Tips & Tricks for Creating Custom Management Packs for Microsoft System Center Operations Manager

2. MGT306 Tips & Tricks for Creating Custom Management Packs for Microsoft System Center Operations Manager Mickey Gousset Principal Consultant Infront Consulting Group

3. Mickey Gousset mickey.gousset@infrontconsulting.com @mickey_gousset http://teamsystemrocks.com http://almrocks.com http://radiotfs.com

4. tinyurl.com/protfs

5. Agenda • Intro to Management Pack Structure • Tools for Getting The Job Done • Basic Tips & Tricks • Advanced Tips & Tricks • Expert Tips & Tricks

6. Intro to Management Packs • Simply an XML file • Used to add functionality into SCOM • Sealed vs. Unsealed

7. Management Pack Structure

8. Tools for Getting The Job Done • SCOM 2007 Authoring Tool • SCOM 2012 Operations Console • Visio 2010 (via extension) • Visual Studio 2010 (via extension) • A Text Editor (I like Notepad++)

9. Basic Tips & Tricks • Targeting • Management Pack Design – One vs. Many • MP Version Control • Sealed Management Packs • Discovery Scripts • Debugging Scripts • Customizing Rules and Monitors • Running a rule during business Hours

10. Targeting You want to monitor failed logon attempts on Windows Computers • GOOD • Use Windows Operating System to target all Windows managed nodes (desktop and servers) • Use Windows Server Operating System to target all Windows server managed nodes (all versions) • Use Windows Server 2003 Operating System to target all Windows Server 2003 managed nodes • Used Windows Computer to target all windows computers (desktop and servers) • BAD • Don’t use Agent: • The monitor will not work for agent-less managed computers. • The monitor will affect the health state of the Agent which is not what you want. • Don’t use Computer: • Management packs for non windows management are likely to use computer as the base type for types such as Unix computer. The monitor that you just created will not work against non windows computers. • The monitor will execute against all windows computers. Both clients and servers that are managed by OpsMgr.

11. Targeting – Operating System Model Operating System Inheritance Windows Operating System Other Operating System Windows Server Operating System Windows Client Operating System Windows Server 2003 Operating System Windows Server 2008 Operating System Windows XP Operating System Windows Vista Operating System

12. Management Pack Design – One vs. Many • MyCustomMP.xml • Classes • Discoveries • Rules • Monitors • Reports • MyCustomMP.Classes.xml • MyCustomMP.Discoveries.xml • MyCustomMP.Rules.xml • MyCustomMP.Monitors.xml • MyCustomMP.Reporting.xml

13. Management Pack Design – One vs. Many • A MP must be sealed to reference it • Have to reseal MyCustomMP.Classes after each change MyCustomMP.Classes.mp MyCustomMp.Discoveries.xml MyCustomMp.Monitors.xml

14. MP Version Control • MP Development is “development” • Version Control allows you to track changes • Version Control Options • Microsoft Team Foundation Server • Works well with new Visual Studio extensions • Other 3rd party VCS • “Poor Man’s Version Control”

15. Basic Discovery Script • ‘Setup the objects • Set oAPi = CreateObject (“MOM.ScriptAPI”) • Set oDiscoveryData = oAPI.CreateDiscoveryData(0, SourceId, ManagedEntityId) ‘Create Discovery Instance Set oInstance = oDiscoveryData.CreateClassInstance( “$MPElement[Name=‘ClassName’]$”) oInstance.AddProperty “$MPElement[Name=‘ClassName’]/Property1$, Value1 oDiscoveryData.AddInstanceoInstance ‘Return discovery data oAPI.ReturnoDiscoveryData

16. SourceId and ManagedEntityId • SourceId • The workflow ID • $MPElement$ • ManagedEntityId • The base ID for the object the workflow is running against • $Target/Id$

17. Discovery Scripts – Best Practices • Always return discovery data – even if nothing is discovered • This is how SCOM knows to delete previously discovered object instances • Always target as specifically as possible • Use oAPI.LogScriptEvent to help debug scripts

18. Running A Rule During Business Hours

19. Advanced Tips & Tricks • Advanced Authoring Concepts • Creating a Custom Data Source • Creating a Custom Unit Monitor

20. Advanced Authoring Concepts • Behind the scenes, everything is a workflow • Workflows are composed of four module types Data Source Condition Detection Write Action Probe Action Does not take input, generates output based on external sources. Does not change object state. One input and one output; when triggered, generates output from external sources. One or more input streams, one output. No external sources and no state changes. One input and zero or one output streams. Changes object state. Always the last module in Rules and Recoveries.

