SCOM: Use Operations Manager Shell to close multiple Alerts generated by Same Rule

Hi,

When today i login in to my SCOM console I saw approx 134 Active Alerts about Microsoft SQL Job failure. I was about to close these alert but then one thing strike in my mind that lets try to close these alerts using “Operations Manager Shell”. These Alerts are generating from same source and the name of the alert is same to it would not be to hard. So let try.

Our First Step is to find out the Command which can show us Alert in SCOM Shell.

Open “Operations manager shell” and type  Get-Command *alert* , this will search for all SCOM cmdlets which have the word alert (we use wildcard *), and as you know PowerShell cmdlets works on Verb-Noun format  so if we use Get-Alert cmdlets it will shows all alerts.

Let Try Get-Alert

Type get-alert in the shell and hit Enter and it shown you all alerts.

Next task is to choose which Alert to Close .. if you look at active Alert in SCOM CONSOLE name of My Alert is “"A SQL job failed to complete successfully"

 

Now our next step is to find the properties and methods supported by Get-Alert command. To know these we need to use another command Get-Member

Yes.. it has name property…Gr8

Now we need to see all alerts whose name match “"A SQL job failed to complete successfully", for filter the output from Get-alert command we pipe (|) the output of Get-Alert command to Where-Object cmdlet.

Get-alert | Where-Object { $_.Name -match "A SQL job failed to complete successfully"}

 

This will show all alerts whose name matches with "A SQL job failed to complete successfully"

So now our next step is to find a cmdlet which can close these alerts. lets find out..  run the same command

Get-Command *alert*

So this time we have find Resolve-Alert cmdlet. now we need to join and our cmdlets command using piping . so this should be like this.

get-alert | where-object { $_.Name -match "A SQL job failed to complete successfully"} | Resolve-alert

in Get Alert we are searching for an Alerts | then we are filter then using Name with match to “Sql job Failure | and then we are resolving them.  now type the above command and hit enter. It will take sometime to do this.

When you command run successfully, open SCOM Console and search for same SQL JOB error and you will found nothing :)

 

I hope that it helps someone…

Thanks

Aman Dhally

Mystery of Blank Schedule Email Reports in SCOM

Hi,

After deployment of Reporting Server for SCOM we test the working of Reporting Server by generating few “Windows Generic Reports” manually and they works perfect. So we plan to schedule Reports for a weekly delivery on Emails. So that we can have the statistics of our server weekly.

So when we test schedule email reports in SCOM, but when reports arrives in an email they are with no data completely blank email with link to Reporting Server. Then we investigate on internet and found that this is a knows issue (KB:  http://support.microsoft.com/kb/972821) and we also found  the blog posting on Kevin Holman on the same Issue. (Please visit his blog posting  for more clarifications..click here )

So Lets try.

Step:1

Login to your SQL Reporting Server for SCOM

Navigate to default Reporting Server installation path and navigate to ”Reporting Services\ReportServer\bin”   and Open

“ReportingServicesService.exe.config” in notepad.

“C:\Program Files\Microsoft SQL Server\MSRS10.MSSQLSERVER\Reporting Services\ReportServer\bin”

 

 

Step:2

After opening “ReportingServicesService.exe.config”  we need to insert below code in to this file. The main issue is where to insert the Code.

 

To resolve this problem, add the following information to the ReportingServicesService.exe.config file in the ReportServer\bin directory: <dependentAssembly> <assemblyIdentity name="Microsoft.ReportingServices.ProcessingCore" publicKeyToken="89845dcd8080cc91" culture="neutral" /> <bindingRedirect oldVersion="9.0.242.0" newVersion="10.0.0.0" /> </dependentAssembly> <dependentAssembly xmlns="urn:schemas-microsoft-com:asm.v1"> <assemblyIdentity name="Microsoft.ReportingServices.ProcessingCore" publicKeyToken="89845dcd8080cc91" culture="neutral" /> <bindingRedirect oldVersion="9.0.242.0" newVersion="10.0.0.0" /> </dependentAssembly>

The Right Position of Correct code is below.

This XML section must be added in between <runtime><assemblyBinding…> and </assemblyBinding></runtime> statements of the \ReportServer\bin\ReportingServicesService.exe.config file.

