Sofia Event Center 21-22 November 2013

1. Sofia Event Center 21-22 November 2013 Infrastructure and Application Monitoring with System Center 2012 R2 Nikolay Dinev Microsoft Consulting Service

2. Share your feedback for this particular session and for the overall conference experience at http://aka.ms/incharge for a chance to win HTC 8S and other prizes!

3. Agenda • Operations Manager Architecture • Infrastructure Monitoring • Workload Monitoring • Application Monitoring • Private Cloud Monitoring • System Center Advisor Customer ONE ConsistentPlatform ServiceProvider Microsoft

4. Operations Manager Architecture

5. Architectural Change Operations Manager 2007 R2 Platform Parent child topology with the RMS as the parent and all other management servers as children. Operations Manager 2012, 2012 SP1 and R2 Platform Peer to Peer topology with all management servers acting as equals.

6. Management Server Design What do you need to know about designing your management server? • Hardware requirements • Best practices in sizing helper tool • High availability and virtualization recommendations • Network requirements • Usage of Gateway servers • Database and report consideration

7. Databases and Reporting What database does it use and for what? • Operational database: • Contains all configuration data for the management group • Stores all monitoring data that is collected and processed for the management group by default for 7 days • Data warehouse: • Stores monitoring and alerting data for historical purposes • How does report work and what needs to be considered? • Uses SQL server reporting server • Assess the number of concurrent reporting users • Recall the data warehouse data retention decision

8. Network Requirements How do operations managers communicate to each other? • No direct communication between an operations console and the databases • All communication goes to the resource pool and to the database servers • Direct communication between an application diagnostics console and databases • Supports full distribution of features among servers • For more information, see connecting management groups in operations managers

9. Architecture Patterns Architecture example for infrastructure monitoring head with OpsMgr • Most commonly used architecture for enterprise deployments • Allows for the distribution of features and services across multiple servers to allow for scalability • Includes all server roles and supports the monitoring of devices

10. Management Groups What is a management group? How would you group your managed systems? • Basic unit of functionality: • Management group consists of a management server, the operational database, and the reporting data warehouse database • Why one should consider multiple management groups? • View consolidation • Language requirements • Security boundaries • Separation of test and production environments

11. Agents and Watcher Nodes Agents • What does an agent do? • Agent collects data, compares sampled data to predefined values, creates alerts, and runs responses • Agent calculates the health state of the monitored computer and objects on the monitored computer and reports back • Where can the agent be installed? • Windows agents • UNIX/Linux • Network devices

12. Infrastructure Monitoring Challenges • BACKGROUND • Infrastructure is transitioning from traditional physical device to virtualized compute, network and storage, and building into a cloud • Administrator within the data center has to deal with traditional, virtualized, private and public cloud as part of their infrastructure • THE CHALLENGES • Difficult tracking health state of your infrastructure • Disconnected information of network, storage, virtual machine and cloud it is running on • Longer Time to Resolution or TTR when a problem occurs with complex infrastructure Traditional Virtualized Private Cloud Public Cloud

13. Wake Up Time!What was theSCOM agent service name in SCOM 2007?

14. Infrastructure Monitoring

15. Focus on Enterprise Operating Systems Manage the full range of infrastructures Enable movement between infrastructures Virtualized Private Cloud Public Cloud Traditional •  Windows • Linux • UNIX •  Windows • Linux • UNIX •  Windows • Linux •  Windows • Linux

16. Support for the latest Windows platforms Windows Server 2012, Windows Server 2012 R2 Updated support for Linux distributions CentOS, Debian, Ubuntu Red Hat Enterprise Linux SUSE Linus Enterprise Server 45+ Management Packs (new or updated) released this year VEEAM Management Pack Amazon Web Services Management Pack Monitoring the OS and Workloads

17. Agent auto detects Windows servers and by default monitors Disk Network Windows itself Windows Server Monitoring

18. Each Windows server has its default health state defined by the Windows server development team Windows Server Monitoring • Availability—detects the roles, features, and services it is running and checks the health model • Configuration—detects activation status, service configuration setting, and results of best practice analyzer • Performance—checks available memory, memory pages per second, system page file, total CPU utilization and other performance counters • Security—monitors for security related setting

