Free PowerShell Book

If you wanted to know more about PowerShell then there is a free PDF you can download from http://powershell.com/cs/blogs/ebook/. It is called “Mastering PowerShell” and it is 567 pages long. It is written by Dr. Tobias Weltner.

It is useful to know PowerShell for OpsMgr as there are areas where it is very easy to do a one liner in PowerShell that is impossible in the console. However you may want to read this article about whether you should learn scripting. http://4sysops.com/archives/a-different-network-why-administrators-should-avoid-scripting/

My view is that I do not want to learn to be a scripting guru but having a stock of PowerShell scripts that I have gleaned from blog posts over the years is very useful. Once I have a line or script that I find useful I put it in a text file so that I can use it at multiple customer sites. Of course in order to use these correctly and modify them you do need to know a bit about PowerShell. This is a case where a little knowledge is a useful thing.

Disk Extravaganza

Having posted about the hard disk free space report a few days ago there are a large number of posts recently concerning hard disk monitoring. Hard disk monitoring is one of those givens that all organisations expect from a monitoring solution.

Setting The Thresholds

One area that causes confusion is the double threshold that the disk space monitor uses. Both figures have to be breached to create an alert.

	Warning		Critical
	%	MB	%	MB
System	10	200	5	100
Non System	10	1024	5	2048

Having talked to a few customers I have found the best way to discuss it is to use the spreadsheet created by Jonathan Almquist. This allows you to put in figures for typical hard disks and see when the threshold will be breached and whether it was MB or % that did it. Pump in some larger figures (as suggested by Anders) and the threshold changes to the other etc. It is a great visual tool to use with customers. It is a good article that explains the monitor really well.

Hard Disk Script Alert

Scott Moss at MyITForum updated his MOM 2005 script last July and turned it into an MP. There was a need for this type of script in 2005 and I used part of Scott’s along with Geeky Girls to create my own 2005 disk space script. He has redone his MOM 2005 script to ignore the MB threshold and added the ability to set a threshold on an individual disk using a percentage value using the DiskThreshold.MOM file, or disable alerting all together on a per disk basis using the NoDiskAlerts.MOM file. I find that with the 2007 monitor I have not needed to run a custom script. Understanding the double threshold makes it easy to customise and the fact that you can now create overrides for individual disks is useful and something that was not possible in MOM 2005. I suppose if you need to give other people the rights to make those changes then having the 2 files on the servers that they can change is a good idea. But I am happy with the default monitor.

Getting the Hard Disk Free Space Info

Here is a script to extract the percentage free disk space on all servers in a SCOM environment, and email it to an administrator. From Electric Bunnies (aka Geeky Girl aka Vanessa). I have not tested this one.

I was talking to Stefan Stranger at the MMS and he has a SQL query which returns all the disk space for the servers regardless of the OS rather than running a report per OS.

Run the query against the DW database in SQL Management Studio. Change the dates to dates that you want the info on. You can click the top corner of the table like a spreadsheet and copy and paste the info to a spreadsheet for further work.

Query in doc text file – SQL Query for Disk Space

Updated Disk Space Report

And Zeimbor (Ziemek Borowski) has posted a new version of his disk space report which looks a lot better that the “proof of concept” one that he originally did. He provides the MP as a .MP and .XML.

He also provides the SQL query and has redone the zip file which seem to cause a lot of problems for other people. And the MP can be downloaded with the zip file which contains the XML file. It shows up as a directory called Board in the reports. I don’t know why but if you use the XML file you can change that. I like the way you can put in a figure for free space like 20 and all server hard disks with less that 20% free will show up as a red graph bar on the right. It is a really great report now and highly recommended. My big disappointment (and others from the correspondence I have received on this subject) is why didn’t Microsoft do a report like that out of the box.

I did find an issue with it (well not really with the report) as System Center DPM creates a large number of mounted disks with very long names which throws the report a bit. Exporting it as a PDF is a nightmare but I found that exporting it to Excel tames that column and still shows all the nice info in the report.

I have tried Ziemek’s report on R2 and it works on that as well. Good news.

