May 2008 - Posts

• SCOM Agent, Gateway, Management Server Ports

  While working in a very complex environment (lots of segregated and isolated VLANs, firewalls, 8 non trusted domains, NAT between domain etc.) I discovered that the communication coming FROM the agent to the Gateway or Management servers is not originating from 5723. The communication from the Gateway and Management Server TO the agent is originating from port 5723. It appears the agent is randomly grabbing a port to communicate from. What made us start looking at this was agent discovery was failing (In the end discovery was failing for a different reason). We could install the agent manually and it would report into SCOM, send alerts, events etc. We were concerned that there were some port issues that would cause trouble down the road so we began running telnet tests on both sides of  the connection. The telnet test would fail from the GW to the agent on 5723, but would succeed from the agent to the GW. We then ran netstat -a cmd and could see that the agent is randomly picking ports to communicate on looking to the mgt server port 5723. So be fore warned in complex environments where you need to have firewall ports opened and you are running in to problems you can try to use the telnet test, but make sure you also run a netstat test to see what port your agent is listening on. Posted May 29 2008, 01:05 PM by Operations Manager 2007

• Alert Aging in SCOM07

  There is a lot of information out there on SCOM Notifications; however I haven't run into much in the way of Alert Aging. I've been told that Aging was for sending repeat alerts to the same users after a period of time. I have also been told its for Alert Escalations. I have done some testing in my lab over the last couple of days and have found some interesting facts... Here was my testing scenario: 2 Users (User1 and User2) two subscriptions set exactly the same, targeted to only send notifications for AD alerts User1 has aging set to 10 minutes, User2 has aging set to 20 minutes I created a rule to trigger alerts targeted to all Domain Controllers. What I found was User1 didn't get the first alert for exactly 10 minutes. I left two of the alerts in the New state and set two more alerts to WIP. After 20 minutes User2 got two notifications about the Alerts that were still in the New state. User1 didn't get any repeat notifications. So I am to assume that Alert Aging is for Escalation of alerts that have not been handled; whether that means auto resolved, self-healed, or manually changed to resolved or some other Resolution state. Hopefully this will help clarify some of the confusion around Alert Aging (I know it did for me). Posted May 29 2008, 10:06 AM by Operations Manager 2007

• A Small Bug in the Base OS Management Pack for SCOM07

  I came across a small bug the other day while playing with the OpsMgr07 Base OS Management Pack. When you go into the Logical Disk Space Monitor and look at the thresholds there appears to be an error. You will see a small red '!' and by placing your mouse over it you will see that it says the values are of the threshold are set backwards.     However when you go in to the Overrides tab and look at the actual values you will see they are set correctly. It appears there is a slight coding problem in the way the MP translates the settings to the to the display. Because this is a sealed MP, you can't remove the appearance of the error. Again the important thing to note is the settings are correct and the MP monitors the diskspace as it should, this is a display bug, not a functional one. If you are interested in technical classroom training, take a look at our Operations Manager courses at http://www.infrontconsulting.com/events.htm. Posted May 23 2008, 11:58 AM by Operations Manager 2007

• Gateway / Certificate Fun

  I have been answering plenty of questions about Gateways and certificates, as well as dealing with some fairly complex environments that involve Certs and Gateways lately. There’s a lot of information out there to help troubleshoot problems and give advice, so I thought I would add my two cents. Here are my simple steps for making Gateways and or Certificate Authentication for single servers work: This assumes you have a PKI infrastructure already and all the servers trust the Issuing Certificate Authority. 1. Verify there is name resolution between the Management Server and the Gateway (or the server you are using certificate auth for) **YOU HAVE TO HAVE IT**      a. If there isn’t name resolution add an entry to the hosts file on both the Mgt server and Gateway (or server you need to authenticate with) 2. Verify that port 5723 is open in the firewall (Telnet to port 5723 from the GW to the Mgt Server, and from the Mgt Server back to the GW to test it) 3. Request a Certificate         a. An Advance Cert Request      b. Create and Submit a Request      c. Make sure you use the FQDN of the server you are going to put the cert on in the Name Field and the Friendly name field      d. Type of Cert needed is Other          i. Copy the existing OID then put a 1 at the end of it followed by a coma (,) then paste the OID you just copied and put a 2 after it.      e. Mark it as Exportable      f. Mark the store cert in the local cert store check box 4. Approve the Cert (in the Cert Authority MMC) 5. On the Certsrv website (where you just requested the cert) view your pending request and “Install the certificate” 6. Go to the Certificates MMC snap-in, look under Personal - Certificates, right click and Export the cert (give it a password and a .pfx extension). 7. Copy that cert to the Mgt Server.     a. On the Mgt server Right Click and Install the Cert (you will need to enter the password you just gave it) 8. After you installed the Cert copy the MOMCertImportTool.exe from the install media to the directory you put the cert in     a. Open a cmd prompt and cd to the folder that contains the cert and certimport tool. (make sure you are using the correct version of the tool, amd64 for x64  machines, i386 of 32bit machines).. been there made that mistake Type the following command MOMCERTIMPORTTOOL.exe NAME-OF-YOUR-CERT.pfx You should be prompted to enter the password for the cert Once you have successfully completed that… FOLLOW ALL THE ABOVE STEPS AGAIN ONLY SUBSTITUTE THE FQDN OF THE GATEWAY SERVER (or server you need to authenticate with) FOR THE MGT SERVER FQDN IN THE NAME SECTIONS OF THE CERT REQUEST You need two certs, one for the Mgt Server and One for the GW server Once you have installed the cert, then used the MOMCertimporttool on the GW (or server you need to authenticate with), then go back to the Mgt server for one last step Once you are back on the Mmgt server: 1. Copy the Microsoft.EnterpriseManagement.GatewayApprovalTool.exe from the install media to the folder where you installed SCOM (C:\Program Files\System Center Operations Manager 2007 is the default) 2. Open a Cmd prompt and browse to the folder where you installed SCOM (and subsequently copied the GW Approval Tool). If you skip this step and run the tool from the media you will get a bunch of strange errors… see been there done that 3. Type the following command: Microsoft.EnterpriseManagement.GatewayApprovalTool /ManagementServerName=FQDN_name /GatewayName=gateway_server_FQDN_name  /Action=create When you get the success message you can open your Operations Manager Console, go to the Administration pane, look under management servers (for gateways) or Agent managed (for single servers you are managing without a gateway) and you should see your newly added certificate authenticated servers. ***IMPORTANT NOTE*** It may take up to 5 to 10 minutes for your gateway server to show up as monitored. Here are some great links with loads more information… Gateway Server and PKI Scenarios Guide SystemCenterForum.org Gateways the fastway systemcenterforum.org Gateway scenarios Technet Gateways Posted May 18 2008, 12:24 AM by Operations Manager 2007

