OM2012 Add-ons

Microsoft has renamed the JEE MP download page and is now calling it “OM2012 Add-ons”. Also included in this page is the “System Center 2012 Operations Manager Sizing Helper Tool”.

From what I can see the JEE MP hasn’t been updated. The page just got a new timestamp.

You can find the OM2012 Add-ons here.

Management Pack, SCOM 2012

System Center 2012 SP1 released

System Center 2012 SP1 has been released on TechNet and MSDN. If you have a subscription you are able to download the RTM version.

It will most likely be general available at the 3rd of January 2013.

SCOM 2012, Service Pack

Text log monitoring in Operations Manager part 2

Part 2: Log parser monitor

In part 1 I showed how to use the built-in text log rule in the Authoring Console. In this part I will create a rule that is using Log Parser to match a pattern in a text log.

In this example I will use a script-based Rule using PowerShell in the Operations Manager 2007 R2 Authoring Console.

Of course PowerShell needs to be installed on the servers your are going to monitor, also Log Parser is needed. You can download Log Parser here.

Make sure the appropriate privileges are set to the DCOM object MSUtil, either by changing the identity or setting up a RunAs account for the rule.

I used the following script in the Management Pack to call Log Parser.


1. First off create a new MP and design your Service Model in the Authoring Console.

Probe Action

2. In the Type Library pane choose Module Types -> Probe Actions.

3. Right-click the window or use the action menu and click New -> Composite Probe Action …

4. Set the ID and then Name the Probe Action.

5. In the Configuration Schema tab add the parameters to be used in the script. Set the appropriate Type.

6. In the Member Modules tab click Add… and then choose the Module Type Microsoft.Windows.PowerShellPropertyBagTriggerOnlyProbe.

7. Click Edit ..

8. Paste the script in the <ScriptBody> tags and add the <Parameters> and <TimeoutSeconds> tags.

9. Save the settings and check the Data Types tab that Trigger Only and Data Type is set to System.PropertyBagData.

10. In Options select Public if you need to access it from other Management packs. Click OK to finish.

Write Action

11. Create a new Composite Write Action in the Write Action window. Set an ID and Name.

12. In Member Modules click Add…, select the Type System.Health.GenerateAlert and name the ID.

13. Click Configure.

14. Fill in Alert name, Alert description, Priority and Severity.

15. Set the Accessibility in the Options tab. Click OK.

Data Source

16. In the Data Sources window create a new Data Source and set ID and Name.

17. In Configuration Schema add the variables in use.

18. Set the Overridable Variables.

19. In Member Modules click Add… and use System.SimpleScheduler and ModuleID.

20. Set the values for the variables in use.

21. Add the previously created Probe Action.

22. Set the variables.

23. Set the Module run order with the appropriate NextModule value.


24. Now we can create a Rule based on this. In the Health Model pane create a new Custom Rule. Set an ID, Name and target at a class.

25. In the Modules tab add the Data Source and Write Action that was created earlier.

26. Click Edit… for the Data Source and set the variable values.

The rule is now created and you can run this on servers with PowerShell and Log Parser installed.

Any feedback is appreciated.

Authoring, SCOM 2007 R2, SCOM 2012

Windows Server Print Server MP updated

The Windows Server Print server MP has been updated. Print servers running on Windows Server 2008 R2 and Windows Server 2012 is now supported.

It can be used in both Operations Manager 2007 R2 and 2012.

You can find the MP here.

Management Pack, SCOM 2007 R2, SCOM 2012

Operations Manager Integration Guide

Two days ago Microsoft announced the release of the Operations Manager Integration Guide. It provides an overview of how connectivity works between the different System Center 2012 products and other systems.

You can find the guide here.


Windows Server 2012 RDS

Today a Management pack for monitoring Windows Server 2012 Remote Desktop Services has been released. It provides monitoring for the following services:

  • RD Session Host
  • RD Virtualization Host
  • RD Licensing
  • RD Gateway
  • RD Connection Broker
  • RD Web Access

You can download it from here.

Management Pack, SCOM 2012

Authoring – Error with Event ID 11903


A custom Management Pack with a rule matching an event in the Application log isn’t generating any alerts.

Event ID 11903

Looking in the OperationsManager Event log on the monitored server I found a error with ID 11903.