19. Resource pool role in high availability scenarios Linux and UNIX Monitoring • Operations Manager AgentUNIX/Linux computers • Supported operating systems: • CentOS 5 and 6 (x86/x64) • DebianLinux 5 and 6 (x86/x64) • HP-UX 11i v2 and v3 (PA-RISC and IA64) • IBM AIX 5.3, AIX 6.1 (POWER), and AIX 7.1 (POWER) • Novell SUSE Linux Enterprise Server 9 (x86), 10 SP1 (x86/x64), and 11 (x86/x64) • Oracle Solaris 9 (SPARC), Solaris 10 (SPARC and x86), and Solaris 11 (SPARC and x86) • Oracle Linux 5 and 6 (x86/x64) • Red Hat Enterprise Linux 4, 5, and 6 (x86/x64) • Ubuntu Linux Server 10.04 and 12.04 (x86/x64) Management server Managed UNIX/Linux computer MPMP MP Config service SSH client library Agent maintenance actions SSHD SSH connection Port 1270 SDK WS-man request: HTTPS transport Health service OpsMgrAgent for UNIX/Linux (OpenPegasus CIMOM Server + providers) WinRM client library WS-man response: HTTPS transport WinRM = Windows remote management WS-Man = Web service management protocol SSHD = UNIX/Linux Secure Shell Daemon

20. Each Linux and UNIX server has its default health state Linux and UNIX Monitoring • Availability—detects the hardware availability including disk • Configuration—detects name resolution and WS-man health status for remote management • Performance—checks available memory, swap space, DPC time

21. Supported Operating Systems

22. Linux Built-In Monitoring

23. Custom Monitoring Options Service monitoring Custom LogFile monitoring Command line rules and monitors • Monitor any logfile • Specify regular expression to match against • Target a single computer or group of computers • Monitor by name any service, daemon or process • Distinguish duplicate names with regex filter on process arguments • Specify minimum and maximum counts • Target a single computer or group of computers • Run any shell command line to determine health or performance • Target a single computer or group of computers

24. Network Monitoring Discovery Discovering stages • Initial probing • Sends an initial ICMP and/or SNMP request to identify system • Processing • Get components, IP addresses, VLAN memberships, resources, IP networks, netmasks and neighboring devices • Topology is created • Post processing • Creates layer 2 and Layer 3 connectivity between the devices in the toplogy • Port stitching ICMP Ping and/or SNMP Get • Uses SNMP v2c by default • ICMP Ping first • SNMP Get next • If no response: device is added to Pending • If SNMP v2c fails: SNMP v1 is tried Creates Layer 2 and Layer 3 connectivity between the devices in the topology Port Stitching • Mapping IP and MAC access points retrieved from the ARP cache to the appropriate devices. Removes MAC access points that do not belong to devices in the topology • A MAC Access Point is the interface to which a device on an IP network connects Creates network connections to represent WAN, or logical connections Creates connections based on discovery protocols

25. Network Monitoring Events Discovery Events Discovery methods Explicit discovery • Customer knows the network devices • Manual process – add IP address or import list Recursive discovery • Network topology unknown • Discovered based on a set of seed devices • Grabs ARP and IP tables and crawls network

26. Network Monitoring Capabilities Physical network routers and switches • Interfaces and ports/virtual local area networks (VLANs) • Hot Standby Router Protocol (HSRP) groups • Firewalls and load balancers Increased visibility into your network infrastructure • Identify failures in critical services and applications that were caused by the network • Show how your network is connected to the computers you are monitoring List of network devices with extended monitoring capability

27. Network Monitoring Dashboard Network dashboard • Vicinity view, availability, and performance Health view for each network device

28. Other Infrastructure Management Packs • Active Directory (ADCS, ADDS, ADFS, ADLDS, ADRMS) • App-V • AppFabric • Application Server • BranchCache • Cluster • BitLocker • Direct Access • DFS Namespaces • DFS Replication • DHCP • DNS • Fax Server • File Services & iSCSI • Group Policy • Host Integration Server • Hyper-V • IIS • Internet Security & Acceleration (ISA) • Key Management Service • Message Queuing Services (MSMQ) • Network Load Balancing • Power Management • Print Server • Remote Access • Remote Desktop Services • Routing & Remote Access Service • Service Bus • SC Advisor • SC App Controller • SC Configuration Manager • SC Data Protection Manager • SC Orchestrator • SC Service Manager • SC Virtual Machine Manager • Storage Server • Terminal Services • Update services • Windows Azure Pack • Windows Client • Windows Deployment Services • Windows HPC Server • Windows Server • WS-Management & SMASH

