[OpsMgr 2012] How to find a specific rule/monitor/discovery in the console - SQL queries / Powershell command ( #SQL #Powershell #OpsMgr #OpsMgr2012 )

Sometimes in the Operations Manager Event log, we have some event/alert  for script error or WMI query error and all the time, the description give your the exact name of the rule/monitor/discovery that cause the issue. In SCOM console, you cannot find the rule/monitor/discovery by their exact name, only by the display name.

For example, here is an event 5500 we have on one server due to an invalid configuration for a monitor: Microsoft.SystemCenter.Agent.HealthService.PrivateBytesThreshold

Log Name:      Operations Manager

Source:        HealthService

Date:          11/28/2013 3:10:43 PM

Event ID:      5500

Task Category: Health Service

Level:         Information

Keywords:      Classic

User:          N/A

Computer:      MyServer.MyDom.Dom

Description:

Frequent state change requests caused the incoming state change request to be dropped due to it being older than the currently recorded state change for this monitor. This could also be due to an invalid configuration for this monitor. 

Affected monitor: Microsoft.SystemCenter.Agent.HealthService.PrivateBytesThreshold

Instance: MyServer.MyDom.Dom

Instance ID: 293C0099-290F-C53C-340E-A5E710CA5B9F

Management Group: MyMgtGroup

Request generated time: 2013-11-28T15:10:43.1658766+01:00

Requested state: Success

Recorded time: 2013-11-28T15:20:35.7827611+01:00

Recorded state Success

To start investigation, you need to retrieve the display name of the rule/monitor/discovery. You can also execute SQL queries on views in the OpsMgrDB or PowerShell commands connected to your management group :

Rules:

SQL:

select DisplayName from ruleview where name = 'Rule.Name'

Command Shell:

(Get-SCOMRule | Where {$_.name -match 'Rule.Name'}).DisplayName

Monitors:

SQL:

select DisplayName from monitorview where Name = 'Monitor.Name'

Command Shell:

(Get-SCOMMonitor| Where {$_.name -match 'Monitor.Name'}).DisplayName

Discoveries:

SQL:

select DisplayName from DiscoveryView where name = 'Discovery.Name'

Command Shell:

(Get-SCOMDiscovery| Where {$_.name -match 'Discovery.Name'}).DisplayName

In our case, powershell command or SQL query give a display name (replace Monitor.Name by Microsoft.SystemCenter.Agent.HealthService.PrivateBytesThreshold in the line) : Health Service Private Bytes Threshold for monitor Microsoft.SystemCenter.Agent.HealthService.PrivateBytesThreshold

We can now retrieve the monitor in the SCOM console and try to investigate the issue  ! :)

This posting is provided "AS IS" with no warranties.

[OpsMgr 2012] Custom Rule for selective APM Event collection ( #OpsMgr #SCOM #APM )

Daniele Muscetta (MSFT) has published an article on the team blog System Center Operations Manager to discuss customizing the collection rule #APM events. Side effect may occur when the agent is multi-homed on several environments. It gives such a way to create a custom rule to circumvent the problem.

More information on the ticket: Custom Rule for selective APM Event collection

This posting is provided "AS IS" with no warranties.

[OpsMgr 2007 R2][OpsMgr 2012] Get Rule/Monitor full information from Rule/Monitor name - Powershell script

Today, I've had a request to retrieve all informations for a rule that was generating too much alerts. The rule was give, by it's name and the name was not really user friendly : _08C092E8_FD6F_48b2_BA1E_473C3B84A2F3_.RaiseAlert

Thanks to the Exchange Server 2010 Management pack developper team :)

So I've create a short powershell function to add to my powershell profile :

1. Function RuleInfo  ([string]$RuleName)
2. {
3. get-rule | where {$_.Name -eq $RuleName} | select-object @{Name="MP";Expression={ foreach-object {$_.GetManagementPack().DisplayName }}}, @{Name="MP Version";Expression={ foreach-object {$_.GetManagementPack().Version }}}, Name, DisplayName, XmlTag, Enabled, Category, Target, ConfirmDelivery, Remotable, Priority, DiscardLevel, ConditionDetection, DataSourceCollection, WriteActionCollection, Id, Description, Comment, Status, LastModified, TimeAdded
4. }

Then I've launch it in my powershell console using the line :

RuleInfo  _08C092E8_FD6F_48b2_BA1E_473C3B84A2F3_.RaiseAlert

Result is like :

 Well done ! :)

I've also created the same function for monitors :

1. Function MonitorInfo  ([string]$MonitorName)
2. {
3. get-monitor | where {$_.Name -eq $MonitorName} | select-object @{Name="MP";Expression={ foreach-object {$_.GetManagementPack().DisplayName }}}, @{Name="MP Version";Expression={ foreach-object {$_.GetManagementPack().Version }}}, Name, DisplayName, XmlTag, Enabled, Category, Configuration, Id, ConfirmDelivery, OperationalStateCollection, Target, ParentMonitorID, Remotable, Priority, RunAs, AlertSettings, Accessibility, Description, LanguageCode, Comment, Status, LastModified, TimeAdded
4. }

Have fun !

This posting is provided "AS IS" with no warranties.