Create Events

Something that is handy for demos and testing systems is to create events in order to check that rules and monitors work and create alerts to order. Usually if you want an event to happen in the event log it never will. As soon as you turn your back thousands happen.

I was confronted with this recently as a customer wanted to do a functional test after installation and want to create events from some of the key MPs to ensure that they worked. Using MP Viewer I can look into the MPs, look at the rules and find out which event numbers with source and event log are in an MP and enabled. Normally for demos I use eventcreate.exe as it is part of the OS. Unfortunately this only does events up to 1000. So I looked around to see what I could find. It was difficult to search for as most searches tend to respond with tools to monitor and manipulate event logs. So there may be other tools out there.

1 Eventcreate.exe

Pros – included in Windows 2003, 2008, XP and Vista; can do remote to another server; can be used in a batch file.

Cons – only up to ID 1000, only Application and System logs

2 Logevent.exe

Pros – can be included in a batch file; can do all event IDs; can do remote.

Cons – Can only do Application log; was part of Windows 2000 Resource Kit but no longer shown in that download area.

3 VBScript

Pros – run from anything that can do VBscript

Cons – Incredibly limited; only one source – WSH; only Application log; event ID equals type of event (0 for info, 1 for warning etc).

4 PowerShell

Pros – Clever use of interactive PowerShell script from Stefan Strange with additions from Ken

Cons – interactive (would need extra work to take parameters to be used in a batch file); can only do local server (but could be extended with more code) and so needs PowerShell installed

5 Event Create (MOM 2005 Resource Kit)
http://technet.microsoft.com/en-us/opsmgr/bb498240.aspx
http://download.microsoft.com/download/d/4/b/d4bfc32c-d8d2-4541-8356-4c6359eecbb4/MOM2005ResKit.msi

Pros – GUI front end that can do remote; any event logs; all IDs

Cons – can not be used in batch file; msi needs .Net v1 to extract its files

6 OpsMgr Script

Pros – simple to create a timed script to run as at a regular interval; can use OpsMgr targeting; could be created as a VB script to run as batch file

Cons – can only log to Operations Manager log; can only use Health Service Script as a source; needs OpsMgr agent in order to work

Example showing how to ping.

Summary

If you need to create events and are happy with the limitations then eventcreate.exe is easy and is included in all the latest OSes. For a demo the Event Create GUI from the MOM 2005 Resource Kit is great. If you can get hold of it logevent can automate event creation (as long as it is the Application event log). Highly recommended is the PowerShell script from Stefan and Ken. With some more work it would be able to do everything.

Updated 26/8/08 – Changed references to logevent.exe as it is not included in MOM Resource Kit as I originally thought. It was in my 2005 VM but when I did a new install only the GUI version is there.

It would be nice to have a single tool like eventcreate.exe but without the limitation on event logs and event IDs. Anyone want to create a tool like that?

SCOM Webcasts and Podcasts

If you can not get to MMS perhaps these webcasts will help. List also at http://www.microsoft.com/events/series/technetmms.aspx?tab=webcasts&id=42365 which is slightly different to the search that I did.

Also when searching I came across these podcasts which do not require registration. You can get them in WMA or MP3 and listen to them on the way to work. It looks like the audio portion of the webcast but I will need to check that out. You can also get an RSS feed to see what ones are being released. Full list at
http://www.microsoft.com/events/podcasts/default.mspx
and under IP Professional, Management you can get the RSS for all the management podcasts.
MP3 feed for management  http://www.microsoft.com/seminar/en/BMO-PODCAST/TechNet_Management_MP3.xml
MP3 feed for scripting and PowerShell
http://www.microsoft.com/seminar/en/BMO-PODCAST/TechNet_Scripting_MP3.xml

On-Demand TechNet Webcasts

“For a richer experience, make sure you’ve first downloaded the Microsoft Office Live Meeting 2005 Replay Wrapper. It allows you to explore webcasts and complete the evaluations, and it’s something you only have to do once. ”

Fri, 7 Mar 2008
Installation and Management Pack Migration of Operations Manager 2007 (Level 200)

In this session, we discuss the installation and management pack migration of Microsoft System Center Operations Manager 2007. Join us to learn how to properly plan your deployment of Operations Manager 2007. We also look at common Operations Manager
Blain Barton

