Connecting a Server into my Microsoft Operations Management Suite

With Microsoft Operations Management Suite (MOMS) you can add different sources of data to send data to OMS.

1. Manually installing the MMA agent on a server

2. Connecting your SCOM management group.

3. Azure Storage Account

For this post I will discuss option 1 above.

I’ve setup my lab environment with three Windows 2012 servers.

1. SQL 2012 Server

2. Windows 2012 File Server

3. SCVMM 2012 server

Details that is required during the MMA agent installation are

1. The workspace ID

2. Primary Key

This information is obtainable in your MOMS console

There is also a download link for the Windows Agent.

The next step I did was to copy the MMagent install msi across to the 3 servers and double-clicked on the install.

The files are then extracted and I was presented with the following screen

Click Next and then you get

The next screen is then where you specify wether you want to connect this MMA to a SCOM management group or to an Microsoft Azure Operational Insights service

Click on the first option (“Connect the agent to Microsoft Azure Operational Insights” and then click on next you get the following screen

The here you specify the ID and Key as it appears on your website.

For my environment and lab I had to specify the HTPP proxy URL, username and password, I click on the “Advanced” button and specified the details in the next screen.

Filling in all the details on this screen and click Next and Next on the main screen will cause the MMA agent installation to verify details with the MOMS site.

The log file for this installation is in %temp%monitoringagent.log

This log file will contain the installation steps and any issues that occurred during the installation.

When the installation was successful in it’s verification you will get the following screen.

Clicking on Next and then Install will install the MMA agent.

Successful installed

The agent will then communicate with the MOMS service and all management packs for the MOMS Solutions will then be pulled from the MOMS site and monitoring will commence.

Events in the OperationsManager Eventlog like the following will tell you that there is communication between the MOMS service and your MMA agent installed on your server

In the next post I will chat more about the different MOMS solutions and also connect my SCOM management group in my Lab with the MOMS services for alert management etc.

GrapeVine SMS and SCOM

GrapeVine has several methods for message delivery to be sent as a SMS.

1. Email to grapevine mailbox from there SMS messages is sent

2. Post

3. XML

The below powershell script is one example of consuming the HTTP Post method.

The powershell script is configured in SCOM as a Command Line notification with the SCOM alert description and CellPhoneNumbers passed to the script as parameters.

The script takes the comma-seperated list of CellPhonenumbers and one for one send the information to GrapeVine web url.

You will need the following information from GrapeVine for your clients’ account

1. Originator ID

2. AffiliateCode

3. AuthenticationCode.

These 3 items are required and only obtainable from Grapevine, you need to get in touch with the GrapeVine SP to get this information.

The script also consumes the return code information from the post attempt and saves these returned information into a text file for future reference.

The script also when the # lines are removed to create actual event log entries into the Application event log. You can use these event logging capabilities and monitor for these events either by using SCOM or some Monitor of Monitors.

Param($Message=$Args[1], $cellnumbers=$Args[2])

$aaa = $cellnumbers.split(“,”)

write-host $cellnumbers

foreach ($cellnumber in $aaa)


write-host $Message

write-host $cellnumber

$http_request = New-Object -ComObject Msxml2.XMLHTTP




write-host $http_request.responseText

$ResultOutPut = $http_request.responseText

$DateNow = Get-Date

add-content d:\grapevinesms\gvsmslog.txt “$DateNow :: $Message – $cellnumber returned the following response – $ResultOutPut”

add-content d:\grapevinesms\gvsmslog.txt “

Reading SQL Database and Table and create SCOM Alerts

Reading data from a SQL database table and based on the returned recordset one can easily created SCOM performance counters or SCOM events.

The below VB-Script does just that. It reads a SQL table and for each record it builds up the event message with VBCRLF (Carriage Return Line Feed aka Enter key J).

Dim oAPI

Set oAPI = CreateObject(“MOM.ScriptAPI”)

Set conn = CreateObject(“ADODB.Connection”)’

conn.Open “Provider=SQLOLEDB;Data Source=SQLSERVER;Initial Catalog=Database;Persist Security Info=False;Integrated Security=SSPI”

‘Call oAPI.LogScriptEvent(“ReadSQLTable”, 100, 2, “running”)

conn.commandtimeout = 500

set recset = createobject(“adodb.recordset”)

sql = “SQLSelectStatement” sql, conn

Call oAPI.LogScriptEvent(“readsqltable.vbs”, 100, 2, “connected and running”)

recfound = 0

while not recset.eof

eventmsg = eventmsg & vbcrlf & recset.fields(0).value & ” ” & recset.fields(1).value & ” ” & recset.fields(2) & ” ” & recset.fields(3) & ” ” & recset.fields(4)


recfound = recfound +1

Set oBagAgentVer = oAPI.CreateTypedPropertyBag(1)

call oBagAgentVer.AddValue(“EventID”,912)

call oBagAgentVer.AddValue(“EventSource” ,”ReadSQLTable“)

call oBagAgentVer.AddValue(“EventMessage”,eventmsg)


Call oAPI.ReturnItems

Call oAPI.LogScriptEvent(“readsqltable”, 101, 2, eventmsg)




The above script is then put into a Time Command > Execute a Script SCOM rule

For this rule and the access to the particular database I needed to specify a Run-As account

This runas account has a domain user specified with read access to the particular SQL table.

