Management Pack Melee: Understanding MOM 2005 Management Packs Gordon McKenna MOM – MVP Inframon Highlights

Management Pack Melee: Understanding MOM 2005 Management Packs Gordon McKenna MOM – MVP Inframon

Outline MOM 2005 Introduction What’s new for MPs with MOM 2005 State Monitoring TasksResponses Service Discovery Management Pack Tools

Reporting Web-based management reports Scheduled Publishing Event and performance management Enterprise event collection Rules-based filtering and consolidation Proactive alerting/action response Applications/Role Monitoring Health Model Rules libraries Built-in knowledge-base Enterprise ready Central console Full redundancy ExtensibleMCF MOM 2005 Delivers AutomationScriptsTasksDiagnostics

MOM Architectural Overview Key Terms Data sources Events: Windows, application, WMI, service change, SNMP traps, timed events, missing events, UNIX syslogs… Performance data: Used for graphs, reports, and to set thresholds Alerts MOMs indication of a particular issue  What operators see first Based on events, performance thresholds or script output Response Reaction to an alert (auto-resolve, send , page, run script) Management Pack (MP) Set of Processing Rules to monitor applications Supporting views and reports

MOM Rule: Unit Of Instruction/Policy Event Rules Collection rules Filtering rules Missing event rules Consolidation rules Duplicate Alert Suppression Performance Rules MeasuringThreshold Alert Rules Rule Provider NT event log Perfmon data WMISNMP Log files Syslog CriteriaResponse AlertScript SNMP trap Pager Task Managed Code File Transfer Where source=DCOM and Event ID=1006 Knowledge Product Knowledge Links to Vendor Company Knowledge Links to Centralised Company knowledge

Management Pack Overview Gordon McKenna MOM – MVP Inframon

What Can Management Packs Provide? Monitor line of business applications or business process Monitor the state of your business Monitor third party applications and components Understand how my applications are actually being used

What’s New For MPs With MOM 2005? State Monitoring Topology SQL Server Reporting Services Reports Tasks Service Discovery Improved Knowledge

MOM 2000 Management Packs And MOM 2005 MOM 2000 Management Packs run fine on MOM 2005 servers  Investment in MOM 2000 Management Packs preserved Exceptions MOM 2000 Access-based reports do not migrate forward to MOM 2005 Some scripts use objects that were deprecated in MOM 2000 and are gone in MOM 2005

Management Packs Management Pack imported via MOM Server Discovery finds computers in need of a given Management Pack MOM deploys appropriate Management Packs No need to touch managed nodes to install Management Packs Rules: Implement all MOM monitoring behavior Watch for indicators of problems Verify key elements of functionality Management Packs provide a definition of server health

Management Pack Features Alerts: Calls attention to critical events that require administrator intervention Product Knowledge: Provides guidance for administrators to resolve outstanding alerts Views: Provide targeted drill down details about server health Performance plots, collections of specific events/alerts, groups of servers, topology, etc. State Monitoring: At a glance view of the state of my servers and applications by server role Detail to component level Tasks: Enable administrators to investigate and repair issues from the MOM console Context sensitive diagnostics and remediation Reports: Historical data analytics Assess operations performance and capacity planning

Health And Diagnostic Modeling Concept What is a Health Model? Health States State Transitions: Defined by indicators (e.g., events) Organizes health indicators into an end-user digestible context Alert = actionable health state transition

Health Modeling Process List all Events and Performance Counters Analyze each Event and Performance Threshold For each define State Before, State After Probability Auto-Retry (self-healing) “Anti Event” (indicates situation was corrected) Resolution (action required) Analyze data to define Event and Performance Threshold Groups (e.g., EG1;PG1) Produce Health Model Diagram

Example: Cluster Health Model

Example: Cluster Management Pack Health model translates into 38 rules Most rules fairly straightforward Match event source Match one or more event IDs Example: Quorum Space Alert Source = Clussvc ID = 1170, 1171, 1021 or 1022

State Rules Advantages State is always current “What is the server status now?” Problem taxonomy What aspect of my server is having the problem? Role (Exchange, DNS, etc.) Component (Services, Queues, Mail Flow, Databases) Typical candidates for state-based rules Numeric thresholds (e.g., perf counters) Service State

State Terminology

Event Monitoring Event rules can be used for state monitoring An event rule which adjusts state must match at least two event IDs using a regular expression Regular expressions are written in the form 1 | 2 | 3 and wrapped with ^(expression)$ to prevent mismatches

Event Monitoring in Action Rule - Microsoft Operations Manager\Operations Manager 2005\Agents on all MOM roles\The incoming agent queue is full

Performance Monitoring Query and threshold Windows Performance counters as part of your management pack Specify counter attributes to query ObjectCounterInstance Excellent targets for easy state monitoring

Performance Monitoring in Action Rule - Microsoft Operations Manager\Operations Manager 2005\Agent\Performance Threshold: MOM Service CPU

Internal Service Monitoring Monitors for service changes and status Scripts no longer required for service monitoring in MOM Interrogates the Service Control Manager (SCM) to determine service state Internal MOM events contain details of service changes and state

Internal Service Monitoring Event Details Event ID Source ”Microsoft Operations Manager” 1- Number of seconds from last sample 2 - Display Name 3 - Old State 4 - New State 5 - Service Name (Internal Service Name) 6 - Start Up Type 7 - Service Context 8 - Old State (numeric) 9 - New State (numeric, e.g., 1= stopped) 10 - Start Up Type (numeric, e.g., 2 = automatic start)

