Hi All,
The forensic report for user captures events 4724 (Password reset) and 4767 (account unlock). But it doesn’t capture who did it.
This information is part of the native event on the DC but is missing in the forensic report.
I'm not understandinng the value of string01, string02...etc...pls help me with it.
Thanks,
Sameer
Hi,
We have a customer running a couple of clusters "LinuxCluster" and "WindowsCluster". The issue I have is that only the "LinuxCluster" CSV are discovered/shown in the view "Microsoft Windows Hyper-V Extensions 2012 R2>Cluster Shared Volumes State"
I have also looked under "Microsoft Windows Server>Health Monitoring>Cluster Shared Volumes Health" and its only showing the "LinuxCluster" volumes.
I am running version 6.0.7230.0 version of the cluster MP and 7.1.10140.0 of the Hyper-v MP and 1.0.1.282 of the Hyper-V Extension MP (I believe these are all the latest versions).
I have checked and the discover rule "Cluster Shared Volume Discovery" and it is enabled by default with no overrides applied.
I have verified this by running the below command.
PS C:\temp> get-scomclassinstance -class (Get-SCOMClass -displayname "Cluster Shared Volume") HealthState InMaintenanceMode DisplayName ----------- ----------------- ----------- Success False T2_DEV_OS_03 Success False T1_PRD_OS_06 Success False T2_LIN_ISO Success False T2_DEV_OS_04 Success False T2_DEV_DATA_04 Success False T1_PRD_DATA_06 Success False T1_PRD_OS_07 Success False T1_PRD_OS_05 Success False T1_PRD_DATA_05 Success False T2_DEV_DATA_03 Success False T2_LIN_TEMPLATES Success False T1_PRD_OS_08 Success False T1_PRD_OS_10 Success False T1_PRD_OS_09
I have also checked that agent proxy is enabled on all agents.
What I have found interesting is that in the "Administrators" Tab under "Agentless Managed" the LinuxCluster is reported as "Healthy" but the "WindowsCluster" is reporting "Not Monitored"?
Any suggestions for troubleshooting this?
Cheers,
Martin
Blog:Note: Posts are provided “AS IS” without warranty of any kind, either expressed or implied, including but not limited to the implied warranties of merchantability and/or fitness for a particular purpose.
Hi All,
I need to create a report that will be sent out by 6AM everyday to a DG. The report needs to show the Health / State of selected Application Pools, Sites, and Windows services running on ~20 production servers. The servers show up in SCOM just fine. ('Application Pool State', 'Web Site State', etc.) I can see what I need in the Monitoring view, but did not find a way to create the report I need in Reporting or Authoring.
I've looked through the documentation and the forums and have not found what I need...at least I don't think so. I just did not see how I can capture the Health/State at a specific time for the selected Objects and send out the results.
Seems like this would be a common request. Basically, we just need to know that our web applications are running before the start or business, without manually logging in to each server and typing a report.
I've scripted some of what we need with WMI/PowerShell, and piped out to an email. The problem is that several of our servers our locked down or don't have the appropriate components installed to work with remote scripting. (don't ask...life in a
big corporation!)
Since we have SCOM installed throughout the network, I am hoping it will get us the info we need. Any help or ideas would be very appreciated!
Thanks in advance!!!
~ noob
Hi, this is driving me crazy. I have 2 scripts for putting a server in and out of maintenance mode. I am sure it is something simple but I can't figure it out. Basically if I see a specific event log entry I capture the server name and time and put the server and all components in maint mode for x time. If I see another event log entry I note the server name and take it out. Now this all works except the server stays "Not monitored" when I end Maintenance Mode. The Server and all classes monitored stay "Not monitored"
Any help would be much appreciated.
PS SCRIPT TO PUT SERVER IN MM
param($rootMS,$mmserver,$mmmins)
Import-Module-NameOperationsManager
$instance=Get-SCOMClassInstance-Name$mmserver#load server to maintmode
if ([int]$mmmins-lt5) {$Time= ((Get-Date).AddMinutes(10))}# 5 minute minimum. If <5 make 10 mins default
else {$Time= ((Get-Date).AddMinutes([int]$mmmins))}
Start-SCOMMaintenanceMode-Instance$Instance-EndTime$Time-Reason"PlannedOther"
Write-EventLog-LogName'Operations Manager'-Source'SCOM Maintenance Mode' -EntryTypeInformation-EventId1 -Message'Scripted Maint Mode started'
PS SCRIPT TO TAKE SERVER OUT OF MM
param($rootMS,$mmserver,$comment)
Import-Module-NameOperationsManager
$instance=Get-SCOMClassInstance-Name$mmserver#load server to maintmode
$mmentry=Get-SCOMMaintenanceMode-Instance$instance#locate server in maintenance mode
$newendtime= (Get-Date).AddMinutes(1)#end maintmode, sends end time of 1 minute
Set-SCOMMaintenanceMode-MaintenanceModeEntry $mmentry-EndTime $newendtime-Comment"Stopping scripted Maintenance Mode"
Write-EventLog-LogName'Operations Manager'-Source'SCOM Maintenance Mode' -EntryTypeInformation-EventId1 -Message'Scripted Maint Mode finished'
I have an issue with setting up a new 2007 R2 SCOM Gateway Mgmt Server. The Root Mgmt Server is running Windows 2003. This new Gateway Mgmt Server I'm trying to setup is running Windows 2008 R2. I've followed the steps listed here: http://technet.microsoft.com/en-us/library/dd789059.aspx and all seems fine - meaning, the SSL cert used for gateway client communication (including cert chain) imported successfully, the Gateway Server was approved and shows up as a Mgmt server in the SCOM Mgmt console.