29. Wake Up Time!What is the name of SCOM functionality responsible for gathering security events?

30. DemoWindows Service Monitoring, Windows Event logLinux Monitoring

31. Workload Monitoring

32. Exchange 2010 Monitoring In addition to the Exchange 2007 management pack features, this includes: Alert correlation Maintaining the health model in memory, and processing state change events Determines when to raise an alert based on the state of the system Alert classification Uses the following alert categories to classify alerts Key Health Indicator (KHI), Non-Service Impacting (NSI), and Forensic. Mail flow statistics reporting E-mail transaction statistics are collected by using message tracking log data. Service-oriented reporting Uptime is reported based on the uptime of the application, service, and feature uptime rather than on server uptime Exchange-aware availability modeling Client availability uptime is measured for each type of Exchange client, based on test user transaction

33. Exchange Topology

34. SQL Server Monitoring Discover SQL Server 2005, 2008, 2008 R2, and SQL Server 2012 Monitors SQL Server components such as database engine instances, databases, and SQL Server Agents Integrate the monitoring of SQL Server components into your service-oriented monitoring scenarios Dashboard views, diagram views, and extensive knowledge with embedded inline tasks, and views that enable near real-time diagnosis and resolution of detected issues

35. SQL Hardware Monitoring

36. SQL Memory Monitoring

37. SQL Component Monitoring

38. SQL Monitoring Dashboards

39. SQL Performance Monitoring SPN monitor improved Support for special symbols in DB names Improved AlwaysOn seed discovery Run As configuration changes to support Low privilege for SQL Server 2012 Cluster Improved performance of AlwaysOn discovery Custom user policy discovery and monitoring performance optimization Hided AG health object from Diagram view

40. SharePoint 2010 Monitoring Monitor multiple farms, multiple servers, services, shared services, SharePoint Health Analyzer rules and web applications Automatically discovers what SharePoint bits or servers are installed in the environment Depth and breadth of monitoring and rapid detection and resolution

41. SharePoint 2013 Monitoring SharePoint Server 2013 MP support Microsoft SharePoint Server 2013 Microsoft Project Server 2013 Service Applications Access Services Business Data Connectivity Security Token Service Managed Metadata Web Service Education Services Excel Services Application InfoPath Forms Service Performance Point Services Translation Services Sandboxed Code Services Secure Store Services SharePoint Server Search User Profile Service Visio Service Word Automation Service

42. Oracle Monitoring • Insight how memory, physical design and maintenance affect performance • Monitor the entire Oracle environment (RAC) • Understand and manage an Oracle environment like an ecosystem that is constantly changing in terms of physical design, transactions, and memory

43. SAP Monitoring • Flexible deployment options - the SAP connector for the MP can be installed on: • SCOM Agent or management server machine • One or more remote Windows servers • Under the same active directory domain as the management server or outside the domain • Built-in failover functionality • Automatic failover/restore • Automatic configuration synchronization • Heterogeneous SAP support • Connect to SAP Systems running on any platform includingWindows Server 2008, Unix, Linux, iSeries or zOS

44. Other Workload Management Packs • BizTalk Server • Business Intelligence Appliance • Commerce Server • Data Warehouse Appliance • Dynamics AX • Dynamics CRM • Dynamics NAV • FAST Search Server • Forefront Protection • Forefront Security • Forefront Threat Management Gateway • Forefront Unified Access Gateway • Information Worker • Lync Server • Office Communication Server • Office Project Server • Team Foundation Server • Windows Azure Applications • Workflow Manager

45. More Management Packs… • http://aka.ms/mpcatalog • http://systemcenter.pinpoint.microsoft.com

46. Wake Up Time!Distributed Application, Distributed what…

47. DemoOverrides Distributed App

48. Overcoming the Dev-Ops Disconnect “Hey, I just got a call about a failed application.” “Do you know what might have caused the failure?” “How would I know? You wrote the code!” Infrastructure Operations Application Developer

49. Complete Application Monitoring Solution • Server-side • Monitoring the actual code that is executed and delivered by the application • Client-side • End user experiences related to page load times, server and network latency, and client-side scripting exceptions • Synthetic • Pre-recorded testing paths through the application that highlight availability, response times, and unexpected responses • GSM enables tests to be run from Windows Azure Infrastructure monitoring Use the same tools to monitor with visibility across infrastructure and applications

50. Improving DevOps Agility Server-side monitoring shows the application is functioning Client-side, however, shows there is a problem..    “My application is running slowly!” “The network looks good.” “The code passed all testing.” “The servers are running fine.” Application performance monitoring pinpoints exactly where the issue is, reducing the mean time to resolution