No On Premise OS “Ecks” SCCM Zed Yes On Premises OS “Ten” (OS X) ConfigMgr Zee Get It Right!

Collection Evaluation and SuchCollection Evaluation and Such Session Subtitle Kim Oppalfens Twitter Handle Blog or address Jason

Junior Consultant (Job Titles go by Age) 17 years professional experience 12 years CM 10+ years MVP Belgium Kim Oppalfens

Principal Consultant 15+ Years San Antonio, TX Jason Sandys Forums, Blog

Overview A-FH-MO-SV-Z.ADC filesHistorical BehaviorOne Million x 10Collection evaluation Viewer Best/Bad practicesIncremental UpdateStored ProceduresWhy are you here Colleval.logJasonCollection QueriesEXclusion rules Direct MembershipKimRBAYOLO Extended Events (SQL)Limiting CollectionsSql TempDBZ or Zed Full update evaluationManual Update Membership Sql Triggers Collection_GNon-Indexed fields.Udc files in inbox J

Why Do We Care Collections are the core of most everything Collection basics have changed drastically The exact behavior of updates isn’t exactly deeply documented J

Rule TypesRule Types

Direct Membership Effects Collection A ResourceID Collection A Full Collection Evaluation On Collection A J

Include and Exclude Rules Collection A Collection B Collection C Include Exclude Depends On Collection X Limited To Depends On J

Collection Evaluation in Hierarchies CAS Reason #513 why not to use a CAS unless you have to Primary Site APrimary Site B Collection evaluation occurs on the primary sites J

Collection Membership Evaluation

Demo Logs & Tools J

Collection Evaluation Types Full Incremental Manual Primary evaluation Express evaluation Single evaluation Auxiliary evaluation J

Full Collection Evaluation Overview K CollectionRules Queries Dependency Chain Graph Temp TableCollectionMembers Table v_R_System_Valid View

Limiting Collections and Evaluation Direct Rules Query Rules Includes Excludes } #colltemp table K CollectionMembers table Applied to Limiting Collection CollectionMembers table + where CollectionID

Incremental Evaluation Differences K CollectionNotifications DB Trigger DB Change CollectionMembers Table

How Many Collections with Incremental Enabled? 10,000,000 / C * 0.7 I = Incremental Collection Evaluation Interval C -> CollectionNotifications table C = The number of changes within I C -> collevel.log 10,000,000 K

Items That Impact Change Rate Hardware Inventory Frequency Hardware Inventory Often Changing Attributes Discovery Frequency v_CH_ClientSumma ry J

Kill incremental evaluation with a single query SELECT * FROMSMS_R_System sys INNER JOINSMS_G_System_CH_ClientSummary CHS ON chs.ResourceId = sys.ResourceId WHERE chs.LastMPServerName = "EvilJoe.oscc.be" J

Find tables causing large number of changes SELECTtablename, count(*) FROM CollectionNotifications GROUP BYtableName ORDER BYcount(*) DESC

Query OptimizationQuery Optimization

Optimization Hints Use indexed fields Use LIKE with double wildcards Use LIKE with negation queries (NOT) Use LIKE sparingly Create incremental collections based of CI Compliance K

Interesting Indices SystemResource Netbios Name Sid Client Obsolete Decommisioned Active User Discovery Unique User Name User Principal Name Sid Mail Distinguished Name Clouduserid Hardware Inventory: Installed Software MachineId SoftwarepropertiesHash Productname Productversion Publisher Hardware Inventory: Recently Used Applications MachineId Filedescription Explorerfilename ProductName Productcode msidisplayname LastUsername K

Use Indexed Columns USE CM_Sitecode SELECT TableName = t.name, IndexName = ind.name, IndexId = ind.index_id, ColumnId = ic.index_column_id, ColumnName = col.name, ind.*, ic.*, col.* FROM sys.indexes ind INNER JOIN sys.index_columns ic ON ind.object_id = ic.object_id and ind.index_id = ic.index_id INNER JOIN sys.columns col ON ic.object_id = col.object_id and ic.column_id = col.column_id INNER JOIN sys.tables t ON ind.object_id = t.object_id WHERE ind.is_primary_key = 0 AND ind.is_unique = 0 AND ind.is_unique_constraint = 0 AND t.is_ms_shipped = 0 ORDER BYt.name, ind.name, ind.index_id, ic.index_column_id K

SQL (If we have time)

SQL Internals Use SQL extended events to monitor SMS_Collection_evaluator CM_Sitecode - The trigger happy database Enable Verbose logging for the sms_collection evaluator J

