Until recently I used a performance mapper to get consecutive samples for my custom monitors or rules. This is not optimal since the data is transformed into performance data.

When taking a look at the Web Application Availability monitoring I found out that the Expression Filter with the 2.0 schema version has a new element called SupressionSettings.

This is great! You can with this set how many matches that is needed to output the data to the next module. You can also set the total number of samples or a time limit for the samples.

I don’t know how I managed to miss this, but hopefully with this post, I’ll help some else not to miss this possibility.

Information from MSDN about the SupressionSettings element in the System.ExpressionFilter module:

Problem

A customer wants to monitor a text log file for an event. There is also a correlated event that will indicate a good state. There shouldn’t be any alert unless no correlating event has been added to the log file within an hour.

Discussion

My first thought was to create a scripted monitor to solve this. But after looking at the different log file monitor types that is available in the library I realized that you could, with some effort, create my own customized log file monitoring to solve this problem. Since there will be a correlated event it is possible to user a monitor instead of a rule.

Solution

Before starting with the MP let’s take a look at an example. In the MP “System.ApplicationLog.Library” and the MonitorType “System.ApplicationLog.GenericLog.MissingCorrelatedEventSingle2StateMonitorType” there is some interesting information.

We will need “log readers” and filters for matching the events with an error string. To correlate the events we need a filter for that too.

• A “log reader” for the first matching event in the log file.
• A “log reader” for the correlated matching event in the log file that generates Unhealthy state.
• A “log reader” for when monitor goes back to Healthy state.
• A filter for each of the “log readers”.
• A filter for correlation.

A reference to the MP “System.ApplicationLog.Library” is needed. In my example I’ll use the alias “AppLog”.

Start with creating a new empty MP fragment in your solution.

Set an ID for the MonitorType and the states for the monitor. I’ll use a two-state.

Set the parameters used under the Configuration tag. Also set which parameters that should be overrideable.

Add all member modules. All modules, except for the correlating filter, are built-in.

Set the run order of the modules. In my example I will not use On Demand detection just Regular.

Create the Display string.

Create a new fragment for module types and put the correlator there after taking a peek at the System.CorrelatorAutoMissingCondition module.

We need two modules in this correlator. One that handles the “correlator count” and one to filter the output.

In my example I’ll use a static threshold for the matching values. Hence, there should be one “item count” for the first event and null for the last one.

Set the modules to run in the right order.

The modules are set up. Now it is time to create the monitor. I’ll use the Unit Monitor template.

Fill in the Alert description. Populate with fitting alert parameters.

Next, set the Monitor configuration. Open the window and populate all in-parameters.

Set Monitor operations states.

After building the solution you are done.

The unsealed Management Pack can be found here.

Note, this Management Pack is developed for a lab/test environment only.

Today I encountered an error with a TimedPowerShell discovery. The Invoke-WebRequest command was the cause as I found out in the Event Log.

The targeted server was running Windows Server 2012 with PowerShell version 3. Apparently there is know bug: https://connect.microsoft.com/PowerShell/feedback/details/734056/invoke-webrequest-ie-error

The workaround is to open Internet Explorer with the account executing the command. Since the SCOM agent uses “Local System”, the solution is to run it with PsExec: http://marckean.wordpress.com/2010/12/17/run-internet-explorer-as-the-local-system-account/

After starting Internet Explorer once with “Local system” the discovery finished the script with out errors.