Fri, 29 Feb 2008
Client Monitoring with System Center Operations Manager 2007 (Level 200)

In this session, we show you some of the new features that we have built into Microsoft System Center Operations Manager 2007. By the end of this session, you will  have a good understanding of what we are doing with client monitoring.
John Baker

Fri, 15 Feb 2008
System Center Operations Manager 2007 Technical Overview (Level 200)

In this session, we look at the next version of the Microsoft management product, Microsoft System Center Operations Manager 2007. There are a number of enhancements from Microsoft Operations Manager 2005; John Weston

Fri, 2 Nov 2007
System Center Operations Manager 2007 Installation and Management Pack Migration (Level 200)

In this session, we discuss the installation and management pack migration of Microsoft Systems Center Operations Manager 2007. We cover how to plan your deployment of Systems Center Operations Manager 2007 properly and explore common IT topologies
Blain Barton

Wed, 26 Sep 2007
Security and Enterprise Features of System Center Operations Manager 2007

In this session, we provide an overview of how the new features in Microsoft System Center Operations Manager 2007 can help satisfy key security and enterprise scenarios. Join us as we explore: Core infrastructure optimization (IO).
John Baker

Mon, 17 Sep 2007
Reporting with System Center Operations Manager 2007

In this session, we discuss the new features and benefits of reporting in Microsoft System Center Operations Manager 2007. We start with a look at the new functionality and features in Operations Manager 2007 Reporting.
John Weston

Mon, 10 Sep 2007
Client Monitoring with System Center Operations Manager 2007

In this session, we show you some of the new features that we have built into Microsoft System Center Operations Manager 2007 so that you have a good understanding of what we are doing with client monitoring. Chris Avis

Wed, 8 Aug 2007
End-to-End Service Monitoring with System Center Operations Manager 2007

In this webcast, we discuss some common challenges that customers have in monitoring distributed applications, and we explain how Microsoft System Center Operations Manager 2007 addresses those issues.
Matt Hester

Mon, 23 Jul 2007
System Center Operations Manager 2007 Technical Overview (Level 200)

In this webcast, we look at the next version of the Microsoft management product, Microsoft System Center Operations Manager 2007. There are a number of the enhancements from Microsoft Operations Manager 2005; we cover many of these, including a basic description of the installation process. We follow that up with a look at some of the new monitoring features. We also describe the new security and enterprise features, before exploring the new client monitoring and reporting functionalities. This session is designed to provide a high-level overview of each of the new functional areas and the enhanced feature set in System Center Operations Manager 2007. Our intent is not to dive into great depth for any one feature area, but rather to introduce each feature and refer you to a more in-depth presentation on each area.
John Baker

Mon, 16 Jul 2007
Security and Enterprise Features of System Center Operations Manager 2007 (Level 200)

“In this session, we provide an overview of the new features in Microsoft System Center Operations Manager 2007 and describe how they can help satisfy key security and enterprise scenarios. Join us as we explore the following topics in System Center Operations Manager 2007: Core infrastructure optimization (IO). Upfront, built-in security design. Your security monitoring tool. Advances in enterprise capabilities.”
John Baker

Mon, 9 Jul 2007
Monitoring with System Center Operations Manager 2007 (Level 200)

In this session, we discuss the new features and benefits of monitoring in Microsoft System Center Operations Manager 2007. We begin by reviewing how monitoring is done in Microsoft Operations Manager 2005, and then we look at some monitoring fundamentals in System Center Operations Manager 2007. We also explore the new diagnostic and recovery functionality included in System Center Operations Manager 2007. We conclude this session by describing how groups and overrides work in System Center Operations Manager 2007.
John Weston

Mon, 18 Jun 2007
Client Monitoring with System Center Operations Manager 2007 [200] [Released]

In this session we are going to show you some of the new features that we have built into Operations Manager 2007. By the end of this session you will have a good understanding of what we are doing with client monitoring. We will start off with a look at some customer challenges around client monitoring and then take a look at Microsoft?s short term and long term vision for client monitoring. Next we will discuss the approach that we have taken to make client monitoring as flexible as possible with features including. Agentless Exception Monitoring, Aggregated Client Monitoring and Critical Client Monitoring. We will wrap up this session with a look at the Management Packs we are delivering specifically for client monitoring.
Blain Barton

