Hello,

  I was wondering if a Wildcard SSL Cert from GoDaddy or another Provider can be used to monitor Non-Domain Computer on SCOM 2012R2?

TIA,

Jim

I'm trying to create a rule to which generates an alert, email, when say an account gets locked out. In a test I was able to create a  rule based on event ID: 4740 and the alerts appeared. So now I want to include the following events in this rule:

Event ID: 4720, 4722, 4723, 4724, 4725, 4726, 4738, 4740, 4765, 4766, 4767, 4780, 4781, 4794, 5376, 5377. 

All of these fall under the User Account Management category so any of these events generated should kick off an alert. 

I create the rule with the multiple events, link it to a custom MP, and to Windows Computer. In addition I create a new channel and subscription. I gets nothing. If I remove the multiple ID's and leave just one, say 4740, then I get emails. 

Is it not possible to group multiple Event ID's? 

Guys,

I am working on a SCOM 2012 design. The primary concern is to make SCOM a highly available solution.

Environment:

• Two data centers (suppose DC1 and DC2), away few KM from each other. Good network connectivity. Network latency less than 2ms.
• SQL 2102 AlwaysOn to host OperationsManager database. One node in DC1, other secondary node in DC2.
• Separate SQL server to host data warehouse database. No SQL failover
• Separate SQL Server+SSRS to host SCOM Reports. This will also have Web Console (optional)
• 4 Management Servers (MS). 2 in each data center, member of two resource pool (RS). One RS for each data center.
• 4 Gateway. 2 in each data center to monitor untrusted domain agents.

For OperationsManager database, I am using SQL 2012 AlwaysOn (two node, automatic failover).

1. Should I make OperationsManager database on secondary node readable or not? If I make it readable, will it have any impact on SCOM performance etc.
2. Both SQL nodes will be in two different data centers (few KM away from each other). The network is very good, high bandwidth and latency is less that 1 or 2 ms. I assume that both nodes will perform okay and shouldn't be an issue?

Data warehouse database will be hosted on a separate SQL Server. It is expected that the size of this database will be grown to 1TB in a year. I am proposing to not make it part of any SQL cluster (either AlwaysOn or traditional SQL cluster) due to the limitations of the hardware availability. Question:

• Does data warehouse database provide real-time data? documentation says it will keep both historical and real-time data. But I've seen few posts where people says it takes about 2hours to aggregate the data then show in the report. We want to write few reports to get real-time data every few minutes, is it possible to get it from DW or from Operations DB?
• In case of disaster, if Data warehouse SQL server dies, I assume that the SCOM will still work because OperationsManager database is hosted separately. In other words, in my opinion data warehouse is not critical for basic SCOM operations like receiving alerts or monitoring agents (other than reporting). Please correct me if I am wrong.
• If above is correct, and we rebuild the server, restore data warehouse database from backups with in 7 days, I assume that the data from OperationsManager database will be put in the data warehouse db. So end result will be that no data loss in data warehouse database. Correct or not?
• SCOM Reports will be hosted on a 3rd server, separate to data warehouse. If data warehouse SQL server is down, it will only impact the reports availability, all other operations will work okay?

For management servers, I am suggesting to put two MS servers in each data center i.e. two MS in DC1 will be part of one resource pool and two MS in DC2 will be part of second resource pool.

• What is the best way to provide failover for MS - with in data center and across? Should I create one resource pool or 2 pools having 2 MS in each?
• Agents in DC1 will talk to resource pool 1 in its own data center. Agents in DC2 will talk to the resource pool 2. My assumption is that 2 MS in each data center will provide automatic failover with in data center?
• I assume that we can assign one resource pool as primary to agents and another as failover? i.e. in case both MS servers in one data center goes down, agents will talk to MS in other DC???
• Same as above, connectivity between both data center is very good and network latency is less than 2ms (maybe less than 1ms). Will there any be any issue with the communication between MS servers across data centers? I read lot of post opposing this solution but in most cases the mentioned only about network latency - in my case it is below 2ms.

SCOM Report Server will be installed on separate SQL server hosting SSRS. The Web Console will also be installed on this server.

• If this server goes down, I believe it will only impact on reports availability. Correct?
• Any known issues putting SSRS, Reports and Web Console on same server? To me I don't see any.

