How to create Service Monitor - best Way
-
Friday, January 04, 2013 2:19 PM
I have a task at hand :
Creating monitor to alert when a service is stopped.
We are using SCOM 2012
I checked and found various ways to do so http://www.bictt.com/blogs/bictt.php/2011/03/16/scom-monitoring-a-service-part1
My requirement is : there are like 100 such services on 100 different windows computers that i need to monitor.
The services are not common , so 2 computers have the same service , Maybe some service that i need to be monitored be on 2 computers but overall every service is unique.
What is my best option:
1.Create a basic unit monitor and target to Windows computer class ? Create is as disabled ? Override for just the machine that has it.
Will it clutter my Windows Server class health explorer . (How bad is that as per performance)
2.Create a Service monitor using Windows Service templates
Do i have to create 100 target groups , as i have to Target the monitor to specific computer only
Since template service monitor create discoveries , targets etc on its own (Am i going to clutter SCOM with a lot of those) 100
3.Do i create a attribute for each service , so as to extend the windows base class to discover the computer that has specific service (Using registry)
too much work is it and how good of an option is this.
4.MP Authoring ,Create new class discovery based on WMI / Registry to find computer and then target the monitor
What would you do in such a case.
All Replies
-
Friday, January 04, 2013 2:36 PMModerator
Hi
It depends what you need.
E.g. Do you need each service discovered as a class \ object? The Microsoft Management Packs don't generally do this. They are simple service monitors targetted at Windows 20XX Operating System and SQL 20XX DBEngine \ SQL Agent. You can't add a SQLDBEngine service class to a distributed application because it doesn't exist. There is the SQL DB Engine class and monitors targetted at that.
If you need to discover the services as classes \ objects then
1) Create a new class with a registry based discovery that looks in HKLM\SYSTEM\CurrentControlSet\Services for the existance of the service (you could even discover based on the Start Value e.g. automatic, manual, disabled).
2) Target the Basic Service Monitor at this class.
The Authoring Templates are the compromise route - they are easier than creating your own classes and discoveries (because the template does that for you) but you do need to create the groups - the template uses Windows Computer as the target but then sets overrides based on the group you select in the wizard.
Cheers
Graham
Regards Graham New System Center 2012 Blog! - http://www.systemcentersolutions.co.uk
View OpsMgr tips and tricks at http://systemcentersolutions.wordpress.com/ -
Friday, January 04, 2013 2:51 PM
As you mention do i need class or object , i think i do not understand this much. could you give an example (a simple one)
Because once i create the monitor i want to use it in availability reports as well , and if i create a basic service monitor i cant find it , but if i create a service monitor using template , i can use it in the Availability reporting
I think it has something to do with objects / class
I would get tempted to create class based on service if only this service exist on 5 or more computers , but for just 1 computer i think it is too much
What is your personal view on this Graham
-
Friday, January 04, 2013 3:04 PMModerator
An example is the windows service monitoring from the Windows Management Packs. Microsoft does not discover any of these services. The MPs discover the Windows 2003 \ 2008 \ 2012 Operating System Class and the basic service monitors are targetted at this class. This means it is relatively light weight monitoring (less overhead on the agent and less discovery information in the databases) but it does mean that you can't add any of these services to a distributed application or report on their availability. You don't report on individual monitors but on objects which may have many monitors targetted at them.
Windows Server 2003
ü Computer Browser Service
ü DHCP Client Service
ü DNS Client Service
ü Plug and Play Service
ü RPC Service
ü Server Service
ü TCP \ IP NetBios Service
ü Windows Event Log Service
ü Workstation Service
Windows Server 2008 (including R2)
ü Computer Browser Service
ü DHCP Client Service
ü DNS Client Service
ü Plug and Play Service
ü RPC Service
ü Server Service
ü TCP \ IP NetBios Service
ü Windows Event Log Service
ü Workstation Service
Windows Server 2012
ü Computer Browser Service
ü DHCP Client Service
ü DNS Client Service
ü Plug and Play Service
ü RPC Service
ü Server Service
ü TCP \ IP NetBios Service
ü Windows Event Log Service
ü Workstation Service
If you want to actually report on the availability of this windows service (or add it to a Distributed Application) then you do need to discover it - either via the Authoring Template or authoring your own discoveries.