This indicates that the there is a wrong datatype. A quick look in the Authoring Console shows that the matching value for the Event Level is wrong and set to a string. In the below screenshot I’ve changed the value.

After importing the MP I got the same error. Deleting it from the Management Group and importing it again solved the issue.


Author Process monitoring

In this post I will create a Process monitor in the Authoring Console. There are some pitfalls, for example the instance Count variable and to use lower-case in the process name.

1. Create an MP and a class in the Authoring console.

2. Create a discovery for your class. In my case i’ll check the registry if the spooler service is installed.

3. Now, create a reference to the process class. In Options add a reference by browsing to the folder containing

4. Next it’s time to create to monitor. Open the Health Model tab and create a new custom monitor.

5. Set a Name and Target for the previously created class.

6. Click Browse for type in the Configurations tab.

7. Choose 1 of the 4 available types from the library referenced to. In this example I’ll pick ProcessInstanceCountMonitorType.

8. Fill in ProcessName, Frekvency, Max, Min and OutOfRangeTimeThreshold. Note, the process name must be written in lower-case or the monitor will not work.

9. Set the Health of the monitor.

10. Activate alerting. To obtain the Instance count you have to get the data from the variable $Data[Default=’0′]/Context/DataItem/Item0Context/DataItem/ProcessInformations/ProcessInformation[./ProcessName =’notepad.exe’]/ActiveInstanceCount$

11. Import the MP in the SCOM Console under the Administration tab.

12. In the Monitoring tab, check that the class has been discovered.


13. When the class is instanced with the correct server(s), kill the process to test the monitor.

14. An alert will show up.

In the next blog post about process monitoring I will create a custom Monitor Type that will let you override the Min-/Max-InstanceCount thresholds.


Authoring, SCOM 2007 R2

Text log monitoring in Operations Manager part 1

Part 1: Built-in monitor

In these series of blog posts I will cover text log monitoring in SCOM.

First off, there are some limitations with the built-in monitor type for monitoring text log files on Windows servers. For example circular log files and fast re-created log files can’t be monitored. This is a known limitation and Microsoft has published a KB article with information about text- and csv-logfile monitoring. Read more here.

When using the built-in rule you can either create your monitor directly in the Operations Manager console, the Authoring console or the Visual Studio Authoring Extensions. I will demonstrate the steps in the Authoring Console.

1. Open the Authoring Console and create a new MP, Class and Discovery. (I will not cover this part in this blog post.)

2. Navigate to Health Model and Rules.

3. Right-click or use the Action menu and select New -> Alerting -> Text Log.

4. Set ID and Name of the Rule. Also target the rule at a class contained in the MP.

5. In Directory specify in which directory the log files are located on the server/servers. Pattern indicates the name of the log files. It is possible to use wildcards in the file name. If the log files use UTF8 encoding mark the check box, otherwise leave it be.

6. Next, an expression to match an event in the text log is needed. The text log entry will be passed in the parameter name “Params/Param[1]”, Using the operator Matches regular expression gives the ability to use a regexp value to match against.

A tip is to use the pipe symbol to match several values in one expression. A good resource to check your regular expression is the online RegexPal.

7. Set an Alert Name, Priority and Severity. In the Alert description put an informative text.

Finding the correct variable name to populate the alert description can sometimes be tricky. You can find some directions here:

8. Save the MP and import it in your Operations Manager environment.

In the next part I will look into using LogParser with a custom monitor.

Authoring, SCOM 2007 R2, SCOM 2012

System Center 2012 UR3 released

A new Update Rollup (UR3) for System Center 2012 has beeen released. It contains fixes for Operations Manager (KB2750631), Data Protection Manager (KB2751230) and Service Manager (KB2750615).

It can either be installed via Windows Update at the server or downloaded from the Windows Update Catalog.


Issues that has been fixed for Operations Manager:

Issue 1
When you use the 32-bit version of Windows Internet Explorer to start a web console, the Microsoft.EnterpriseManagement.Presentation.Controls.SpeedometerGaugeUIController controller does not work correctly.

Issue 2
When you run a Windows PowerShell cmdlet, you receive the following error message: Get-BPAModel is not recognized as the name of a cmdlet.

Issue 3
When you try to change a URL in the “web application availability monitoring” template instance, the change is not applied.

More information can be found here.

SCOM 2012, UR