However I'm receiving OpsMgr Connector errors (eventid 21001 and 210057) on the new Gateway server every 15 minutes and when the 'System Center Management' service is restarted, I receive this error message;
Log Name: Operations ManagerThe SSL cert (and chain) used has been working fine for years throughout the environment and I know it's specific usage includes these two types ("Digital Signature" & "Key Encipherment"). The only twist in this is that, the certificate was originally created and signed by our Windows 2003 CA some years ago. That CA has since been migrated to Windows 2008 R2. I don't necessarily think that has anything do to with this issue but I'm out of other ideas.
Has anyone else seen where this scenario with upgraded CA may have any merit?
How do I remove and active alert which has become 'orphaned'.
The alert states "An object of type MonitoringAlert with id fafa7d12-9c26-458f-bb14-cee7b1690ffb was not found.
The Message body is as follows :-
Note: The following information was gathered when the operation was attempted. The information may appear cryptic but provides context for the error. The application will continue to run.
Microsoft.EnterpriseManagement.Common.ObjectNotFoundException: An object of type MonitoringAlert with Id fafa7d12-9c26-458f-bb14-cee7b1690ffb was not found.
at Microsoft.EnterpriseManagement.ManagementGroup.GetMonitoringAlert(Guid id)
at Microsoft.EnterpriseManagement.Mom.Internal.UI.Cache.AlertPropertySet.GetObject()
at Microsoft.EnterpriseManagement.Mom.Internal.UI.AlertDetailPaneController.GetDetailContent(DetailContextUpdate detailContextUpdate)
at Microsoft.EnterpriseManagement.Mom.Internal.UI.DetailPaneControllerBase.GenerateDetailContentJob(Object sender, ConsoleJobEventArgs args)
at Microsoft.EnterpriseManagement.Mom.Internal.UI.Console.ConsoleJobExceptionHandler.ExecuteJob(IComponent component, EventHandler`1 job, Object sender, ConsoleJobEventArgs args)
Any ideas on how to clean up this event would be most appreciated.
SCOM Version 2007 R 2
Hello,
What is the most good and safe way to upgrade windows operating system while SCOM is installed with high availability?
I have SCOM 2012 SP1 and windows 2008 R2.
I want to upgrade to Windows 2012 R2.
Do you have a best practice solution?
Thanks.
TechNet
Recently we have deployed the scom 2012 r2 with ur 4 and integrating with the scvmm 2012 r2 updated ur4 when we connect the PRO feature of scvmm we got the below error so kindly tell us the solution of it. We have already deployed the required MP on Operations Manager
Error (10218)
Setup could not import the System Center Virtual Machine Manager Management Pack into Operations Manager server because one or more required management packs are missing. The VMM Management Packs cannot be deployed unless the following component management packs are present in Operations Manager :
Windows Server Internet Information Services 2003,
Windows Server 2008 Internet Information Services 7,
Windows Server Internet Information Services Library,
SQL Server Core Library.
Recommended Action
To provide the missing component management packs, ensure that the following management packs have been imported into Operations Manager server:
Microsoft Windows Server 2003 Internet Information Services Management Pack for OpsMgr 2012 (version 6.0.6278.0 or later)
Microsoft SQL Server 2005 Management Pack(version 6.0.5000.0 or later)
You can download the management packs from the System Center Operations Manager Catalog athttp://go.microsoft.com/fwlink/?LinkId=86411
Dear Experts,
I have moved some SQL Cluster servers from SCOM 2007 R2 to SCOM 2012 SP1 along with some Exchange 2007 servers, After SCOM 2012 agent installed on those machines I am getting the following alerts regularly from the SCOM.
Also these servers health status showing 'Warning' state
Alert: Run As Account Cannot Log On Locally
Source: LXXXXXXX.XXXX.XX
Path: LXXXXXXX.XXXX.XX
Last modified by: System
Last modified time: 1/7/2015 9:03:59 AM
Alert description: The Run As account needs to have the "Log On Locally " right.
Can you please help me to resolve this issue.
Saravana Raja
XV
I only have one server at present (a beefy one) for testing SCOM 2012 and with just 10 servers being monitored and only the AD, SQL, and Task Scheduler MP's installed, already the RMS is complaining that the Threshold for theHealth Service Handle Count is over the top.
Is this a case of simply adjusting the threshold from 6000 to a higher number?
If so, what is the magic number pls?
Thx very much,
John Bradshaw
Hi
Can i help me about schadule reporting in scom 2012:
I want that to give downtime report from scom 2012? how?
I recently via in generic report / health report is this true?
