locked
Forefront for Exchange and SCOM RRS feed

  • Question

  • Hello,

    Thanks to Bob for the description

    http://social.technet.microsoft.com/Forums/en-IE/operationsmanagermgmtpacks/thread/d70dde44-bfe9-4d60-8ced-c4b2e27e2c6c

    Now why am I getting these errors:

    Alert: ServicesForefrontMonitor StateMonitor
    Resolution state: New
    Source: BOPMB7SCCB
    Path: BOPMB7SCCB.ad
    Last modified by: System
    Last modified time: 6/7/2011 6:21:24 AM
    Alert description: The service FSCMonitor is in 1 state.

    It is the Active Node of the Cluster.

    The Service FCSMonitor is running on both nodes.

    Why does SCOM see this service as stopped?

    Thanks,

    DOm


    System Center Operations Manager 2007 / System Center Configuration Manager 2007 R2 / Forefront Client Security / Forefront Identity Manager

    • Edited by Felyjos Thursday, June 9, 2011 2:09 PM
    Tuesday, June 7, 2011 2:12 PM

All replies

  • I don't really understand the question, but Forefront is clustered?  Does the monitor ignore the forefront service if it's not set to automatic?  Most services being monitored by SCOM look to ensure the service is set to automatic.  If an app is clusterd, the services are set to manual.  So to monitor a clustered service you probably have to override the monitor so that it monitors it even if it's not set to automatic.

    The SQL MP talks about this for monitoring clustered SQL.  I would suspect this might be mentioned in the forefront MP.


    Regards, Blake Email: mengotto<at>hotmail.com Blog: http://discussitnow.wordpress.com/
    Tuesday, June 7, 2011 5:00 PM
  • Hello,

    The question is: Why do I get a FCSMonitor is in State 1 meaning it is not running when the service on the machine is effectively running.

    The Monitor is set:

    Alert only if service startup type is automatic "False"

    FCSMonitor service is set to Manual.

    Forefront for Exchange is running on a Cluster, with Exchange which is clustered for sure. I will review Forefront for Exchange to be sure it is properly configured.

    Let me read again the Forefront MP docuemntation.

    Thanks,

    Dom


    System Center Operations Manager 2007 / System Center Configuration Manager 2007 R2 / Forefront Client Security / Forefront Identity Manager

    Tuesday, June 7, 2011 6:02 PM
  • I just read again the documentation Microsoft Forefront Security For Exchange 10.0 MOM 2005 MPUserGuide and the word "cluster" is even not mentioned!!! (: Let me see if there is one for SCOM 2007???

    It might be an issue ...

    FFSMP-SCOM2007UserGuide is having some information that I will review about clusters... but

    - could the old MP be monitoring resources which it should not be monitoring?

    - could I have a conflict between the two MPs????

    When importing the FFSMP 10.1 it is showing Microsoft.Forefront.Exchange.SP1(Converted) version 1.0.0.1 ... strange the change in the version number.

    The other one is Microsoft.Forefront.Exchange(Converted) 6.0.5000.0.

    I noticed:

    Monitoring > Microsoft Forefront Server Security > Forefront for Exchange > Services > Services Status

    Nothing is listed for the FCSMonitor for the node B only node A is listed for the cluster!!!

    Thanks

    Dom


    System Center Operations Manager 2007 / System Center Configuration Manager 2007 R2 / Forefront Client Security / Forefront Identity Manager






    Tuesday, June 7, 2011 6:38 PM
  • This sounds right for the way OM 2007 works in a cluster by default.  In OM 2007, agents are aware when they are on a computer with a clustered resource group membership.  When the agent is on the inactive node in a cluster, it disables all workflows for that node - including discoveries - and this is how the inactive node stays quiet.
    Microsoft Corporation
    Tuesday, June 7, 2011 8:31 PM
  • Hello Dan,

    Yes it what was expected but the issue is that the Active node is sending alerts that the service is not running, and if I check the State View effectively it is not listed it is the inactive node which is listed (: and as it is not listed it might be why it is sending the alert but the problem the service is running and it is the other node which should go asleep...

