Management Pack Melee: Understanding MOM 2005 Management Packs

1. Highlights Management Pack Melee:Understanding MOM 2005 Management Packs Gordon McKenna MOM – MVP Inframon

2. Management Pack Melee:Understanding MOM 2005 Management Packs Gordon McKenna MOM – MVP Inframon

3. Outline • MOM 2005 Introduction • What’s new for MPs with MOM 2005 • State Monitoring • Tasks • Responses • Service Discovery • Management Pack Tools

4. Event and performance management Enterprise event collection Rules-based filtering and consolidation Proactive alerting/action response Enterprise ready Central console Full redundancy Extensible MCF Reporting Web-based management reports Scheduled Publishing MOM 2005 Delivers Automation Scripts Tasks Diagnostics Applications/Role Monitoring Health Model Rules libraries Built-in knowledge-base

5. Event Rules Collection rules Filtering rules Missing event rules Consolidation rules Duplicate Alert Suppression Performance Rules Measuring Threshold Alert Rules Rule Provider Response Knowledge Alert Script SNMP trap Pager E-Mail Task Managed Code File Transfer NT event log Perfmon data WMI SNMP Log files Syslog Product Knowledge Links to Vendor Company Knowledge Links to Centralised Company knowledge Criteria Wheresource=DCOM and Event ID=1006 MOM Rule: Unit Of Instruction/Policy

6. Management Pack Overview Gordon McKenna MOM – MVP Inframon

7. What Can Management Packs Provide? • Monitor line of business applications or business process • Monitor the state of your business • Monitor third party applications and components • Understand how my applications are actually being used

8. What’s New For MPs With MOM 2005? • State Monitoring • Topology • SQL Server Reporting Services Reports • Tasks • Service Discovery • Improved Knowledge

9. MOM 2000 Management Packs And MOM 2005 • MOM 2000 Management Packs run fine on MOM 2005 servers Investment in MOM 2000 Management Packs preserved • Exceptions • MOM 2000 Access-based reports do not migrate forward to MOM 2005 • Some scripts use objects that were deprecated in MOM 2000 and are gone in MOM 2005

10. Management Packs • Management Pack imported via MOM Server • Discovery finds computers in need of a given Management Pack • MOM deploys appropriate Management Packs • No need to touch managed nodes to install Management Packs • Rules: Implement all MOM monitoring behavior • Watch for indicators of problems • Verify key elements of functionality • Management Packs provide a definition of server health

11. Management Pack Features • Alerts: Calls attention to critical events that require administrator intervention • Product Knowledge: Provides guidance for administrators to resolve outstanding alerts • Views: Provide targeted drill down details about server health • Performance plots, collections of specific events/alerts, groups of servers , topology, etc. • State Monitoring: At a glance view of the state of my servers and applications by server role • Detail to component level • Tasks: Enable administrators to investigate and repair issues from the MOM console • Context sensitive diagnostics and remediation • Reports: Historical data analytics • Assess operations performance and capacity planning

12. Health And Diagnostic Modeling Concept • What is a Health Model? • Health States • State Transitions: Defined by indicators (e.g., events) • Organizes health indicators into an end-user digestible context • Alert = actionable health state transition

13. Health Modeling Process • List all Events and Performance Counters • Analyze each Event and Performance Threshold • For each define • State Before, State After • Probability • Auto-Retry (self-healing) • “Anti Event” (indicates situation was corrected) • Resolution (action required) • Analyze data to define Event and Performance Threshold Groups (e.g., EG1;PG1) • Produce Health Model Diagram

14. Example: Cluster Health Model

15. Example: Cluster Management Pack • Health model translates into 38 rules • Most rules fairly straightforward • Match event source • Match one or more event IDs • Example: Quorum Space Alert • Source = Clussvc • ID = 1170, 1171, 1021 or 1022

16. State Rules • Advantages • State is always current • “What is the server status now?” • Problem taxonomy • What aspect of my server is having the problem? • Role (Exchange, DNS, etc.) • Component (Services, Queues, Mail Flow, Databases) • Typical candidates for state-based rules • Numeric thresholds (e.g., perf counters) • Service State

17. State Terminology

18. Event Monitoring • Event rules can be used for state monitoring • An event rule which adjusts state must match at least two event IDs using a regular expression • Regular expressions are written in the form 1 | 2 | 3 and wrapped with ^(expression)$ to prevent mismatches

19. Event Monitoring in Action Rule - Microsoft Operations Manager\Operations Manager 2005\Agents on all MOM roles\The incoming agent queue is full

20. Performance Monitoring • Query and threshold Windows Performance counters as part of your management pack • Specify counter attributes to query • Object • Counter • Instance • Excellent targets for easy state monitoring

21. Performance Monitoring in Action Rule - Microsoft Operations Manager\Operations Manager 2005\Agent\Performance Threshold: MOM Service CPU

22. Internal Service Monitoring • Monitors for service changes and status • Scripts no longer required for service monitoring in MOM • Interrogates the Service Control Manager (SCM) to determine service state • Internal MOM events contain details of service changes and state

23. Internal Service Monitoring Event Details • Event ID 21207 • Source ”Microsoft Operations Manager” • 1- Number of seconds from last sample • 2 - Display Name • 3 - Old State • 4 - New State • 5 - Service Name (Internal Service Name) • 6 - Start Up Type • 7 - Service Context • 8 - Old State (numeric) • 9 - New State (numeric, e.g., 1= stopped) • 10 - Start Up Type (numeric, e.g., 2 = automatic start)

