SCOM: Monitor a custom Services on Windows server 2003

Hi, All
Few days back I was trying to monitor a ISCSI service on my one of Windows Server. But I was not get succeed to do it. Then I post it on SCOM mailing list. With the Help of  Kevin Holman and his blog post i am able to get this done.

To Monitor a specific server we need to create a New Class for it  and then we need to write a Discovery rule for it. So that Discovery find that Target and then we can write desired monitoring or Alert rule on it.

For example I am going to Monitor Solarwinds TFTP Server installed on one of my server and going to monitor its service.

Tools Needed.

We need System Center Operations Manager 2007 R2 Authoring Resource Kit. You can download it from here 

Step: 1

After Installation Open SCOM Authoring Console and create and New Management Pack.
Type the Name of Management Pack. for example "solarwinds.Tftp.server

Now type Display Name for Management Pack and Type its description. for example display Name "Solarwinds TFTP Server" and then types its description.

Click on "Service Model" and select "Classes" and in detail pane , right click and select NEW and select Custom Class

Now give an Name to New Class. for example I am giving "TFTP Server"

In "General" tab click on "Base Class" and choose "Microsoft.windows.LocalApplication" and click on OK


In Display String  type name and description. Now Click on Apply and OK

Now click on "Health Model" and click on "Discoveries" , right click on detail pane and right click and select "New" then  "Custom Discovery"

Now choose an "Unique Identifier" for this discovery, I am giving its name "TFTP Discovery"

Select "General" tab and type Display Name , Description for Discovery and My service is running on Windows 2003 server so in Target choose "Microsoft.windows.Server.Computer"

click on "Discovery Classes" tab, in "Discovered classes and their attributes" click on "Add" and select "Add Discovered type"

Now choose "Solarwind TFTP server which we made previously" and click on OK

click on "configuration" tab and click on "Browse for a type"

I want to discover my Server using Registry value of its Computer Name, so we will choose  Registry to discover our server

Now Look for "registry" and choose Microsoft.windows.FilteredregistryDiscovery.Provider" and in Module ID type DS and click on OK

In "Schedule" tab choose the schedule to run, for demo purpose I am using 60 Seconds

I want to discover my computer using computerName registry key and its Value.
the location of this key is "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\ComputerName\ComputerName"

Now click on "registry Probe Configuration" and click on "Value" because we need to find computer by its Name.
In Propertied type "TftpExists" and in path type "SYSTEM\CurrentControlSet\Control\ComputerName\ComputerName\ComputerName"
and in "Attribute Type" choose "String"

Now click on "Expression" tab and click on "Insert"

In "Parameter Name" choose "TFTexists"

In Operator choose "Equals"

and in "Value" type your computer Name (shown as exact in the "computerName"  registry key)

click on "Discover Mapper" and in "Key property" choose "Display Name"

In "Non Key Properties" choose "Network Name"

Now click on "Apply" and then "OK"

Again , click on "Apply" and then click on "OK"

Now save your "Management pack"

Step: 2

Open SCOM Console, click on "Administration" and choose "Import Management packs"

click on "Add" and select "Add from Disk"

click yes on "Online Catalog Connection" to resolve dependencies if required.

Select your management pack file and click "Open"

click on Install

After successfully import of Management Pack , click on Close.

Step: 3

Now we need to see if this management pack is working or not and see if it discovered our Mentioned Server.

Now click on "Monitoring" in Action Pane click on "change target Type" in select item  select "Solarwind Tftp server" and click on OK

great !!! It have found our DC3 server. and status is "Not Monitored"

Step: 3

Now we have to write a rule to monitor service, so if service stop running it send an alert.

click on "Authoring" and right click on "Monitor" and click on "Create a Monitor" and select "Unit Monitor"

Select "Basic service Monitor" in windows services and choose the Management pack which we have imported before. click on Next

Type "Name" and "description" of the service and in Monitor target choose "Solarwind TFTP server2 and click on Next

In "Service name" click on browse and Type the Computer name on which services are running fro example "DC3-Foo" , choose the service to monitor for example "SolarWinds TFTP server Service" click on OK

So , If the service is running then Server is healthy and if the service is not running then the server is critical , so just click on NEXT

Click on "Generate Alerts" and then just click on Create...

currently Solarwind TFTP server Service is running so Server status is healthy.

Step: 4

Testing.

Lets Stop the "Solarwinds TFTP Service" on our DC3-Foo server and then see if it Alerts Us.

And the result is :

Yes It Works :-) 

Thanks 

Aman Dhally

SCOM: "Event Log ID 20070" on managed Computers

Hi,
Today I manually installed SCOM agent on one of my remote servers. After installation when i checked the status of that server it shown me unmanaged. I wait for 1 hours (i thought it may be a communication problem) but the the status was same.

Then i checked the EventLog of managed server and it showing me Event ID 20070  and 21016

which pointing to check the Event Log of the SCOM server and check for Event ID 20000

According to Event ID 20000 , A device which is not a part of this management group has attempted to assess this Health Service .... But this is not true , all my setting , including Management Group Name, Server name is correct.

At this point I have no idea what to do ... Then i did the following ..
I restarted the core services of SCOM server

And after restarting, everything seems fine :)

I hope this helps :)

Thanks

Take care

Aman Dhally 

SCOM: "Failed Accessing Windows Event Log" Error

 Hi All,

Few days back I imported the DHCP Management Pack for SCOM. After importing I start getting Failed "Accessing windows Event Log" errors on Alert View of SCOM.





I Google and search internet and found that this is a BUG in DHCP Management Pack. In Monitored computer it shows the event ID 25002 and 25004

Thanks to Kevins Post who guide us what to monitor and what not to monitor on DHCP Servers
: Kevin Holman


To stop these error you need to Disable this alert using overrides.

To Override:  Right Click the Monitor, click on Properties .
click on Overrides and select "For all objects of class: health Service"

Choose Destination Management Pack. and change the value from "True" to override value "False"

 

and click on APPLY


















Now you can see that it disabled the monitoring of the Windows Event Log.

I hope this Helps

Thanks
Aman Dhally