1. Management Pack Melee: Understanding MOM 2005 Management Packs Gordon McKenna MOM – MVP Inframon Highlights

2. Management Pack Melee: Understanding MOM 2005 Management Packs Gordon McKenna MOM – MVP Inframon

3. Outline MOM 2005 Introduction What’s new for MPs with MOM 2005 State Monitoring TasksResponses Service Discovery Management Pack Tools

4. Reporting Web-based management reports Scheduled Publishing Event and performance management Enterprise event collection Rules-based filtering and consolidation Proactive alerting/action response Applications/Role Monitoring Health Model Rules libraries Built-in knowledge-base Enterprise ready Central console Full redundancy ExtensibleMCF MOM 2005 Delivers AutomationScriptsTasksDiagnostics

5. MOM Architectural Overview Key Terms Data sources Events: Windows, application, WMI, service change, SNMP traps, timed events, missing events, UNIX syslogs… Performance data: Used for graphs, reports, and to set thresholds Alerts MOMs indication of a particular issue  What operators see first Based on events, performance thresholds or script output Response Reaction to an alert (auto-resolve, send e-mail, page, run script) Management Pack (MP) Set of Processing Rules to monitor applications Supporting views and reports

6. MOM Rule: Unit Of Instruction/Policy Event Rules Collection rules Filtering rules Missing event rules Consolidation rules Duplicate Alert Suppression Performance Rules MeasuringThreshold Alert Rules Rule Provider NT event log Perfmon data WMISNMP Log files Syslog CriteriaResponse AlertScript SNMP trap PagerE-MailTask Managed Code File Transfer Where source=DCOM and Event ID=1006 Knowledge Product Knowledge Links to Vendor Company Knowledge Links to Centralised Company knowledge

7. Management Pack Overview Gordon McKenna MOM – MVP Inframon

8. What Can Management Packs Provide? Monitor line of business applications or business process Monitor the state of your business Monitor third party applications and components Understand how my applications are actually being used

9. What’s New For MPs With MOM 2005? State Monitoring Topology SQL Server Reporting Services Reports Tasks Service Discovery Improved Knowledge

10. MOM 2000 Management Packs And MOM 2005 MOM 2000 Management Packs run fine on MOM 2005 servers  Investment in MOM 2000 Management Packs preserved Exceptions MOM 2000 Access-based reports do not migrate forward to MOM 2005 Some scripts use objects that were deprecated in MOM 2000 and are gone in MOM 2005

11. Management Packs Management Pack imported via MOM Server Discovery finds computers in need of a given Management Pack MOM deploys appropriate Management Packs No need to touch managed nodes to install Management Packs Rules: Implement all MOM monitoring behavior Watch for indicators of problems Verify key elements of functionality Management Packs provide a definition of server health

12. Management Pack Features Alerts: Calls attention to critical events that require administrator intervention Product Knowledge: Provides guidance for administrators to resolve outstanding alerts Views: Provide targeted drill down details about server health Performance plots, collections of specific events/alerts, groups of servers, topology, etc. State Monitoring: At a glance view of the state of my servers and applications by server role Detail to component level Tasks: Enable administrators to investigate and repair issues from the MOM console Context sensitive diagnostics and remediation Reports: Historical data analytics Assess operations performance and capacity planning

13. Health And Diagnostic Modeling Concept What is a Health Model? Health States State Transitions: Defined by indicators (e.g., events) Organizes health indicators into an end-user digestible context Alert = actionable health state transition

14. Health Modeling Process List all Events and Performance Counters Analyze each Event and Performance Threshold For each define State Before, State After Probability Auto-Retry (self-healing) “Anti Event” (indicates situation was corrected) Resolution (action required) Analyze data to define Event and Performance Threshold Groups (e.g., EG1;PG1) Produce Health Model Diagram

15. Example: Cluster Health Model

16. Example: Cluster Management Pack Health model translates into 38 rules Most rules fairly straightforward Match event source Match one or more event IDs Example: Quorum Space Alert Source = Clussvc ID = 1170, 1171, 1021 or 1022

17. State Rules Advantages State is always current “What is the server status now?” Problem taxonomy What aspect of my server is having the problem? Role (Exchange, DNS, etc.) Component (Services, Queues, Mail Flow, Databases) Typical candidates for state-based rules Numeric thresholds (e.g., perf counters) Service State

18. State Terminology

19. Event Monitoring Event rules can be used for state monitoring An event rule which adjusts state must match at least two event IDs using a regular expression Regular expressions are written in the form 1 | 2 | 3 and wrapped with ^(expression)$ to prevent mismatches

20. Event Monitoring in Action Rule - Microsoft Operations Manager\Operations Manager 2005\Agents on all MOM roles\The incoming agent queue is full

21. Performance Monitoring Query and threshold Windows Performance counters as part of your management pack Specify counter attributes to query ObjectCounterInstance Excellent targets for easy state monitoring

22. Performance Monitoring in Action Rule - Microsoft Operations Manager\Operations Manager 2005\Agent\Performance Threshold: MOM Service CPU

23. Internal Service Monitoring Monitors for service changes and status Scripts no longer required for service monitoring in MOM Interrogates the Service Control Manager (SCM) to determine service state Internal MOM events contain details of service changes and state

24. Internal Service Monitoring Event Details Event ID 21207 Source ”Microsoft Operations Manager” 1- Number of seconds from last sample 2 - Display Name 3 - Old State 4 - New State 5 - Service Name (Internal Service Name) 6 - Start Up Type 7 - Service Context 8 - Old State (numeric) 9 - New State (numeric, e.g., 1= stopped) 10 - Start Up Type (numeric, e.g., 2 = automatic start)

