In MOM 2005 we could add advanced criterias and for example check if a event description included a special word, “matches wildcard”. In this post I will show you how to get the same feature in Ops Mgr 2007. I want an alert when a event with “unsucessfully” is written in the local event log.

I have create a simple vbscript that writes two events to a local event log. The event ID and source are the same, and the description is almost the same, but one event includes “unsuccessfully” and the other one includes “sucessfully”. Now I want to get an alert only when events with “unsuccessfully” a written in the local event viewer.

1. Start Ops Mgr Console, click Authoring
2. Right-click Rules and choose to create a new Rule, create a Alert Generating Rules/Event Based/NT Event Log (Alert)
3. Rule Type: Choose a suitable management pack to store your new rule, click Next
4. General: Input a name, description and choose a suitable target, click Next
5. Event Log Type: Choose which log, in my example events will be generated in the Application Log. Click next
6. Build Event Expression: in my example
   Event ID. equals. 0
   Event Source. equals. WSH
7. Click Insert and choose then “…” in the new parameter box. In “Select an Event Property” choose “Use parameter name not specified above” and then insert EventDescription , click OK
   setup the last parameter as
   EventDescription. Contains. unsuccessfully  , click Next
8. Configure Alerts: Configure a suitable alert, with some description. If you want the entire event shown in the alert description you can add $Data/EventDescription$. Click Create

You sometimes gets something like this in for example an alert

Affected monitor ID: AE311D41-D0C4-31B3-B2A1-E503E7226F42 Instance ID: 54321668-EFFA-411D-A511-3C6D9E119294 Management Group ID: 17F3B66F-8597-7BB1-35EE-F382AAF6B299

You then want to know the name of the monitor. Unfortunately the built-in advanced search tool in the console dont support searching on Monitor ID.  But you can run this SQL query in your OperationsManager database, it will give you bot monitor name and managementpack

SELECT Monitor.MonitorName, ManagementPack.MPName FROM Monitor INNER JOIN ManagementPack ON Monitor.ManagementPackID = ManagementPAck.ManagementPackID WHERE MonitorID = ‘X’

Replace X with the Monitor ID.

There is a lot of questions regarding ACS and gateway server. Microsoft Audit Connection Service (ACS) is a new function in Ops Mgr that can collect logs from machines. All logs are saved in a special Audit Collection database. You can then run reports against the database to see trends and do security analyzes. You can also for example trace a user activity over many systems. Gateway server is a server service that allow Ops Mgr to monitor machine within non-trusted domains or in workgroups, without lower the security.

I did some tests today about ACS and gateway servers. In my test I had regular Windows Server 2003 domain with Ops Mgr installed, I also had a Windows Server 2008 machine running in another domain that I wanted to monitor. Normal agent installation did not work as there is no firest trust between my domains and the 2008 domain is running Windows Server 2008 Functional Level. Is is no problem installing the agent on a Windows server 2008 machine that are in the same domain as Ops Mgr.I installed a Windows Server 2003 as a gateway (GTW) server and then I manually installed the agent on my Windows server 2008 machine. After that I enable audit collection from operations manager console. During the ACS enable wizard you must do a override and speciy a ACS collector, else the agent will try to forward all events to the gateway server.

 

 

Summary: There is no problem with ACS in a gateway scenario like this. Just remeber to direct your ACS forwarder (the agent) to send its event data to a ACS collector. One of the news in Ops Mgr SP1 is that ACS is now supported on the Management and Gateway server roles.

I saw an interesting blog post from the Operations Manager product team about Ops Mgr db and reporting running at Windows Server 2008 (Longhorn). Of course I wanted to test that and what is a better occupy on a winter day then try some new technologies.

 

I already had a Windows Server 2008 RC1 ENT X64 box running so I simple added the Hyper-V role. I installed a new virtual machines in Hyper-V, a virtual machine running 2008 RC1 ENT X64. There was no real issue during the setup of Ops Mgr. The blog post from the product team is pretty accurate about the SQL setup. But I didn’t do any changes to my applicationHost.config files as the blog post tells you to. I first did, but after a lot of trouble with SQL reporting I restored my original file and SQL reporting started to work. I install all components of Ops Mgr and then installed SP1 RC too. The only issue was the AcsConfig.xml permission issue, there is a KB about that problem here.

After I had installed Ops Mgr Reporting and also applied SP1 RC I had to re-run Reporting Services Configuration Manager. I had some problem with the encryption key and also the web service identity. My ReportServer application pool also reconfigured it self during the setup, so I had to reconfigure that application pool identity too in the IIS console. My Reporting configuration now looks like this

-Report Server Virtual Directory

• Name: ReportServer
• Website: Default Web Site

-Report Manager Virtual Directory

• Name: Reports
• Website: Default Web Site

-Windows Service Identity

• Service Name: ReportServer
• Service Account: NT Authority\LocalService
• Built-in Account: Local Service

-Web Service Identity

• ASP -NET Service Account: NT Authority\SYSTEM
• Report Server: ReportServer
• Report Manager: ReportServer

-Database Setup

• Server Name: OpsMgr
• Database Name: ReportServer
• Credentials Type: Windows Credentials
• Account Name: CORP\svc_dra (Data Warehouse Read Account)

-Execution Account

• Account: CORP\svc_dra

Later I had a problem when running reports, I recived “Value cannot be null, parameter name: GroupList”. The problem seems to be with the “Data Warehouse Main” data source. You can edit it from http://servername/reports. It is in the root and it is hidden, but if you click “show details” you will se it. The problem was that the connection string was blank and that the security settings was incorrect.

-Connection string

• data source=servername;initial catalog=OperationsMnaagerDW;Integrated Security=SSPI
  

-Connect using

• Credentials are not required

I have seen that issue in news groups before so I am not sure that has to do with Windows Server 2008. I think it is because I reconfigure the application pool and interrupt the encrypted content in SQL Reporting. 
Some word about working with Hyper-V.

Last time I tried Microsoft Virtualization was in some early beta of Windows Server 2008. Virtualization was not very fast in that version. But this version is really nice to work with, installing OS don’t take many minutes, I have tried Windows Server 2003 and 2008 as guests, both X64. I recommend you all you try it in your lab.

As you all understand this setup of Windows Server 2008 and Ops Mgr 2007 is not supported at all, so dont try this in your production environment.

This weekend I have been tinker with SNMP in Ops Mgr 2007. It is fairly simple to create performance views and alerts based on SNMP traps. This is a great way to take control and get a overview of network devices like for example switches. You can create both alerts and performance views based on SNMP. If you are not sure which OID to build your monitor and rules on, you can use a tool named AdRem SNMP Manager. It includes a number of functions to handle SNMP, download a evaluation copy here. Getif is a free multi-functional Windows GUI based Network Tool that I also recommend when working with SNMP, link.

 

 

I saw a question about how to view all overrides. Boris Yanushpolsky in the Ops Mgr product team at Microsoft has made a tool to work with overrides in Ops Mgr 2007. With this tool you can easy browse overrides based on type or computer. Download the tool here. If you dont want to do it with a extra tool or if you want to include it in some kind of script, you can list overrides with command shell too,

get-managementpack | get-override

I saw a question from a engineer who recived a number of notifications about the same alert from different notification subscriptions. The questions was how to track down which subscription sending these notifications from the subscription ID. You can do that with Command Shell. Run

get-NotificationSubscription | where {$_.ID -like “subscription ID”}