Different Alert Levels

In MOM 2005 there are the following alert levels.

Level	Values	Description
Service Unavailable	70	The application is 100 percent unavailable.
Security Breach	60	The security of the application has already been compromised, or someone is attempting to expose a vulnerability.
Critical Error	50	The application requires action to correct an error condition.
Error	40	The application is experiencing transient errors that do not require action, or do not require immediate action.
Warning	30	The event does not require immediate action, or does not require any action.
Information	20	The application raises an informational event.
Success	10	A significant task has occurred successfully.

In SCOM 2007 you only appear to get Information, Warning and Critical. Instead of 7 levels there are now 3. A number of organisations want a “simple traffic light system” so three levels works for them but it is not very sophisticated for some organisations. There is however a new field called priority and this can be Low, Medium or High and works for each level so in effect you have 9 levels to work with.

Critical (2)	High (2)
	Medium (1)
	Low (0)
Warning (1)	High (2)
	Medium (1)
	Low (0)
Information (0)	High (2)
	Medium (1)
	Low (0)

This can be displayed in the alerts console as in 2007 you can group alerts according to a number of fields and you can have 3 levels of groupings. Personalize the view:

And you see

While it may help is sorting out alerts to prioritise I believe the advantage comes when using SMS text messages. If I am on call overnight I would only want to get alerts that are Critical and High. So creating an SMS Notification Subscription for that becomes easier. Although I believe the time zones should be in the Notification Subscriptions and not in the Notification Recipients as is done in 2007.

In the table I have also added numbers. That is because when you do overrides sometimes you get the words and sometimes you get the numbers. For example for Warning Medium in numbers:

And Critical Medium with words:

So if you are changing these with overrides bear in mind that it could be either words or numbers.

SP1 RC to SP1 RTM Upgrade

My demo system consists of 2 Windows 2003 SP2 VMs with one being a DC and the other being an OpsMgr server with SQL 2005 SP2, the RMS role, web role, reporting role and a console.

The upgrade went smoothly and similar to Cameron’s (see his screen shots here). After doing the RMS upgrade I then did reporting and that went smoothly as well.

My RMS was up at 6278 and my DC was still 6246 and when I looked at the Pending view the server was listed. I right clicked and chose Approve and the agent was successfully updated. I did not run into the not in pending so do repair problem as mentioned by Clive but it is a small demo system.

I have noticed some funnies but as this system has been MOM then SCOM then SP1 RC, lots of MP updates and now SP1 it may have existed beforehand.

When installing the status screen mentions updating MPs. And when I looked at the list the core ones had been updated but not all.

I imported the latest ones from the extracted SP1 directory and brought them up to date but looking through I noticed an MP (Notifications Library) with a high number (6.0.9010).

May have been there before but I have not seen it. Not sure why it has such a high version number.

The other funny I saw with my SCOM system (which may have been there before) was that the server hits 100% utilisation for 5 to 6 seconds and does that every 50 seconds. The culprit is w3wp.exe used by the Data Reader account. There are a couple of KBs about this relating to IIS and OWA but fixed with SP2 which is installed. I restarted the OpsMgr server and the problem still occurs but at a lower frequency. I used the iisapp.vbs script and saw that only the web console and the report server web apps were running and it was the report server web app. But the server had just been rebooted with no activity going on. Is anyone else seeing this or is it just something weird with my demo VM?

Not Faulty – Just Documented

Pontus points out the the CPU utilisation is not enabled in the SP1 Windows Server management pack.

It is not really a fault with SP1 as it is a management pack. And although the MPs have been revved to go with the SP1 version I am not sure what has changed to give them a new number. Not much I suspect but I would like to know if anything has changed, what and why.

It is not really a fault of the MP as it is clearly documented in the MP guide that the CPU discovery is switched off and how to switch it on. So you can not call it a bug. Even although there is also a KB for it which was done in January and the document was done in October last year.  You may be surprised that it is not switched on by default but as long as it is clearly documented then it is a choice for each installation. I have found that with 2005 it was useful to read the MP guides but with 2007 it is essential.

Be careful with where you get the documentation. I checked if there was a later copy at the main list of documents to download at http://www.microsoft.com/downloads/details.aspx?FamilyID=d826b836-59e5-4628-939e-2b852ed79859&DisplayLang=en but the Windows Server MP Guide document there was March 2007 but I have one dated October 2007 which was included as part of the updated MP download. That was the silly one where they just updated the document and wrapped it up in the MP MSI download even although the MP had not changed. The trouble with this page is that it just gives a list of documents, their file sizes and a download button. There is no date or version number in the table. In fact the documents don’t include a version number any more.  I liked it when they did. For example I knew I had the latest MOM 2005 Security Guide as it was v1.3.  Another example is the Key Concepts paper which was released in Nov but there is a second version and that has a date of 14th Nov. Confusing of you don’t have both. A version number would have helped.