21. Advanced Authoring Concepts – Rules • One or more data sources • Zero or one condition detection • One or more write actions Data Source Condition Detection Write Action

22. Creating a Custom Data Source

23. Creating a Custom Unit Monitor

24. Expert Tips & Tricks • Cookdown • On Demand Detection • Supporting Agentless Monitoring

25. Cookdown – An Example – Part 1 Monitor: MyMP.Monitor.MyCustomMonitor1 MyCustomMonitor1 has been configured with a probe so it can use on-demand detection Condition Detection: My Results Filter Date Source: Simple.Scheduler Probe: MyCustomProbe Monitor: MyMP.Monitor.MyCustomMonitor2 MyCustomMonitor2 is using a custom data source that makes use of our probe. It also has a schedule filter configured Date Source: MyCustomDataSource Condition Detection: Schedule Filter Monitor: MyMP.Monitor.MyCustomAlertRule MyCustomAlertRule is collecting events using our custom data source, and only alerting if certain events show up in order Date Source: MyCustomDataSource Condition Detection: Consolidator Write Action: Generate Alert DataSource: MyCustomDataSource MyCustomDatasource is collecting events on a timer from a text log, and ignoring informational events Condition Detection: My Results Filter Date Source: Simple.Scheduler Probe: MyCustomProbe

26. Cookdown – An Example – Part 2 Monitor: MyMP.Monitor.MyCustomMonitor1 Condition Detection: My Results Filter Date Source: Simple.Scheduler Probe: MyCustomProbe Monitor: MyMP.Monitor.MyCustomMonitor2 Condition Detection: Schedule Filter Condition Detection: My Results Filter Date Source: Simple.Scheduler Probe: MyCustomProbe Monitor: MyMP.Monitor.MyCustomAlertRule Condition Detection: My Results Filter Condition Detection: Consolidator Date Source: Simple.Scheduler Probe: MyCustomProbe Write Action: Generate Alert For each workflow, SCOM builds an execution chain. The first step is to resolve/expand all modules to their root definitions, and place them into the chain. So, all our instances of the custom data source are replaced with the modules that make up the data source. Each chain is analyzed, and each module’s input parameters submitted to a hash function. If module IDs and hash results are the same, that indicates duplicate modules that are candidates for cookdown.

27. Cookdown Workflow Monitor: MyMP.Monitor.MyCustomMonitor1 Monitor: MyMP.Monitor.MyCustomMonitor2 Cooked Down Workflow Condition Detection: My Results Filter Condition Detection: Schedule Filter Date Source: Simple.Scheduler Probe: MyCustomProbe Since the first three modules were all configured identically, they are cooked down and run once, with the output replayed to each consuming workflow Monitor: MyMP.Monitor.MyCustomAlertRule Condition Detection: Consolidator Write Action: Generate Alert

28. Cookdown Example

29. On Demand Detection • Allows the “Recalculate Health” button to work in Health Explorer • Allows health calculation when exiting maintenance mode • Can only trigger a probe module, not a data source module • Be care if you have many instances of a target class on one host

30. Agentless Monitoring • Module should have Remoting= True parameter set • Scripts should never use “localhost” or “.” for computer name • Attempt to use APIs in scripts that support remote execution

31. Summary • Intro to Management Pack Structure • Tools for Getting The Job Done • SCOM 2007 Authoring Tool • SCOM 2012 Operations Console • Visio 2010 (via extension) • Visual Studio 2010 (via extension) • A Text Editor (I like Notepad++)

32. Summary – Cont. • Advanced Tips & Tricks • Advanced Authoring Concepts • Creating a Custom Data Source • Creating a Custom Unit Monitor • Basic Tips & Tricks • Targeting • Management Pack Design – One vs. Many • MP Version Control • Sealed Management Packs • Discovery Scripts • Debugging Scripts • Customizing Rules and Monitors • Running a rule during business Hours • Expert Tips & Tricks • Cookdown • On Demand Detection • Supporting Agentless Monitoring

33. More Information • MP Dev Kit - http://msdn.microsoft.com/en-us/library/ee533840.aspx • SCOM SDK - http://msdn.microsoft.com/en-us/library/hh329086.aspx • MP Dev Documentation - http://social.technet.microsoft.com/wiki/contents/articles/tags/management+packs/default.aspx • Matthew Long- http://matthewlong.wordpress.com/ • Pete Zerger- http://www.systemcentercentral.com/Blogs/Community/tabid/119/controlType/ViewProfile/UserID/7/Default.aspx • Brian Wren - http://blogs.technet.com/b/mpauthor/

34. Special Thanks To… • Matthew Long

35. Mickey Gousset mickey.gousset@infrontconsulting.com @mickey_gousset http://teamsystemrocks.com http://almrocks.com http://radiotfs.com

36. MGT Track Resources Talk to our Experts at the TLC #TEMGT306 Hands-On Labs DOWNLOAD System Center 2012 Evaluation microsoft.com/systemcenter DOWNLOAD System Center 2012 SP1 CTP microsoft.com/systemcenter

37. Resources Learning TechNet • Connect. Share. Discuss. • Microsoft Certification & Training Resources http://europe.msteched.com www.microsoft.com/learning • Resources for IT Professionals • Resources for Developers • http://microsoft.com/technet http://microsoft.com/msdn

38. Evaluations Submit your evals online http://europe.msteched.com/sessions

39. © 2012 Microsoft Corporation. All rights reserved. Microsoft, Windows, Windows Vista and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries. The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.