Same as MS server, we are putting two Gateway (to manage agent in un-trusted domain) in each data center, providing local failover capability to agents and across data center in case of a disaster.

• Same as MS Resource pool, can we create and assign two resource pools for gateway servers in each data center? Will this provide failover mechanism with in data center and across data center?

Thanks in advance :)

-- S Ahmad

Hai,

Anyone please help me. How to configure the alert mail when CPU Utilization is High as above certain %. Without any Tool, how to generate the report.

We are using SCOM 2012 SP1 and our monitoring(L1) team is updating the alert history after acknowledging the alert through the web console. For some of the L1 team engineers, the comments updated in alert history did not show up after saving it. 

As a Work around, they have to log off and login into the Web console and update the comments to persist the comments in alert history.

Appreciate if anybody guide me in right direction to resolve this issue.

Thanks

Syed Musaib

SCOM version: 2012 R2 RU3

Our SQL guys have gone out and purchased SpotLight and want to use it as the primary for monitoring and alerting on SQL at the database and instance level on "select" servers. So instead of SCOM monitoring, lets say all 6 databases on a SQL server, it monitors 3 and Foglight monitors the remaining 3.

I see where I have the ability to start maintenance mode on select databases and need to know if this is the preferred practice? If not what are my options.

Any responses appreciated.

I know this error has been covered many times, and on many topics, but this time mine is slightly different.   It'sNOT the "SCOMpercentageCPUTimeCounter" error covered by Kevin Holman.

Also, I am running SCOM 2012 R2 UR4 (7.1.10226.1046) and everything seems correctly patched (MS and agents), like suggested by Nicole Welch and Kevin Holman as well.

So my environment is a fresh installation of SCOM 2012 R2, and I am transferring to this new Management Group, the monitored servers from our old SCOM 2012 "R1" (which I did not upgrade but rather made a brand new independent install).  So all servers aren't migrated yet, but I would like to solve this error before. This error did NOT happen in "R1", nor was it overridden (I imported the exact same Management Packs anyway).

On 2012 R2, it happens on almost all new monitored machines, mainly Read-Only Domain Controllers (RODCs).

Here is the kind of alert text I am getting:

Het om 10:10:15 gestarte proces is beëindigd als gevolg van een uitvoerverzamelfout als gevolg van fout 0x80070057 : The parameter is incorrect.
; mogelijk zijn er gegevens verloren gegaan.

Opdracht die is uitgevoerd: "C:\Windows\system32\cscript.exe" //nologo "C:\Program Files\Microsoft Monitoring Agent\Agent\Health Service State\Monitoring Host Temporary Files 193\24788\AD_Global_Catalog_Search_Response.vbs" RODC02.mydomain.be (objectCategory=DMD) false 4 {9E253FCB-8AAF-491F-CCA3-E632C6C2800C}
Werkmap: C:\Program Files\Microsoft Monitoring Agent\Agent\Health Service State\Monitoring Host Temporary Files 193\24788\

Dit is van invloed op een of meer werkstromen.

Werkstroomnaam: Microsoft.Windows.Server.2008.AD.DomainController.GCSearchTime.Monitor
Exemplaarnaam: RODC02

Our servers have Belgian (Dutch) regional settings, hence the language. But check out the highlighted info in bold.

The related event Number (in Alert Context) is 21404. Most other articles about this, mention 21402 or 21403. I suppose they all must be related but still, it's a new one here.

There you have the failing VBS file. I checked all alerts and there seem to be different files concerned overall. Other examples:

• C:\Program Files\Microsoft Monitoring Agent\Agent\Health Service State\Monitoring Host Temporary Files 233\22737\AD_Database_and_Log.vbs    (from almost all RODCs)
• C:\Program Files\Microsoft Monitoring Agent\Agent\Health Service State\Monitoring Host Temporary Files 196\19876\Microsoft.Windows.Server.Legacy.FreeSpace.vbs  (also from an RODC)
• C:\Program Files\Microsoft System Center 2012 R2\Operations Manager\Server\Health Service State\Monitoring Host Temporary Files 5891\338282\Microsoft.Windows.Server.CPUUtilization.Monitortype.vbs 95 15
  SCOM02.mydomain.be 1.4119384288787842     (this one is from my second Management Server..)