In the Microsoft Download area choosing Microsoft System Center Operations Manager as my product in the advanced search I can see the last update of the Windows Server MP was 17 Jan 2008.

Management Pack Release History:
Initial Release 3/23/2007 Version 6.0.5000.0
9/28/2007 – Updated release Version 6.0.5000.25
10/23/2007 – Updated MP Guide – Software Version still 6.0.5000.25
11/8/2007 – Updated MP Guide – Software version still 6.0.5000.25
1/15/2008 – Updated Guide – same version

Download the MSI yields up the Oct 2007 guide even though the list says the guide was updated in October, November and January if you are to believe the history. But why is that not reflected in the list of docs to download?

By the way this management pack install must have the most frightening dialogue box ever.

If you go to the Product Documentation page (my favourite page) at http://technet.microsoft.com/en-us/opsmgr/bb498235.aspx you get a list of the docs and guides with a release date and the ability to read some online.

Unfortunately this page confuses you even more. Take the Key Concepts paper. It is listed as 4th Nov (so the first one and not the 14th update). Follow the link and the download page says it was published on the 10th December and it is version 1.0 but you get the right doc when you download.

The Windows Server MP guide says 27th March and it is. Not the October update. What a mess the site is. You can not guarantee that you are working with the latest document and there isn’t even a list to say what all the documents are and the latest update so that you can check.

Suggestions for Microsoft

1. Ensure that all docs have a version number as well as a date
2. Ensure that the list of docs at the above link have a date and version number beside them
3. Update the dates and links on the Product Documentation page
4. Don’t wrap a doc in an MSI with an MP if that is the only change
5. If a document changes make sure that all links refer to the updated document and not an old document
6. Create a page with a list of all documents done and the latest version and keep that page up to date.

It is hard enough keeping up to date without having to work out where to find the latest document.

SCOM SP1

Well it is finally out and if you are using SP1 RC you can upgrade from that as well as the RTM version.

http://technet.microsoft.com/en-us/opsmgr/cc280350.aspx

This is the SP1 upgrade package

http://www.microsoft.com/downloads/details.aspx?FamilyId=EDE38D83-32D1-46FB-8B6D-78FA1DCB3E85&displaylang=en

Clive has a good post on the upgrade path as well as the order to do the parts and how to prepare the management group for the upgrade.

http://blogs.technet.com/cliveeastwood/archive/2008/02/22/operations-manager-2007-service-pack-1-rtm-upgrade-guide.aspx

A long but detailed article that is essential reading if you are upgrading. Also check Kevin’s article as he found that the SDK account did not have enough rights.

http://blogs.technet.com/kevinholman/archive/2008/02/23/opsmgr-sp1-is-here.aspx

If you want to try SCOM with SP1 the eval copy is here

http://www.microsoft.com/downloads/details.aspx?FamilyId=C3B6A44C-A90F-4E7D-B646-957F2A5FFF5F&displaylang=en

It does not say how long the evaluation is valid for but it is possible to upgrade this to a full version.

Clive and Kevin mention that the SP1 is versioned at 06.0.6278.0000.

The documentation is still in the process of being updated. Some nice new features mentioned at Nexus are

What’s included in Service Pack 1?

Operations Manager 2007 SP1 addresses critical customer-initiated issues, including improved deployment, performance, reporting, and enhanced support. 

Highlighting some of the key new features and enhancements:

1. New capability to export Operations Manager 2007 diagrams to Microsoft Visio VDX file format.
2. New ability to publish reports to multiple locations, such as Microsoft Windows SharePoint Services Web sites.
3. Improved performance and reliability across the product, such as when working with alerts, overrides, and searches.
4. Enhanced “advanced search” by improved the ability to search across monitors and rules by their overrides.
5. Simplifying the creation of new management packs by allowing users to copy views from existing management packs to an unsealed management pack.
6. New ability view performance data through the Operations Manager Web console, and setup filters for desired performance counters to ease searching and navigation.
7. New discoveries and views added to the Audit Collection Services (ACS), along with new monitors and alerts to track the health of ACS collectors.
8. Enhanced backup and recovery with the introduction of an easier-to-use Secure Storage Backup Wizard.