• Blog Images

  Posted May 18 2008, 12:24 AM by David's space

• ASP.NET Pre-Req for SCOM install

  On more than one occasion over the last few days we have seen the SCOM07 pre-req check fail due to ASP.net not being registered. We added and removed it a couple of times to no avail and finally re-registered it, reset IIS and were good to go. We have run into this repeatedly with various customers. The add/remove programs, iisreset and rebooting weren't enough, we had to register the components with the following commands: Please follow the procedure below to register ASP.NET: Open Command Prompt. Change directory as follows: For 32-bit machines change to: <WindowsDir>\Microsoft.NET\Framework\<version number>\ For 64-bit machines change to: <WindowsDir\Microsoft.NET\Framework64\<version number>\ Run the command ‘aspnet_regiis.exe -i’ and press enter Posted May 16 2008, 07:20 AM by Operations Manager 2007

• SecureStorageBackup

  Running the new SecureStorageBackup.exe has some nuances to be aware of. Recently a customer was having some problems completing the GUI successfully. We ended up having to use the Browse button to choose our location before it would let us actually write the key file. When we typed in the path directly it would tell us access denied and finish (without writing the key file or writing a 0 byte file). After fixing that problem and re-running the tool we ran into a different error, this time it was the   Could not load file or assembly 'Microsoft.Mom.Common, Version=6.0.4900.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35' or one of its dependencies. The system cannot find the file specified   The cause of this problem was we were not running the tool from the Program Files folder where we installed SCOM07, we were running it from the install media. The resolution is to run it from within the program files folder where you installed SCOM07. It has to be run from the same folder that contains the Microsoft.MOM.Common.dll.   Once we ran it from E:\Program Files\SCOM07\ the key was created successfully. Posted May 15 2008, 10:15 AM by Operations Manager 2007

• MPStudio Lite

  Silect releases a Free Lite version of MP Studio     MP Studio 2007 Lite helps you quickly develop a clear understanding of Management Packs by combining rich Management Pack content analysis with predefined out-of-the-box Management Pack reports giving System Center Operations Manager 2007 users a comprehensive view of all Management Pack components.     Feature Summary: ·         View Management Pack relationships and references ·         Create customized views of Management Pack contents ·         View overrides that are applied to a Management Pack ·         View by Management Pack or by Target ·         Create customizable Management Pack reports in HTML format.   While the Lite version will work with both installed MPs and MP files, I would still recommend users consider purchasing a standard version. The Lite version is great for fast reporting and solving some quick problems, but having the ability to run comparisons tests, do bulk override management, MP testing as well as version control and auditing in my opinion warrant the purchase of a full version. I would recommend any user that is thinking about MPStudio, but is afraid of spending the money; look at the Lite version and I think you will see the value of their products.   You can see a full prodcut comparison here and download a copy of the Lite version here.  Posted May 14 2008, 03:06 PM by Operations Manager 2007

• InterOp

  One of the things that was annouced at MMS was the Beta of InterOp. These are the connectors that allow SCOM bi-communication with TEC, HPOVO and Remedy (intially these are the only tools that InterOp will work with). We saw a demo of this working (and once I get a OV or TEC in my lab I will have some Screen Caps), and I have some conerns. This biggest of these is that you can only have one of these connectors installed and running at a time. I can somewhat understand not running HPOV and TEC at the same time, but most environments have monitoring and ticketing systems installed. I would like to see Interop allow SCOM to connect to both a ticketing system as well as different tools at the same time. Now granted this is still just the Beta and with anyluck by the time this is RTM they will have made it so we can connect both Ticketing and other monitoring systems. What we did see looked very promising, and hopefully will deliever. Posted May 07 2008, 07:58 PM by Operations Manager 2007