 

After Insert the Code in to “ReportingServicesService.exe.config” . save the file and reboot the “SQL Server Reporting Service”

That’s all :) ..

BUT…

But i after doing that problem is still not resolved. We still getting Black Reports. Now No Clue what to do next.  Then i tried the Following. I open the File in “Notepad++” and formatted it, save the file and restart SQL Reporting Server.

Before Formatting

After Formatting

BingO.. this works for me … ( I know it doesn’t make any sense but it works) .. After done this my all schedule email reports works perfectly.

 

I hope that it may save some one else time ..

Thanks

Aman Dhally

SCOM: Event ID “33333” in SCOM from Source “DataAccesslayer”

Hi,
From past few days i am getting Event ID code “33333” from source “DataAccesslayer” in Operations Manager Log of my RMS. This events are generating in almost every minute.

The error is indicating about to “Enable "clr" configuration option” is SQL server

Text Error Code

Event Type: Warning Event Source: DataAccessLayer Event Category: None Event ID: 33333 Date: 31/05/2011 Time: 09:28:41 User: N/A Computer: Foo-BAR Description: Data Access Layer rejected retry on SqlError: Request: MTV_SelectProperty_b87e82bc-1a85-4de3-330a-13133cf5f9c3 -- (ManagedTypeId=994bdf28-10b8-52e4-3334-d65a63d9fe52), (IsDeleted=False), (RegExPattern0=(?i)^10.0..*), (RegExPattern1=(?i)^10.1..*) Class: 16 Number: 6263 Message: Execution of user code in the .NET Framework is disabled. Enable "clr enabled" configuration option. For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Solution:
I searched few website and finally I got the solution. The solution is to enable “CLR” option is “OperationsManager” database so that user codes in .NET can executes

To do this Connect to your SQL server and log in to SQL Server management Console.

Right Click the “OperationsManager” database and click on “New Query”

In “New Query windows” type the below code and then click on “Execute”

sp_configure @configname=clr_enabled, @configvalue=1 GO RECONFIGURE GO

 

 

In Message Pan you will see that it run successfully and “clr” option in changed from “0” to “1”.

After i done this, the error code “33333” not occurred again … 
source: TechNet
I hope it helps someone :)

Thanks
Aman Dhally

SCOM: "Failed Accessing Windows Event Log" Error

 Hi All,

Few days back I imported the DHCP Management Pack for SCOM. After importing I start getting Failed "Accessing windows Event Log" errors on Alert View of SCOM.





I Google and search internet and found that this is a BUG in DHCP Management Pack. In Monitored computer it shows the event ID 25002 and 25004

Thanks to Kevins Post who guide us what to monitor and what not to monitor on DHCP Servers
: Kevin Holman


To stop these error you need to Disable this alert using overrides.

To Override:  Right Click the Monitor, click on Properties .
click on Overrides and select "For all objects of class: health Service"

Choose Destination Management Pack. and change the value from "True" to override value "False"

 

and click on APPLY


















Now you can see that it disabled the monitoring of the Windows Event Log.

I hope this Helps

Thanks
Aman Dhally

SCOM: "DNS 2003 Monitor Zone Resolution Alert" Error

Hi All,

Few days back i imported the DNS Server management pack for SCOM 2007 , The version of DNS Server management pack is 6.0.6480.0





After importing DNS Management Pack after few days i got Alerts regrading "DNS 2003 Monitor Zone Alert" for one of my "Reverse Lookup Zone" subnet.





and when i check using Health Explorer it shows the following.



















The DNS 2003 Zone monitor use the following command to check the working of reverse zone.


NslookUp -QueryType=ns nameofzone dnsserver
for example
Nslookup -querytype=ns 168.192.in-addr.arpa 192.168.1.1

The default timeout of 360 seconds.

So troubleshoot the problem i did the following .

• Login to my DNS Server.
• Open DNS Console
• Expand Reverse Lookup Zone
• Right click on my Subnet for which SCOM was giving me the alert.

• Right Click on the subnet and click on Properties and then click on the NameServer tab
• Note: please note that how much time it take to load, in my environment it takes half an hour to load the name of name servers.

So in My Environment the culprit was "MY old removed domain controllers whose entries still not get removed"

And after cleaning my DNS entries, everything seems well :)


Hope this helps

Thanks
Aman Dhally