Only you can decide what you need and you might have a different need for each service depending on what it is doing.
Jonathan Almquist has a good walk through here about how to change service monitoring to allow for consecutive occurrences of a service being unavailable but it is deep authoring.
http://blogs.technet.com/b/jonathanalmquist/archive/2011/06/24/windows-service-monitoring-reduce-false-alerts-part-2.aspx
Regards Graham New System Center 2012 Blog! - http://www.systemcentersolutions.co.uk
View OpsMgr tips and tricks at http://systemcentersolutions.wordpress.com/- Edited by Graham DaviesMVP, Moderator Friday, January 04, 2013 3:04 PM
- Marked As Answer by Kitaab Wednesday, January 09, 2013 2:04 PM
-
Friday, January 04, 2013 3:05 PMModeratorWe actually also are running into this in an environment where more and more services need to be monitored. Most of the times 1 to 5 custom monitors on groups of server of 2 to 20 servers. We did use creating Dynamic groups to get the membership of those servers discovered into groups based on their name with an expression. And use the windows service monitoring template for them. In this case that is. Also because a number of them need to have memory and cpu monitored per service and the template can create them for you without much pain. Of course the numbers start to add up (as in your case I understand) and also of course the console-created items use the guids in the names which you see at some points sometimes. For this customer this seemed to be the best solution, and is still easy enough to do once you get on a roll (or do two of them and go into the XML to replcate more and more of those while using normal ID's :-) ). For a number of them we could have done discovery of services which start under a domain account as criterium for a discovery and monitor those things, but that was a sub-set.
Bob Cornelissen - BICTT (My Blog about SCOM) - MVP 2012 and Microsoft Community Contributor 2011 + 2012 Recipient
-
Friday, January 04, 2013 3:07 PMModeratorthe method explained by Graham you can also create one or two of them and move more into the authoring tools and XML to replicate the whole mess from 2 to a hundred of the same while only having to change a number of things each time. Still, like you said Kitaab, it is a larger number of items to pull up. Guess you need to be brave and push forward :-)
Bob Cornelissen - BICTT (My Blog about SCOM) - MVP 2012 and Microsoft Community Contributor 2011 + 2012 Recipient
-
Friday, January 04, 2013 4:07 PM
Thanks this is the answer i was looking for i guess :)
I think as per my requirement i will create Groups and use Windows service template to do the rest
It solves my issue with reporting and distributed application.
May be it clutters the Management group with a lot of unnecessary things that i do not need , but i will move forward with it. (It is simple)
Any advice on Groups :)
-
Friday, January 04, 2013 4:07 PMThanks Bob ... will push forward :)
-
Friday, January 04, 2013 4:51 PMModerator
Advise on groups :
Create naming convention so you can find stuff.
Put groups in management pack. Put monitors in same mp if you do not seal it.
If you have one scom environment and 1 or 2 servrs per group you could manually put the servers in thrre as explicit members.
If you have dev+test+accept+prod environments with similar servernames or partly at least or you have multiple servers for yhe group with naming conventions you can use dynamic membership for group. So you can move the mp around between scom instances. I have examples of this process. If you need just email me.
That would be some advice on groups.
Bob Cornelissen - BICTT (My Blog about SCOM) - MVP 2012 + 2013 and Microsoft Community Contributor 2011 + 2012 Recipient
-
Friday, January 04, 2013 5:38 PMModerator
Personally I'd try and group the services logically around a function, especially if you want to build a distributued application.
And then create a Management Pack per function. So all the services that make up a partcular application go into one MP and you can then create a Distributed Application that includes these services in the same MP.
Hope it makes sense ;-)
Regards Graham New System Center 2012 Blog! - http://www.systemcentersolutions.co.uk
View OpsMgr tips and tricks at http://systemcentersolutions.wordpress.com/
.png)