24. Internal Service Monitoring in Action Rule - Microsoft Operations Manager\Operations Manager 2005\Agents on all MOM roles\The WMI Service is not running

25. State Monitoring Gordon McKenna MOM – MVP Inframon

26. Management Pack Wizard • Ships in the MOM 2005 Resource Kit • Build a management pack in 5 clicks containing • Rule Groups • Service Monitoring • Performance Thresholds • Event Monitoring • The wizard automatically generate scripts and underlying logic including regular expressions

27. Management Pack Wizard Gordon McKenna MOM – MVP Inframon

28. Tasks • Tasks provide the ability to execute on demand diagnostics, corrective actions and automation processes • Tasks are executed by the administrator from the Management Server • Task scenarios • Automate a complex set of steps required to solve a common problem • Provide additional information required to diagnose a problem • Run administrative tools in context direct from the MOM server

29. Task Types • Command-line • Execute Windows or Application command line tools • Operator Console: The tasks command line is predefined • Management Server or Agent Managed computer: Command line parameters are modifiable • Script • Executes custom scripts that are available inside MOM • Task scripts can use MOM Scripting Objects • Managed Code • Execute managed code methods • File Transfer • Leverage the file transfer response to transfer a file through a task

30. Tasks Availability • Console Tasks • Alerts • Events • Computers (including all views except groups) • Agent-Targeted Tasks • Computers (including events and alert views) • Computer groups (run once for each computer in the group) • Binaries used by tasks must be present on computer where the tasks will execute

31. Task Output And Security • Tasks Output • Console task output available in task dialog • Agent or Management Server task output is available as MOM internal events • Leverage events 9897, 9898, and 9899 in your management packs to display task results • Security • “MOM Users” can not execute Agent or Management Server tasks • Task audit events provide details on how the task was executed

32. Task Authoring Gordon McKenna MOM – MVP Inframon

33. Responses • Responses run on timed basis or when a given condition is observed • Investigate/Resolve issue • Perform advanced monitoring • Response types • Script • Execute a command • Update a state variable • File Transfer • Managed Code Response • Note: Responses can now be run before alert suppression • Send notifications or perform responses even if the MOM database is not available

34. Script Response Execution • Script and Managed Code responses execute under the dedicated Action Account • Processes are hosted in the MOMHost process • Dedicated Host process per management group • Multiple instances of the same script can run at the same time • The MOMHost process is monitored by MOM Action Account

35. Command line responses can now be managed by the MOM run time Response timeoutmay be specified per response! Command Line Response

36. Script Responses • Script responses are significantly improved and more reliable with the MOMHost process • Response timeout is now specified per script

37. Managed Code Response • Managed code responses execute predefined managed code assemblies • A response may be executed by a rule or task • MOM does not distribute assemblies • Responses can leverage any .NET language • Visual Basic .NET, C#, C++ .NET • Response execute any publicly exposed method in your assembly

38. Managed Code Response

39. File Transfer Response • The file transfer response leverages BITS to transfer files between computers via port 80 • File Transfer responses may • Download files to the agent • Upload files from the agent • File transfer responses may be called from either rules or tasks

40. File Transfer Scenarios • Upload transaction log files to a central location • Archiving data as required by law • Upload a file to assist with troubleshooting • Have a task upload data on demand from the agent • Download a file to the MOM Agent required by a Management Pack

41. Responses Gordon McKenna MOM – MVP Inframon

42. Service Discovery • Service discovery is the mechanism MOM uses to discover information about what it is monitoring. • Service discovery is used for: • Instances – discovery instances of the role you are monitoring. For example Drive Instances, SQL Server Instances, Queue Instances • Attributes – information about the instances you are monitoring. For example Drive Type, SQL Server Version, Queue Name

43. Service Discovery Sample

44. Service Discovery Gordon McKenna MOM – MVP Inframon

45. Management Pack XML • Management Packs can now be converted to XML using tools from the Management Pack Toolkit • Management Pack XML can be used for • Documentation • Change control • Understanding management pack internals • Configuration queries Management Pack XML is not supported by Microsoft and the XML schema will likely change in future releases of MOM

46. Differencing Scenarios • What changes have I made to optimize my management pack? • Are my management packs the same? • Is the management pack version running in my branch office the same as my master copy? • What has Microsoft changed with this service release of the management packs I am running and how will it affect me?

47. Management Pack Tools Gordon McKenna MOM – MVP Inframon

48. Stay Current • Sign up for Management Newsletter • Notice of updates to • New & Updated Management Packs • Microsoft Management Product News • Solutions http://www.microsoft.com/management/notifyme/

49. MOM Resources • Microsoft Operations Manager http://www.microsoft.com/MOM • Getting Started Resourceshttp://www.microsoft.com/MOM/Beginners • Technical Walkthrough • Key Documentation • MOM Evaluation Download • Partner Product Cataloghttp://www.microsoft.com/MOM/ManagementPacks • MOM Communityhttp://www.microsoft.com/MOM/community/ • Solution Acceleratorshttp://www.microsoft.com/mom/evaluation/solutions/default.mspx

50. Gordon McKenna MOM – MVP (UK) Microsoft Management Specialist Inframon Ltd gordon@inframon.com www.inframon.com 07873 830790