Monday, December 15, 2014

Create a Group containing all Computers hosting an Application

This sample is using SQL Server even if there is already a group (SQL Computers) available when importing the SQL MPs.

There is a link to the gallery if you’d like to download the sample MP at the bottom of this post.

Create a MP with a Group that contains all classes involved

This task is just in case that you’re not so familiar in how to find the proper class ID.

Create a new Group within a (new) MP:


Select all classes involved (here Windows Computers and SQL Engines):


The formula now looks like the following one and would show all Windows Computers and all SQL Engines what is not the target of this task:


Export MP and edit the MP (for instance using Notepad++).

Increase the MP Version

The next step is increase the version number to allow importing it again in your Management Group:


Optional: set default language

Move down to LanguagePacks.
Change isDefault to true for the language you’d like to use by default:

<LanguagePack ID="ENU" IsDefault="false">
should become
<LanguagePack ID="ENU" IsDefault="true">

Remove other languages if not needed.

Optional: cleanup the automatically created IDs

Search and replace the automatically generated IDs by something more readable, for instance:

should become

should become

Change the Group Calculation to include all SQL Servers

To change the group calculation just add the green marked lines, copy and paste the yellow marked class from the red section to the green one and remove the red marked ones:

<DataSource ID="GroupPopulationDataSource" TypeID="SystemCenter!Microsoft.SystemCenter.GroupPopulator">

Import the MP in SCOM

Save the XML and import it into SCOM

Check the Group

Under Authoring, Groups, search for the group and right-click to show all members:


The view should contain all computers hosting SQL monitored by your SCOM.


The sample MP from above can be found here:

All information is provided "as is" without any warranty! Try in lab before. Handle with care in production.
Read Full Post...

Monday, December 8, 2014

Correlated Missing Event Detection

Since it is not possible to drop more than 2 images into a forum reply I use my blog to provide the screenshot for a question there.

The original thread can be found here.

Under Authoring, Monitor, create a new unit monitor. Choose Correlated Missing Event Detection:


Enter a proper name and description and choose your target (Windows Computer would be all):


Select the event log for the event that resets your monitor back to healthy (if you’ve chosen event reset above):


Enter the event ID and the source. I took the single occurring of event ID 2 as a reset as a sample:


Choose the event log where the first event is logged:


Enter the event ID for the first event you’re expecting:


Choose the event log for the second event:


Enter the event ID for the second event you’re expecting:


Choose the correlation mode, here B must follow A within 60sec:


Select the missing event as warning and in the other as healthy (could be timer reset either):


Configure the alert settings as you’d like to see the alert in the alert views:



All information is provided "as is" without any warranty! Try in lab before. Handle with care in production.
Read Full Post...

Unable to copy new agent to this computer

Today I had an interesting one:

I had to update a lot of UNIX/Linux machines from 1.5.1-112 to 1.5.1-138 (shipped at the same time as SCOM 2012 R2 UR4). As expected a couple of machines did not update successfully. Unfortunately, a lot of machines had the status “Failed” – all but one with the Message “Unable to copy new agent to this computer” with the exit code “-1073479144”.

Before I wanted to discuss that situation with the UNIX team I wanted to try it again and during the next update wave just half of the machines ended up failed, the rest has been successful. So I tried again and again and after 5 iterations all machines (but one with another failure) have been updated without any other issue.

Conclusion: don’t give up when you see this error and try it again. Smile

All information is provided "as is" without any warranty! Try in lab before. Handle with care in production.
Read Full Post...

Tuesday, December 2, 2014

KMS MP for KMS running on WS2012

Unfortunately there is no KMS MP for WS2012. However, the existing MP for KMS on WS2012 works for KMS on WS2012 as well. And, of course, SCOM 2007 MPs work with SCOM 2012 (R2) either.

Just create a new string value "KeyManagementServiceVersion" with the value "dummy" (or anything else) under
HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform

After that the MP will discover the KMS. Just give it time (24h), restart the agent or override the discovery interval temporarily.

The “old” MP can be downloaded here:

All information is provided "as is" without any warranty! Try in lab before. Handle with care in production.
Read Full Post...