Mon, 11 Jun 2007
Operations Manager 2007 Technical Overview [200] [Released]

In this webcast, we look at the next version of the Microsoft management product, Microsoft System Center Operations Manager 2007. We describe a number of the enhancements from Microsoft Operations Manager 2005, and give a basic description of the installation process. We also cover some of the new capabilities, such as monitoring, security, and enterprise features, before taking a look at the new client monitoring and reporting functionalities. This session is designed to provide a high-level overview of each of the new functional areas and the enhanced feature set in System Center Operations Manager 2007. Our intent is not to dive into great depth for any one feature area, but rather to introduce each feature and refer you to a more in-depth presentation on each area.
Chris Avis

Wed, 23 May 2007
Security and Enterprise Features of System Center Operations Manager 2007 [200]

” In this session, we provide an overview of how the new features in Microsoft System Center Operations Manager 2007 can help satisfy key security and enterprise scenarios. Join us as we explore the following topics in System Center Operations Manager 2007: Core infrastructure optimization (IO). Built-in security design. Your security monitoring tool. Advances in enterprise capabilities.”
John Weston

Yet Another MOM 2005 Disk Space Script

A client wanted to check on disk space based on whether it was a local disk, in which case 15%, or a SAN attached disk, in which case they wanted warnings at 10GB. This made sense as the large disks attached to the SAN could have 100s of GBs free and still alert based on %. Unfortunately WMI can only see what is presented to the OS. Windows doesn’t “know” that a particular volume is on a SAN or a local disk. As far as it is concerned, the SAN volume IS a local disk, therefore WMI just sees it as another instance of Win32_LogicalDisk.

Not being a scripting expert I looked around and found a number of scripts done by others but none were exactly what I wanted. I looked at the modified storage state script by Gerald Mims – http://geraldmims.spaces.live.com/blog/cns!4EDF3C508D92E609!166.entry and the updated version by Scott Moss – http://www.myitforum.com/articles/2/view.asp?id=11442. I like the idea of the file that prevents the disk from being monitored (so added that) but did not fancy putting a text file on hundreds of servers for custom thresholds. With my lack of script skills I felt it was too complicated to change to what I wanted. I also looked at the one from Brian Wren which was nice and simple – http://www.faqshop.com/mom/default.htm?http://faqshop.com/mom/monitor/can%20mom%20rec%20cluster.htm. In the end I went with the one from Geeky Girl – http://mysehnsucht.spaces.live.com/blog/cns!759071229966AF5A!585.entry as it fitted best what I was trying to do and worked “as is” initially which always makes it easier. But shamelessly stole good ideas from the others.

The new script is designed to look at the size of the disk and dependant on size will either use % free space for small disks and GB free space for large disks. The client wanted a threshold of 15% for local disks and 10 GB for SAN disks. 10 GB is 15% if the disk size is 66.67 GB. Therefore I used a figure of 66 GB to be the dividing line to determine whether the disk was small or large but it is a parameter so you can chose your own cut off point.

Rather than a simple threshold a series of worsening thresholds was created as follows:-

Alert Level	Small Disk	Large Disk
Warning	15%	10 GB
Error	10%	5 GB
Critical Error	5%	1 GB

 I turned the hard coded figures into parameters and created the two logic chains depending on the size of disk parameter. I also borrowed the idea from Brian about using >0 to test (I was getting script errors from cluster servers without it) and heavily stole the description piece from the original storage state script which I then turned into sub routine to keep the main logic easier to read. The downside is that this is not a state based script but on the other hand it is easy to customise with the parameters, exclude drives with a file called NoDiskAlerts.MOM in the root of the drive.

I have tried to document the script as much as possible. Create a new script and copy this one in and create a timed rule to run the script and add the 7 parameters. Then create event rules for each level. All are described in the script.

custom-check-disk-space-based-on-size
Note that this ends in doc as that was the only tyoe of file I could upload. It is a text file.
Also thanks to Stuart for pointing out the INT() function.