The Scheduler is set to every 1 minute

Because the above script is creating a SCOM event, you then need to configure an Alert Generating Event rule that monitors for the event source and Event Id as specified in the script.

In this case the eventsource is ReadSQLTable and the eventid is 912.

Below is a sample script for reading records out of an Access Database and creating SCOM alerts for the returned recordset

The bold italics parts of the script is what you must substitute the relevant values for your environment.

Dim oAPI

Set oAPI = CreateObject(“MOM.ScriptAPI”)

Set conn = CreateObject(“ADODB.Connection”)

‘Call oAPI.LogScriptEvent(“accessdbforerrors.vbs”, 100, 2, “Run script”)

sconn = “Driver={Microsoft Access Driver (*.mdb)}; DBQ=DirectoryandAccessMBDfilelocation;”

conn.Open sconn

set recset = createobject(“adodb.recordset”)

sql = “AccessSQLSelectQuery

set rs = conn.execute(sql)

‘Call oAPI.LogScriptEvent(“accessdbforerrors.vbs”, 100, 2, rs.recordcount)

evt_msg = “”

while not rs.eof

sss = RS(“Message“)

Call oAPI.LogScriptEvent(“accessdbforerrors.vbs”, 100, 2, sss)

msg = “‘” & sss & “‘”

evt_msg = “Date of error: ” & RS(“fielname”) & ” ” & RS(“time”) & vbcrlf & ” Type: ” & RS(“type”) & vbcrlf & ” Message: ” & msg & vbcrlf

‘ Call oAPI.LogScriptEvent(“accessdbforerrors.vbs”, 100, 2, evt_msg)

Set oBagAgentVer = oAPI.CreateTypedPropertyBag(1)

call oBagAgentVer.AddValue(“EventID”,99101)

call oBagAgentVer.AddValue(“EventSource” ,”EventSource“)

call oBagAgentVer.AddValue(“EventMessage”,evt_msg)




Call oAPI.ReturnItems

SCOM 2012 R2 UR 6 has been released

This release fixes a lot of issues.

Some of them are

Operations Manager

· The “Remove-DisabledClassInstance” Windows PowerShell command times out without completing

The cmdlet takes lots of time to complete in large SCOM installations and sometimes times out without completing its work. This is fixed by optimizing the query that is used for deletion.

· Duplicate closed alerts

The Find option in a message view sometimes gives results of the current search together with the results from previous searches. This occurs because of an update issue in the grid and is fixed so that values are displayed that correspond only to the current search.

· Topology widget objects lose location when they are opened in a console that has a different locale and decimal format

Topology widgets that are created in one locale but are viewed from another locale display an incorrect location because of the widget’s inability to interpret locale-specific formatting. This issue is fixed, and users can now create and view topology widgets from different locales.

· WebConsole Details widget does not display anything

When you click a message in the Alert widget, the details of the message are not displayed in the details widget on WebConsole. This issue is fixed by fixing the XAML page of the details widget. The XAML page was preventing the data from being displayed on the page.

· Top 10 Performance widgets (WebConsole) are sometimes empty

The Top 10 Performance widgets (WebConsole) are sometimes empty because of a performance issue. This issue was fixed in Update Rollup 3 through an MPB file that requires a manual import. Because many users missed importing the MPB, a fix is included in this update rollup as an SQL query update.

· Problem with decoding SCOM trace log files

Sometimes Operations Manager trace logs do not decode but generate the error “Unknown(X ): GUID=XXX (No Format Information found).” This occurs because the latest TMF files that contain formatting information for the related traces are missing. All TMF files are updated to make sure that traces are formatted correctly.

Exchange HTML 5 Dashboard

Further to my earlier post about HTML 5 dashboards, I want to show you the Exchange performance dashboard that I have also created.

Top part of the dashboard

Bottom part of the dashboard

By clicking on the Exchange Connection Pie Chart you get a bar graph showing you the category servers for either the RPC or OWA connections

SCOM SDK and HTML 5 Web Dashboard Better Together

I’ve been playing with the idea to combine, with the SCOM 2012 SDK and HTML to create HTML 5 dashboards for showing SCOM Distributed Application and other health items.

I’m making use of Bootstrap and other java plugins and style sheets for the layout of the page

Distributed Application Dashboard Health

The little dials shows the CPU and Memory utilization of the server objects in each of the SCOM distributed Applications.

Below is the SCCM HTML 5 dashboard that shows SCCM components, performance and open alerts

SCOM Volumes

It’s very important to keep your eye on the volumes of data that is generated by your SCOM environment.

Several SCOM management packs has collection rules with intervals set to 300 seconds or 5 minutes. On big SCOM environments with hundreds or even thousands of SCOM agents it’s crucial to fine-tune these volumes by changes the intervals via overrides.

It’s very difficult to see the volumes in your environment and also to identify what rules are responsible for the volumes so that they can be fine-tuned or disabled.

The following report shows you a summarization of the volumes for the different data sets read from the SCOM OperationsManager database, this report is a 3-level-drill-down.

This report also allows the user to drill-through by clicking on a specific day for example on the Performance Insertions to see the individual performance counters and count – showing top 20 only.

The next drill-through level shows the SCOM rule details including the Rule DisplayName, with this information at hand the user/scom administrator can proceed to fine-tune the collection interval and other properties using the SCOM console.

PM me for a copy of this and all sub reports.