… and much, much more!!

Clive has a longer and more detail list at

http://blogs.technet.com/cliveeastwood/archive/2008/02/22/operations-manager-2007-service-pack-1-rtm-has-released.aspx

Plus a list of SP1 fixes from Clive

http://blogs.technet.com/cliveeastwood/archive/2008/02/22/operations-manager-2007-service-pack-1-fixlist.aspx

But as Clive mentions support for Windows 2008 will be in the next 90 days.

http://blogs.technet.com/cliveeastwood/archive/2008/02/22/a-note-on-operations-manager-2007-service-pack-1-support-for-windows-server-2008.aspx

Clive has been busy! Now it’s our turn.

MP Assumptions

You would think that by now the major management packs from Microsoft would be settled, especially as many have them have been through a few updates over 6 years. It would be an assumption that many people installing MOM or SCOM for the first time would make – especially based on the marketing. But a number of posts recently made me think about how untrue that is.

Kerrie and Cameron post about how CPU % utilisation monitors don’t work as the Windows 2003 process class discovery is disabled by default. This is bizarre as every customer I have talked to wants to know about CPU utilisation. KB 948097.

Blake Mengotto, Discuss It Now mentions ongoing issues with the Exchange 2003 and 2007 MPs with MOM 2005. As this MP has been around for a long time and one of the major sellers of MOM and SCOM you would think it would be perfect by now. As anyone who has tried to use the wizard to do the advanced front end monitoring knows this is not so. And in 2007 the Exchange Back End server can not be detected as such if it is clustered. KB 948095. Worked OK in 2005.

Pete writes about how some baseline monitors in the Exchange MP are not appropriate.

Pontus Blomqvist mentions that the new SQL MP now has the SQL 2000 Blocking Analysis as active but alerting is disabled! You win some you lose some.

If you are using the console to keep track of alerts you could be in for a surprise as 2007 will groom alerts that are not resolved. See Pontus’s post. Also Kevin mentions that failed tasks are not groomed. And that in the OM MP the MP Notifier rule is not working.

If you think that MOM 2005 AD/DNS MP did things that 2007 does not do you would be right. Fortunately Matt has created an extended custom MP.

So basically you can not assume that any MP is 100% fault free. It would be nice to have full documentation by the MP creators of the FULL contents of their MP and not just an overview in the MP guides. I would like to see all rules/monitors listed and what they are trying to monitor and what assumptions have been made. Sure I can export the MP to XML and try and study it but I should not have to.

System Center Capacity Planner 2007 RTMs

The good news is that SCCP has been released AND it is now free for anyone to download.

The bad news is that it is only for Exchange 2007 with SCOM coming later – Q2 and SharePoint shortly.

The announcement:

System Center Capacity Planner 2007 RTMs

The product team is pleased to announce the release of Microsoft System Center Capacity Planner (SCCP) 2007! SCCP 2007 is a pre-deployment capacity planning and post-deployment change analysis solution for Microsoft Server products including Microsoft Exchange Server 2007. It employs state of the art modelling technology to bring unprecedented functionality and flexibility to the process of performance analysis and planning of distributed application deployments. It provides Information Technology professionals with the tools and guidance to deploy efficiently, while planning for the future by allowing for “what-if” analyses.

The new version adds the following new capabilities:

. Application model for Exchange Server 2007

. Extensibility with new models from Microsoft, including Microsoft Office SharePoint Server 2007 and Microsoft Windows SharePoint Services 3.0. A model for System Center Operations Manager 2007 will be available soon.

. New, more powerful deployment wizards deliver unprecedented ease of use

. Support for 64-bit processor architectures

. Comprehensive reporting of disk IO and storage utilizations

. Increased flexibility in customizing server usage profiles

Unlike the previous version, SCCP 2007 doesn’t require a Microsoft TechNet Plus or MSDN Premium subscription, and is available for anyone to download now on the Microsoft Download Center. Please visit our website to learn more about SCCP 2007.

When will Capacity Models be available?

. Exchange 2007 Model: This model ships with SCCP 2007 and is available NOW and included with the current download on the Microsoft Download Center.

. Operations Manager 2007: This model is not yet available and the beta is closed. The final model is expected to ship in the 2nd quarter of calendar year 2008. Customers seeking capacity guidance should use the OpsMgr 2007 Performance and Scale Guide now available on the Download Center.

. SharePoint 2007 Model: This model is not yet available but will be posted to TechNet shortly.

NOTE: If you already have installed SCCP 2007 beta, you have to uninstall it first before installing RTM.