Repeat count of the alert is 1 to 2 a day, so it's not nightmareish, but still, requires to be fixed. I suspect that even if there is a different VBS file concerned, since the eventID and the alert text are the same, the repeat count will just increase, not showing the last actual VBS concerned.

I connect to each of these servers, and browse to the directory containing the file, and the folder is there, the file is there.  The error text mentions incorrect parameters but they still seem OK to me. 

I found something which might be worth noting:  when browsing to the directory, be it on an RODC or on the SCOM server, I get a permission popup requiring some admin rights to do so - although I am using my domain admin (+SCOM+SQL+local admin everywhere) account:

SCOM services use the Local System account to run, on every machine. I thought Local System shouldn't be concerned with these permissions popups, but normally the domain/local admins aren't either, yet I am.

The "Health service" folder is the only one from the "C:\Program Files\Microsoft Monitoring Agent\Agent" folder to be concerned with this; I can browse without trouble to any other directory there.

After a SCOM service stop, I renamed the "Health Service state" folder (as you can see on the screenshot, there is a "Health Service State bak" folder) and let the service recreate it after a restart, to ensure it was clean and with appropriate permissions , but it doesn't help.

Might that be a clue?

Or else what?  I'm getting confused and don't find a suitable solution.

Bix

How would I monitor for the disk space. Currently I have basic installation of SCOM 2012 r2 and I have couple MP’s installed “Windows Server 2008 \2012.”

If disk 10% free create a warning alerts.

If disk 5% free create a Critical alerts.

Each drive can be different thresh hold for alerting like..

C is 10 % and 5 %

D is 15 % and 7%

E is 20 % and 10%

- Would it be possible to disable every alert and get alert only what we want to monitor. How ? ( like how to disable things monitored automatically when we deploy MP’s )

- Do we need to create a new MP or can we use old one how do that only for Disks / CPU / Mem. Where would I created that and it will be deployed to what so every server is monitored.

- How would I make sure no other alerts set for Disk monitoring or can we change those or better of creating new MP ( specially by default)

- How would you know the disk thresh holds applied to all server which are in same Management server resource pool .

- How would I create the exception for some server where 5% or 10% may not be an option. Like could be 20% or 2 %.

- If I want to do monitoring by Free GB instead of 5% or 10% where would I change and can make this change any time.

- When I am creating the 5% 10% How I know where its applied and which server being monitored.

- After configuring the setup is there a way do the test like can we fake the disk size to generate the alert.

Thanks in advance for all your help !!

Ann



Hello,

I want to replace my primary management server.

Do i need to do the following steps if i have SCOM 2012??

https://technet.microsoft.com/en-us/library/cc540401.aspx?f=255&MSPPError=-2147217396

1. Promote a management server to a root management server role
2. Configure the reporting server with the name of the new root management server.
3. Configure the Web console with the name of the new root management server.
4. Set ENABLE_BROKER to 1 if needed

Thanks!



TechNet

Hi

I went to the Microsoft site and not able to find the ADDS 2012 R2 mp for SCOM 2012 R2. It looked strange to me

I went to the http://www.microsoft.com/en-us/download/details.aspx?id=21357 site and extracted the file and file contains the mp file for 2003 and 2008.Is something i am missing or someone can share the download link for ADDS 2012 R2 mp?

Donald D'souza (http://donald-scom.blogspot.com/)

Hi,

We are currently experiencing constant high CPU usage from MonitoringHost.exe on one of our servers.

The monitoringhost.exe is constantly using 50% of CPU resources, the server is a dual core so it's pretty much hogging one CPU the whole time.

Server

OS: SBS 2011 Std

CPU: Intel CPU dual core @2GHz

RAM: 10GB

The server has got SCOM 2012 R2 gateway/agent installed on it.

I've seen articles where the same issue affecting server 2008 and predecessors and is fixed by updating to msxml 6 however it's not the case.

I've tried to clear health state cache, reinstalled gateway, reboot server, install all available updates in Windows Updates but problem is still there.

Any help would be much appreciated.

Thanks.

Kind Regards,

John

I have SCOM 2012 R2 and I have the console installed on a 2012 R2 remote desktop services server. However whenever I click on an alert and try to view the alert details it prompts for a file download of a MHT file instead of rendering it in the Alert Details section of the console.