How to calculate MTTR & MTBF?
thanks
We have a fresh install of SCOM 2012 R2 (on Server 2012 R2) which is continually providing the above error when trying to view any content in the web browser (details pane). The navigation pane appears fine.
I have:
-Changed the AppPool to .Net v2.0
-Amended the authentication by turning off kernel-mode authenticaiton and then adding Negotiate:kerberos as a provider and setting it to the first choice
-Given the everyone group full access to "C:\Program Files\Microsoft System Center 2012 R2\Operations Manager\WebConsole" just in case it was file permission issue
-Uninstalled and reinstalled the WebConsole from the server
-Updated SCOM to RU4
None of the above has changed anything. I am at a loss as to what is causing this error and any help will be appreciated.
ACS could collect windows security event log but could not collect SQL audit log by default.
but if we configure SQL 2008 to write its log to windows security event log, ACS could collect these logs and produce reports, right?
Do we need any customization of SCOM for this? Thanks.
I know this error has been covered many times, and on many topics, but this time mine is slightly different. It'sNOT the "SCOMpercentageCPUTimeCounter" error covered by Kevin Holman.
Also, I am running SCOM 2012 R2 UR4 (7.1.10226.1046) and everything seems correctly patched (MS and agents), like suggested by Nicole Welch and Kevin Holman as well.
So my environment is a fresh installation of SCOM 2012 R2, and I am transferring to this new Management Group, the monitored servers from our old SCOM 2012 "R1" (which I did not upgrade but rather made a brand new independent install). So all servers aren't migrated yet, but I would like to solve this error before. This error did NOT happen in "R1", nor was it overridden (I imported the exact same Management Packs anyway).
On 2012 R2, it happens on almost all new monitored machines, mainly Read-Only Domain Controllers (RODCs).
Here is the kind of alert text I am getting:
Het om 10:10:15 gestarte proces is beëindigd als gevolg van een uitvoerverzamelfout als gevolg van fout 0x80070057 :
The parameter is incorrect.
; mogelijk zijn er gegevens verloren gegaan.
Opdracht die is uitgevoerd: "C:\Windows\system32\cscript.exe" //nologo "C:\Program Files\Microsoft Monitoring Agent\Agent\Health Service State\Monitoring Host Temporary Files 193\24788\AD_Global_Catalog_Search_Response.vbs"
RODC02.mydomain.be (objectCategory=DMD) false 4 {9E253FCB-8AAF-491F-CCA3-E632C6C2800C}
Werkmap: C:\Program Files\Microsoft Monitoring Agent\Agent\Health Service State\Monitoring Host Temporary Files 193\24788\
Dit is van invloed op een of meer werkstromen.
Werkstroomnaam: Microsoft.Windows.Server.2008.AD.DomainController.GCSearchTime.Monitor
Exemplaarnaam: RODC02
Our servers have Belgian (Dutch) regional settings, hence the language. But check out the highlighted info in bold.
The related event Number (in Alert Context) is 21404. Most other articles about this, mention 21402 or 21403. I suppose they all must be related but still, it's a new one here.
There you have the failing VBS file. I checked all alerts and there seem to be different files concerned overall. Other examples:
Repeat count of the alert is 1 to 2 a day, so it's not nightmareish, but still, requires to be fixed. I suspect that even if there is a different VBS file concerned, since the eventID and the alert text are the same, the repeat count will just increase, not showing the last actual VBS concerned.
I connect to each of these servers, and browse to the directory containing the file, and the folder is there, the file is there. The error text mentions incorrect parameters but they still seem OK to me.
I found something which might be worth noting: when browsing to the directory, be it on an RODC or on the SCOM server, I get a permission popup requiring some admin rights to do so - although I am using my domain admin (+SCOM+SQL+local admin everywhere) account:
SCOM services use the Local System account to run, on every machine. I thought Local System shouldn't be concerned with these permissions popups, but normally the domain/local admins aren't either, yet I am.
The "Health service" folder is the only one from the "C:\Program Files\Microsoft Monitoring Agent\Agent" folder to be concerned with this; I can browse without trouble to any other directory there.
After a SCOM service stop, I renamed the "Health Service state" folder (as you can see on the screenshot, there is a "Health Service State bak" folder) and let the service recreate it after a restart, to ensure it was clean and with appropriate permissions , but it doesn't help.
Might that be a clue?
Or else what? I'm getting confused and don't find a suitable solution.
Bix
Hi,
When I spy under Monitoring/Dell/State Views/CMC, there are a number of components that have the OPEN Circle, indicating they are not being monitored.
We wish to activate a specific one, the Dell Chassis Power Supply Group.
Any idea how to get the little Green Tick for this, so it is monitored?
Thx,
John Bradshaw
Hello everyone,
I have asked this question couple of months ago as well.
Have anyone noticed scom scheduler is not following the defined intervals.?
I am using rules carrying vbscript to run on specific server class. Used simple recurring scheduler.
Set interval to every 8 hours or 12 hours. It worked fine for few days.
Now I am able to see that the script ( which has debug event logging in opsmanager log) is running every x (random number ) of mins. Ideally it should be running at the given intervals.
Any pointers how to fix this?
Thanks
Manish