Use SQL extended events to monitor ALTER EVENT SESSION [SMS Remote procedures executing] ON SERVER DROP EVENT sqlserver.rpc_completed WITH (TRACK_CAUSALITY=ON) ALTER EVENT SESSION [SMS Remote procedures executing] ON SERVER ADD EVENT sqlserver.rpc_completed(SET collect_statement=(1) ACTION(package0.callstack,package0.collect_system_time,package0.process_id,sqlo s.task_time,sqlserver.client_app_name,sqlserver.client_connection_id,sqlserver. client_hostname,sqlserver.client_pid,sqlserver.database_id,sqlserver.database_n ame,sqlserver.nt_username,sqlserver.server_instance_name,sqlserver.server_princ ipal_name,sqlserver.server_principal_sid,sqlserver.sql_text,sqlserver.username) WHERE ([sqlserver].[equal_i_sql_unicode_string]([sqlserver].[database_name],N'CM_KIM' ))) GO

Queries select SMS_R_SYSTEM.ResourceID,SMS_R_SYST EM.ResourceType,SMS_R_SYSTEM.Name,S MS_R_SYSTEM.SMSUniqueIdentifier,SMS_R _SYSTEM.ResourceDomainORWorkgroup,SM S_R_SYSTEM.Client from SMS_R_System inner join SMS_G_System_INSTALLED_SOFTWARE on SMS_G_System_INSTALLED_SOFTWARE.R esourceId = SMS_R_System.ResourceId where SMS_G_System_INSTALLED_SOFTWARE.A RPDisplayName = "Microsoft Office Professional Plus 2013" select SMS_R_SYSTEM.ResourceID,SMS_R_SYST EM.ResourceType,SMS_R_SYSTEM.Name,S MS_R_SYSTEM.SMSUniqueIdentifier,SMS_R _SYSTEM.ResourceDomainORWorkgroup,SM S_R_SYSTEM.Client from SMS_R_System inner join SMS_G_System_INSTALLED_SOFTWARE on SMS_G_System_INSTALLED_SOFTWARE.R esourceId = SMS_R_System.ResourceId where SMS_G_System_INSTALLED_SOFTWARE.Pr oductName = "Microsoft Office Professional Plus 2013" Modifications 1.Installed Software product name indexed field in where clause as opposed to Non- indexed add remove programs arpdisplayname Result 1.Query1: 102,69 seconds 2.Query2: 6,3 seconds Query based collections (1)

Queries select R.ResourceID,R.ResourceType,R. Name,R.SMSUniqueIdentifier,R.R esourceDomainORWorkgroup,R.C lient from SMS_R_System as r full join SMS_R_System as s1 on s1.ResourceId = r.ResourceId full join SMS_R_System as s2 on s2.Name = s1.Name where s1.Name = s2.Name and s1.SID != s2.SID order by r.Name select R.ResourceID,R.ResourceType,R. Name,R.SMSUniqueIdentifier,R.R esourceDomainORWorkgroup,R.C lient from SMS_R_System as r inner join SMS_R_System as s2 on s2.Name = r.Name where r.NetbiosName = s2.NetbiosName and r.SID != s2.SID Modifications 1.Inner joins vs full joins 2.1 additional SMS_r_system join, not 2 3.Netbiosname indexed name in where clause as opposed to Non-indexed name 4.No Order by (useless in a collection query) Result 1.Query1: 153,17 seconds 2.Query2: 1,1 seconds Query based collections –duplicates (2)

Overview A-FH-MO-SV-Z.ADC filesHistorical BehaviorOne Million x 10Collection evaluation Viewer Best/Bad practicesIncremental UpdateStored ProceduresWhy are you here Colleval.logJasonCollection QueriesEXclusion rules Direct MembershipKimRBAYOLO Extended Events (SQL)Limiting CollectionsSql TempDBZ or Zed Full update evaluationManual Update Membership Sql Triggers Collection_GNon-Indexed fields.Udc files in inbox J

Changes Along the Way Important objects in collection evaluation Tables:CollectionMembers, collection_rules, collection_rules_sql, collections_g, collections_l, collectionqueryruletables, collectionnotifications SP’s: sp_transfermemberhip, sp_getcollectionsmarkedforevaluation, spcollbeginincevaluation, spcollendincevaluation Functions: fn_collectiondependencychain

Thou Shallt Not Create incremental collections based of CI Compliance

Evaluations: Please provide session feedback by clicking the EVAL button in the scheduler app (also download slides). One lucky winner will receive a free ticket to the next MMS! Session Title: Discuss… Ask your questions-real world answers! Plenty of time to engage, share knowledge. SPONSORS