreateObject(“MOM.ScriptAPI”)
Set oBag = oAPI.CreatePropertyBag()

Set objFSO = CreateObject(“Scripting.FileSystemObject”)
Set objTextFile = objFSO.OpenTextFile _
(“c:\temp\file.txt”, ForReading)

Do Until objTextFile.AtEndOfStream
strText = objTextFile.ReadLine

varWarPos = Instr(strText, “Warning”)
If varWarPos > 0 Then
varStatus = “Warning”
varLine = strText
End If

varCriPos = Instr(strText, “Critical”)
If varCriPos > 0 Then
Call oBag.AddValue(“Line”, strText)
Call oBag.AddValue(“Status”,”critical”)
Call oAPI.Return(oBag)
Wscript.Quit(0)
End If

Loop
objTextFile.Close

If varStatus = “Warning” Then
Call oBag.AddValue(“Line”, varLine)
Call oBag.AddValue(“Status”,”warning”)
Call oAPI.Return(oBag)
Wscript.Quit(0)
Else
Call oBag.AddValue(“Status”,”ok”)
Call oAPI.Return(oBag)
End If

This script will read the file (c:\temp\file.txt) line by line. The script is looking for two keywords in the logfile, “Warning” and “Critical”. If there is a “Critical” in a line the script will send back a bag with status=Critical and the script will stop. If there is a “Warning” in the line the script will continue, as there might be a “critical” somewhere too. If there was only “Warning” the script will send back status=Warning. If there was no “Warning” or “Critical” the script will send back status=ok.

If there is a “Warning” or “Critical” the script will also put that line into a bag, and send it back to Operations Manager. You will see this line in the alert description. To use this script, you can configure a monitor like this:

• Create a new monitor of type Scripting/Generic/Timed Script Three State Monitor. Input a suitable name and target. More about targeting here.
• Schedule
  • Configure your script to run every X minute. The script will rad the whole logfile each time
• Script
  • Filename and Timeout, for example CheckFile.vbs and 2 minutes
  • Paste the script in the script field
• Unhealthy expression
  • Property[@Name=’Status’]
  • Equals
  • Warning
• Degraded expression
  • Property[@Name=’Status’]
  • Equals
  • Critical
• Healthy expression
  • Property[@Name=’Status’]
  • Equals
  • ok
• Alerting
  • Check Generate alerts for this monitor
  • Generate an alert when: The monitor is in a critical or warning health state
  • Check Automatically resolve the alert when the monitor returns to a healthy state
  • Alert name: Input an alert name
  • Alert Description
    • State $Data/Context/Property[@Name=’Status’]$
    • Line $Data/Context/Property[@Name=’Line’]$

Summary: This monitor, including the script, will read a logfile and generate alerts based on keywords. In will read the whole logfile each time and look for two different keywords.