Vlad’s Blog

It is nice to see Vlad Joanovic has started blogging.Vlad has been in the Product Group since MOM 2000. He is very knowledgeable and if you have had a chance to see him speak at Technet or MMS you know that he is a great speaker. One to definitely add to your RSS feed.

http://blogs.msdn.com/vladj/

ISA 2006 MP Problem with ISA SP1

This came up in the newsgroups that the latest ISA 2006 MP (version 6.0.6351.0 – 14th July 08) does not seem to work with ISA 2006 SP1. Basically the MP says they are not monitored but it works fine on ISA 2006 without SP1. The “solution” appears to be to use the previous ISA MP (6.0.5000.0 13th Sept 07) which according to one guy does work OK with ISA 2006 SP1. Luckily the previous MP is still in the catalog. A Microsoft response on the thread was:-

This is known issue with the ISA MP. A bug has been filed for it and was briefly investigated. The next re-release for the ISA MP will unfortunately not be any time soon — it is planned for around Q1 FY10 — but I will keep updating if plans change for this MP.

This brings up a whole load of questions about why we have to wait for almost a year. FY usually means Microsoft’s Financial Year which runs from July to June. This is a bad habit that Microsoft employees pick up to use FY instead of using “normal” years which are Jan to Dec. Not everyone knows Microsoft’s financial setup. So Q1 FY10 would mean July to September 2009!

The Microsoft Product Groups are supposed to ensure that the MPs match the updates and SPs that they release. It was all part of the Common Engineering Criteria announced by the VPs in 2005 and updated each year.

Common Engineering Criteria – http://www.microsoft.com/windowsserversystem/cer/overview.mspx

Specifically for 2008 (bold by me)

New Health Model to improve Troubleshooting

IT often have to perform an “information treasure hunt” when presented with events and trying to troubleshoot them. The documentation of events is often inconsistent between product documentation, the Windows Event Viewer, and documents on the Web.

To solve this problem, all server products must create and maintain a health model based on the standard Service Modeling Language (SML) including relevant operational events and performance counters, in addition to identifying potential failures and define diagnose and recovery information.

Improved Management Pack(s)

The new version of the Management Pack specification released as part of System Center Operations Manager 2007 offers significant improvement in system monitoring, availability, and health through centralized and proactive management. In order to ensure that IT can continue to support existing products in addition to implementing new products by taking advantage of the new Health Model and Management Packs, all server products will continue to also ship Microsoft Operations Manager 2005 Management Packs.

And from the original 2005 criteria

MOM 2005 Management Pack Support at Launch

To help businesses reduce the cost of managing infrastructure, all server products will have a MOM Management Pack available at launch. The management pack will be serviced on the same schedule as the core product. MOM packs will provide:

• Event and performance processing alerts.
• Basic views that graphically map performance and event trending information.
• State Monitoring view (green/yellow/red) state for managed entities.
• Tasks.

MPs in 2007 have the version no’s and are sealed. Therefore it should be easy to update the MP and put it out with these small but important fixes. Or even as an override MP that fixes the problem. If Microsoft balks at the testing then they should release them as beta MPs and it would be up to each organisation to decide on whether to use them or not

This is not just directed at the ISA MP but all the Microsoft MPs where bugs are discovered but they all get put into a pot and wait until a big release. This is unacceptable in the Web 2.0 Internet era. I remember years ago the MOM team talking about releasing rule updates when KB articles were released so you could download MP fixes and updates like you would download WSUS patches. After all, if there is a bug in a product we would have a KB article and a hotfix. Why not the same for MPs?

Updated Windows OS MP

Just noticed from Stefan‘s Twitter feed (MP Notifier) that an updated Windows OS MP has been released – 20th October 2008 (version 6.0.6321.5). This covers Windows Server 2000, 2003 and 2008.

What’s new is that various scripts were updated to prevent issues with locale specific number formatting.

So good news for all those outside the US of A.

Disappearing DNS Servers

I had prepared a draft blog about Version 6.0.6278.27 of the DNS MP (14/8/2008). It is very noisy but having installed it in a couple of environments and read through the MP guide I think I had a handle on how to tune it. But rather than publish that I am posting this instead.

I am about to remove that MP from the environments that I have installed it in and replace it with the old version. The reason being is that the DNS servers seem to disappear from the discovered DNS servers list and sometimes come back but generally not. I picked up this from the newsgroup and initially I did not see that problem but then it happened to me and a few other people have replied that it has happened to them as well. So it does not matter how much better the new MP is (or not depending on how you view noisy MPs) but if it is not running the rules on the servers it is supposed to then there is no point in deploying it.

I did turn on the trace and watched the events come in and looked at the script to see how the script was working. And for non DNS servers the discovery failed and exited which is fine. For DNS servers they all exited OK but only some of them had the event to say they were putting in discovery data and that matched the list showing in the console. There appears to be no rhyme or reason why some DNS servers put the data in and some do not and looking at the script it is not obvious why this is happening. There was a report that upgrading to .Net 3.5 sorted it out but I had some servers on that version that were in the discovered list and some that were not. So far no response from Microsoft on this but it is difficult to recreate as my servers were all discovered for a few weeks before some of them disappeared. Very strange. If you are running this MP it is worth checking that it has found all your DNS servers.

Walter’s Views in a Management Pack

While I am on a theme of views Walter Chomak, MCS has released an unsealed MP which is a collection of views that he has used for general diagnostics and MP tuning while at client sites.

http://blogs.technet.com/wchomak/archive/2008/09/30/general-diagnostics-management-pack-1-0.aspx

Here is the screen shot.

He does include a GIF with the views but here is a screen shot after I installed it to see if you think it is useful before downloading it. I do.

These go into the main Monitoring tab. You can of course go into the XML and change the name to something that you would prefer. Just remember if you change the Name ensure you rename the XML file to match or OpsMgr will not import it and give you an error.

In some of the alerts views I have had to change some of the properties as it was filtering for 0 (New alerts) I changed those to Less Than 255 so anything that is not closed shows up. Useful if you use a number of resolution states. But very neat idea to get you started after my post about Views.

Note – I have just seen that this has been updated to v1.0.0.1. The “DC has been stopped/started” view has been removed as it is part of the AD views. I see no problem in having the same view in multiple places if it makes it easier to find the information

ExBPA Useful View for PowerShell Script

I was wanting to get a list of the Exchange BPA alerts to the Exchange team doing 2007. I did not like the idea of copying and pasting lots of individual alerts. I knew that with a PowerShell get-alert I could export a list of alerts to Excel but how to get only the ExBAP ones. I knew there was an alert view for ExBPA alerts in the Exchange 2007 MP views and when I looked at the properties it was a Eureka moment.

As you can see these rules all use Custom Field 6 which makes it easy to do a PowerShell one liner. That is a good piece of forward thinking by the team that created these rules.

get-alert | where-object {($_.ResolutionState -ne 255) -and ($_.CustomField6 -eq “MSExchange ExBPA”)} | export-csv c:\ExBPA.csv

Although I found that when looking at the spreadsheet most of the columns were irrelevant so I just amended the PowerShell to do the three fields that I wanted.

get-alert | where-object {($_.ResolutionState -ne 255) -and ($_.CustomField6 -eq “MSExchange ExBPA”)} | select-object Name, NetbiosComputerName, Description | export-csv c:\ExBPA.csv

And then I had a nice little spreadsheet to send to the guys so they could have a quick look at what was alerting. I must teach them how to use the console.