25. Internal Service Monitoring in Action Rule - Microsoft Operations Manager\Operations Manager 2005\Agents on all MOM roles\The WMI Service is not running

26. State Monitoring Gordon McKenna MOM – MVP Inframon

27. Management Pack Wizard Ships in the MOM 2005 Resource Kit Build a management pack in 5 clicks containing Rule Groups Service Monitoring Performance Thresholds Event Monitoring The wizard automatically generate scripts and underlying logic including regular expressions

28. Management Pack Wizard Gordon McKenna MOM – MVP Inframon

29. Tasks Tasks provide the ability to execute on demand diagnostics, corrective actions and automation processes Tasks are executed by the administrator from the Management Server Task scenarios Automate a complex set of steps required to solve a common problem Provide additional information required to diagnose a problem Run administrative tools in context direct from the MOM server

30. Task Types Command-line Execute Windows or Application command line tools Operator Console: The tasks command line is predefined Management Server or Agent Managed computer: Command line parameters are modifiable Script Executes custom scripts that are available inside MOM Task scripts can use MOM Scripting Objects Managed Code Execute managed code methods File Transfer Leverage the file transfer response to transfer a file through a task

31. Tasks Availability Console Tasks AlertsEvents Computers (including all views except groups) Agent-Targeted Tasks Computers (including events and alert views) Computer groups (run once for each computer in the group) Binaries used by tasks must be present on computer where the tasks will execute

32. Task Output And Security Tasks Output Console task output available in task dialog Agent or Management Server task output is available as MOM internal events Leverage events 9897, 9898, and 9899 in your management packs to display task results Security “MOM Users” can not execute Agent or Management Server tasks Task audit events provide details on how the task was executed

33. Task Authoring Gordon McKenna MOM – MVP Inframon

34. Responses Responses run on timed basis or when a given condition is observed Investigate/Resolve issue Perform advanced monitoring Response types Script Execute a command Update a state variable File Transfer Managed Code Response Note: Responses can now be run before alert suppression Send notifications or perform responses even if the MOM database is not available

35. Response Execution Script and Managed Code responses execute under the dedicated Action Account Processes are hosted in the MOMHost process Dedicated Host process per management group Multiple instances of the same script can run at the same time The MOMHost process is monitored by MOM Script Action Account

36. Command Line Response Command line responses can now be managed by the MOM run time Response timeout may be specified per response!

37. Script Responses Script responses are significantly improved and more reliable with the MOMHost process Response timeout is now specified per script

38. Managed Code Response Managed code responses execute predefined managed code assemblies A response may be executed by a rule or task MOM does not distribute assemblies Responses can leverage any.NET language Visual Basic.NET, C#, C++.NET Response execute any publicly exposed method in your assembly

39. Managed Code Response

40. File Transfer Response The file transfer response leverages BITS to transfer files between computers via port 80 File Transfer responses may Download files to the agent Upload files from the agent File transfer responses may be called from either rules or tasks

41. File Transfer Scenarios Upload transaction log files to a central location Archiving data as required by law Upload a file to assist with troubleshooting Have a task upload data on demand from the agent Download a file to the MOM Agent required by a Management Pack

42. Responses Gordon McKenna MOM – MVP Inframon

43. Service Discovery Service discovery is the mechanism MOM uses to discover information about what it is monitoring. Service discovery is used for: Instances – discovery instances of the role you are monitoring. For example Drive Instances, SQL Server Instances, Queue Instances Attributes – information about the instances you are monitoring. For example Drive Type, SQL Server Version, Queue Name

44. Service Discovery Sample

45. Service Discovery Gordon McKenna MOM – MVP Inframon

46. Diagram Authoring Develop custom topologies to help monitor the health of your application or service Authors can define custom topology shapes and annotations Wizard driven development experience

47. Diagram Authoring Wizard Wizard driven creation of diagram topologies Visual selection of diagram types, routing and placements styles Diagram preview including nodes, groups, lines, annotations and tooltips as well as the ability to export to Visio and print your topology Shape and Annotation Import (including the ability to edit hotspot and Visio settings from the tool) Intelligent automatic selection of diagram and routing styles Automatic default selection of classes and relationships

48. Diagram Authoring Gordon McKenna MOM – MVP Inframon

49. Management Pack XML Management Packs can now be converted to XML using tools from the Management Pack Toolkit Management Pack XML can be used for Documentation Change control Understanding management pack internals Configuration queries Management Pack XML is not supported by Microsoft and the XML schema will likely change in future releases of MOM

50. Differencing Scenarios What changes have I made to optimize my management pack? Are my management packs the same? Is the management pack version running in my branch office the same as my master copy? What has Microsoft changed with this service release of the management packs I am running and how will it affect me?

51. Management Pack Tools Gordon McKenna MOM – MVP Inframon

52. Stay Current Sign up for Management Newsletter Notice of updates to New & Updated Management Packs Microsoft Management Product News Solutionshttp://www.microsoft.com/management/notifyme/

53. MOM Resources Microsoft Operations Manager http://www.microsoft.com/MOM Getting Started Resources http://www.microsoft.com/MOM/Beginners Technical Walkthrough Key Documentation MOM Evaluation Download Partner Product Catalog http://www.microsoft.com/MOM/ManagementPacks MOM Community http://www.microsoft.com/MOM/community/ Solution Accelerators http://www.microsoft.com/mom/evaluation/solutions/default.mspx

54. Gordon McKenna MOM – MVP (UK) Microsoft Management Specialist Inframon Ltd gordon@inframon.com www.inframon.com 07873 830790

55. Questions

56. © 2005 Microsoft Corporation. All rights reserved. This presentation is for informational purposes only. Microsoft makes no warranties, express or implied, in this summary.