How do I resolve this?

I have a couple of questions on SCOM 2012 SDK usage:

1. In SCOM 2012 SDK, GetMonitoringAlerts API has various overloads that allow user (client) to filter alerts by properties, management class etc. but I do not find a way to filter the alerts by management pack.

I can achieve it by enumerating classes in a management pack and then querying alerts for each class, but this would result in a lot of calls to management server. I wanted to check if there's a easier way to perform this operation.

2. I do not see any support for sorting/paging alert data, does the SDK support server side sorting/paging of data?

Thanks in advance!

Himanshu

In this URL link, it says there are no updates to Orchestrator.

http://support2.microsoft.com/kb/2992012/en-us

But if you go here for Cumulative Update 3, to System Center R2 there is an update.

http://support.microsoft.com/kb/2965090

---------------

My question now is, if you have base System Center 2012 R2, do you have to apply CU1, CU2, CU3, and CU4 in that order to get all your updates ?

Hi,

I'm running SCOM and VMM integration. For the most part everything is working. However I get lots of alerts generated in regards to my scvmm server.

This is a the guide I used: https://technet.microsoft.com/en-ca/library/hh882396.aspx

SCOM + VMM 2012r2 Ur4

One of the Errors(which appears to be root issue):

The PowerShell script failed with below
exception

System.Management.Automation.CmdletInvocationException: VMM is
unable to perform this operation without a connection to a Virtual Machine
Manager management server. (Error ID: 1615)

Use the Get-VMMServer cmdlet
or the -VMMServer parameter to connect to a Virtual Machine Manager management
server. For more information, type at the command prompt: Get-Help Get-VMMServer
-detailed.At line:109 char:12
+ $vmm = Get-SCVMMServer $VMMServer -Credential
$cred;
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
at
System.Management.Automation.Internal.PipelineProcessor.SynchronousExecuteEnumerate(Object
input, Hashtable errorResults, Boolean enumerate)
at
System.Management.Automation.PipelineOps.InvokePipeline(Object input, Boolean
ignoreInput, CommandParameterInternal[][] pipeElements, CommandBaseAst[]
pipeElementAsts, CommandRedirection[][] commandRedirections, FunctionContext
funcContext)
at
System.Management.Automation.Interpreter.ActionCallInstruction`6.Run(InterpretedFrame
frame)
at
System.Management.Automation.Interpreter.EnterTryCatchFinallyInstruction.Run(InterpretedFrame
frame)
at
System.Management.Automation.Interpreter.EnterTryCatchFinallyInstruction.Run(InterpretedFrame
frame)




Script Name:
GetStorageSubsystemPerfScript


One or more workflows were affected by
this.


Workflow name:
Microsoft.SystemCenter.Advisor.StorageSubsystem.Performance.PerfCollection

Instance
name: SCVMM01.Domain.com

Instance ID:
{B5175EAC-D64D-2553-D567-F19B5C864BBD}

Management group: OMGRP82

Hi 

we have noticed a large spike in disk i/o relating to our scom agents. The health service is constantly reading at around 5-10mb/sec across all our monitored servers. We linked this to last time that we performed a datacentre shutdown. We can see the spike from from the days after the shutdown.I have unfortunately inherited scom from someone else so my knowledge of scom is not the greatest at this point. Any help will gladly be appreciated.We have tried restarting the service on the monitored servers.

We are using SCOM 2012 R2 

VeeCT

Hello,

I'm having the follow error on SCOM 2012 SP1 in Windows Server 2008 R2, with the id 31567:

Failed to deploy reporting component to the SQL Server Reporting Services server. The operation will be retried.
Exception 'DeploymentException': Failed to deploy reports for management pack with version dependent id '7c10d4f8-4743-fe71-32c8-d5222d549670'. Failed to deploy linked report 'Microsoft.Linux.Universal.MemoryPerformanceHistory.Report'. Failed to convert management pack element reference '$MPElement[Name="Universal!Microsoft.Linux.Universal.OperatingSystem.PagesPerSecond.Collection"]$' to guid. Check if MP element referenced exists in the MP. An object of class ManagementPackElement with ID c37d8c39-2c86-42f0-63cc-6805295571eb was not found. 