Internal Service Monitoring in Action Rule - Microsoft Operations Manager\Operations Manager 2005\Agents on all MOM roles\The WMI Service is not running

State Monitoring Gordon McKenna MOM – MVP Inframon

Management Pack Wizard Ships in the MOM 2005 Resource Kit Build a management pack in 5 clicks containing Rule Groups Service Monitoring Performance Thresholds Event Monitoring The wizard automatically generate scripts and underlying logic including regular expressions

Management Pack Wizard Gordon McKenna MOM – MVP Inframon

Tasks Tasks provide the ability to execute on demand diagnostics, corrective actions and automation processes Tasks are executed by the administrator from the Management Server Task scenarios Automate a complex set of steps required to solve a common problem Provide additional information required to diagnose a problem Run administrative tools in context direct from the MOM server

Task Types Command-line Execute Windows or Application command line tools Operator Console: The tasks command line is predefined Management Server or Agent Managed computer: Command line parameters are modifiable Script Executes custom scripts that are available inside MOM Task scripts can use MOM Scripting Objects Managed Code Execute managed code methods File Transfer Leverage the file transfer response to transfer a file through a task

Tasks Availability Console Tasks AlertsEvents Computers (including all views except groups) Agent-Targeted Tasks Computers (including events and alert views) Computer groups (run once for each computer in the group) Binaries used by tasks must be present on computer where the tasks will execute

Task Output And Security Tasks Output Console task output available in task dialog Agent or Management Server task output is available as MOM internal events Leverage events 9897, 9898, and 9899 in your management packs to display task results Security “MOM Users” can not execute Agent or Management Server tasks Task audit events provide details on how the task was executed

Task Authoring Gordon McKenna MOM – MVP Inframon

Responses Responses run on timed basis or when a given condition is observed Investigate/Resolve issue Perform advanced monitoring Response types Script Execute a command Update a state variable File Transfer Managed Code Response Note: Responses can now be run before alert suppression Send notifications or perform responses even if the MOM database is not available

Response Execution Script and Managed Code responses execute under the dedicated Action Account Processes are hosted in the MOMHost process Dedicated Host process per management group Multiple instances of the same script can run at the same time The MOMHost process is monitored by MOM Script Action Account

Command Line Response Command line responses can now be managed by the MOM run time Response timeout may be specified per response!

Script Responses Script responses are significantly improved and more reliable with the MOMHost process Response timeout is now specified per script

Managed Code Response Managed code responses execute predefined managed code assemblies A response may be executed by a rule or task MOM does not distribute assemblies Responses can leverage any.NET language Visual Basic.NET, C#, C++.NET Response execute any publicly exposed method in your assembly

Managed Code Response

File Transfer Response The file transfer response leverages BITS to transfer files between computers via port 80 File Transfer responses may Download files to the agent Upload files from the agent File transfer responses may be called from either rules or tasks

File Transfer Scenarios Upload transaction log files to a central location Archiving data as required by law Upload a file to assist with troubleshooting Have a task upload data on demand from the agent Download a file to the MOM Agent required by a Management Pack

Responses Gordon McKenna MOM – MVP Inframon

Service Discovery Service discovery is the mechanism MOM uses to discover information about what it is monitoring. Service discovery is used for: Instances – discovery instances of the role you are monitoring. For example Drive Instances, SQL Server Instances, Queue Instances Attributes – information about the instances you are monitoring. For example Drive Type, SQL Server Version, Queue Name

Service Discovery Sample

Service Discovery Gordon McKenna MOM – MVP Inframon

Diagram Authoring Develop custom topologies to help monitor the health of your application or service Authors can define custom topology shapes and annotations Wizard driven development experience

Diagram Authoring Wizard Wizard driven creation of diagram topologies Visual selection of diagram types, routing and placements styles Diagram preview including nodes, groups, lines, annotations and tooltips as well as the ability to export to Visio and print your topology Shape and Annotation Import (including the ability to edit hotspot and Visio settings from the tool) Intelligent automatic selection of diagram and routing styles Automatic default selection of classes and relationships

Diagram Authoring Gordon McKenna MOM – MVP Inframon

Management Pack XML Management Packs can now be converted to XML using tools from the Management Pack Toolkit Management Pack XML can be used for Documentation Change control Understanding management pack internals Configuration queries Management Pack XML is not supported by Microsoft and the XML schema will likely change in future releases of MOM

Differencing Scenarios What changes have I made to optimize my management pack? Are my management packs the same? Is the management pack version running in my branch office the same as my master copy? What has Microsoft changed with this service release of the management packs I am running and how will it affect me?

Management Pack Tools Gordon McKenna MOM – MVP Inframon

Stay Current Sign up for Management Newsletter Notice of updates to New & Updated Management Packs Microsoft Management Product News Solutionshttp://

MOM Resources Microsoft Operations Manager Getting Started Resources Technical Walkthrough Key Documentation MOM Evaluation Download Partner Product Catalog MOM Community Solution Accelerators

Gordon McKenna MOM – MVP (UK) Microsoft Management Specialist Inframon Ltd

Questions

© 2005 Microsoft Corporation. All rights reserved. This presentation is for informational purposes only. Microsoft makes no warranties, express or implied, in this summary.