One or more workflows were affected by this.  

Workflow name: Microsoft.SystemCenter.DataWarehouse.Deployment.Report 
Instance name: 34d6aca7-5ec8-4285-a4e3-ac718a12b6ad 
Instance ID: {F057174F-1D89-3D85-69D8-CE5CE74BAAB2} 

It's a fresh install, and i tried to remove de MP and i install again but the problem started as soon as i install the MP the second time. I saw this possible solution in this link, but doesn't work for me. 

http://thoughtsonopsmgr.blogspot.com/2010/09/eventid-31567-failed-to-deploy.html

The configuration are like in this link https://social.technet.microsoft.com/Forums/systemcenter/en-US/80cafbf9-a051-48df-b0b1-bb8b040af683/data-warehouse-failed-to-deploy-reports-for-a-management-pack-to-sql-reporting-services-server-event?forum=operationsmanagerreporting:

"Open Internet Explorer, visit http://servername/reports.

2.    Click on “Show Details” on the upper right corner. If you see “Data Warehouse Main” listed, please click it and check its properties. The settings should be:

Connection Type: Microsoft SQL server

Connection String: data source=<Name of the SQL reporting server>;initial catalog=OperationsManagerDW;Integrated Security=SSPI

(Ensure the NETBIOS name of the SQL reporting server is used.)

The option “credentials are not required” is selected."

Anyone have some idea what is the problem?

I already have deleted the folder in reporting server after i unistall the specific Management Pack, and them reinstall againd that MP, the error show up again.

Thank you,

Rui

Hi

Could some one confirm the compliance  status for MS SCOM 2012R2 on following regulations?.

• HIPPA
• HITECH
• PHI
• PCI
• ISO 27034

Hi All,

Reporting is down in SCOM 2012 R2.

Environment and issue: I have a small management group which consists of two MS and a SQL DB which is clustered. The reporting binaries have been run on node1 of the DB server only and the node 1 only has the follwing registry key :

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\System Center Operations Manager\3.0\Reporting,\ DWDBInstance 

Now , all the sql resources are on Node 2 and when i run the report it says : 

Reporting Services Error

---

• An internal error occurred on the report server. See the error log for more details. (rsInternalError) Get Online Help

And when i dug into the log it says: 

library!ReportServer_0-1!1940!01/18/2015-21:07:03:: e ERROR: Throwing Microsoft.ReportingServices.Diagnostics.Utilities.InternalCatalogException: Incorrect security descriptor version, Microsoft.ReportingServices.Diagnostics.Utilities.InternalCatalogException: An internal error occurred on the report server. See the error log for more details.;

Earlier the following link format use to work but it does not now:

http://clustername/ReportServer_instancename

I tried to change it to node 2 like below [which does not work]:

http://node2/ReportServer_instancename

Finally i just tried with node 1 which works just fine via web browser:

http://node1/ReportServer_instancename

I think switching the sql resources back to node1 will solve the situation, i have already created a ticket to the DB team to look into it.I know that SCOm reporting is not cluster aware and that is how i just ran the reporting server binaries on the first node.

Could you help me with the change of reporting server entries in either registry or config files or DB tables which could tell SCOM to look and contact only the node1 for reporting and not the node2.

Any comments would be greatly appreciated as I need to fix this soon else I would not be able to send the monthly SLA reports to my stakeholders as the Service Level Report Library option is not visible via SCOM web portal reporting.

Regards,

Techie Seeker.

I have five management servers, a reporting server, and the usual two database servers.

I do windows updates and reboot the 5 management severs (one at a time, waiting for it to come back to life before moving on to the next server).

My issue is that I have a few ‘open’ alerts (which I would like to remain open), but some get resolved as soon as a Management Server reboots.  Alert history says ‘Resolved by system’.  It’s random which of the 5 servers will close which open alert.  It doesn't matter what the Source or Name of the Alert is.  By the time I've restarted all the servers, all existing alerts have closed and reopened.

Please note, the question is not about alerts being present, it's about them getting 'resolved' by themselves and then generated anew.

This happens regardless of placing the management servers in ‘maintenance mode’ or not before doing Windows Updates.

Would someone please help me understand what I am missing?

Appreciate any help I can get.

KB