    The view:

    Monitoring > Microsoft Forefront Server Security > Forefront for Exchange > Services > Services Status should display the Active node for a cluster, isn't it? for me it is the inactive node which is displayed so far...

    ** the Cluster is listed in the Agentless managed

    Thanks,
    Dom


    System Center Operations Manager 2007 / System Center Configuration Manager 2007 R2 / Forefront Client Security / Forefront Identity Manager

    Tuesday, June 7, 2011 8:53 PM
  • Dom,

    Is Forefront clustered?  Is there a cluster resource for it?


    Regards, Blake Email: mengotto<at>hotmail.com Blog: http://discussitnow.wordpress.com/
    Tuesday, June 7, 2011 9:22 PM
  • Hi Blake,

    Yes there is a resource FSEClusRes.

    I noticed thate the Current Host Server is "B".

    The Curernt Owner of the databases and logs is "A"

    In the event log on "B" I have

    Log Name: Application
    
    Source: FSCController
    
    Date: 6/7/2011 2:15:11 PM
    
    Event ID: 5173
    
    Task Category: (5)
    
    Level: Error
    
    Keywords: Classic
    
    User: N/A
    
    Computer: BOPMB7SCCB.ad
    
    Description:
    
    The Scanjobs.fdb settings file is corrupt
    
    ==========================================
    Log Name: Application
    
    Source: FSCController
    
    Date: 6/7/2011 2:15:11 PM
    
    Event ID: 5174
    
    Task Category: (5)
    
    Level: Error
    
    Keywords: Classic
    
    User: N/A
    
    Computer: BOPMB7SCCB.ad
    
    Description:
    
    Forefront Server can be started with default settings by deleting or renaming the Scanjobs.fdb
    
    ==========================================
    
    
    
    Log Name: Application
    
    Source: FSCController
    
    Date: 6/7/2011 2:15:11 PM
    
    Event ID: 1033
    
    Task Category: (1)
    
    Level: Error
    
    Keywords: Classic
    
    User: N/A
    
    Computer: BOPMB7SCCB.ad
    
    Description:
    
    FSCController service failed to start
    
    ==========================================

     The Scanjobs.fdb is on "A" which is the "inactive" node...

    - Current Owner is "A"

    - Current Host Server is "B"

    It seems I cannot get a complete answer for the difference between this two terms to know where should be the resources, where should be the Forefront running...

    I noticed that one task FSS-WormList is in the task scheduler on both nodes... it is a local task!! anybody knows why there is this task ? is it soemthing installed by Forefront Client Security for Exchnage or something which is installed manually from another source?

    Thanks,
    Dom


    System Center Operations Manager 2007 / System Center Configuration Manager 2007 R2 / Forefront Client Security / Forefront Identity Manager
    • Edited by Felyjos Thursday, June 9, 2011 5:00 PM
    Tuesday, June 7, 2011 9:36 PM
  • I don't know anything about fore front.  I do know a little about clusters.  In our environment we have clustered exchange, sql, and some other apps.  Each node is set up to be able to host various resources, but is the owner of a particular set of resources.  In some instances, when Exchange resources fail to another node, but the cluster resource is hosted by the node that no longer owns the Exchange resources, I see SCOM workflows fail because they are trying to access a WMI namespace for applications that no longer are sitting on that node.  All of these clustered resources services are set to MANUAL.  Therefore, any service monitor in SCOM that has a requirement that the service be set to AUTOMATIC in order for it to be monitored, will not monitor any of these clustered resources (unless I override the monitors).  For a clustered application like Exchange, I have never seen an active and passive node running the same service at the same time.  You would have a resource conflict if that was the case.

    Did you build these clusters?  Do you know if ForeFront is supposed to be clustered?  Supported in a cluster environment?  Is this an active active cluster or active passive?  Is event log replication disabled in this cluster?  IF not, you should disable that for certain.

    Sorry to ask so many questions, but monitoring clustered applications with System Center is not easy because the agents are not aware of the cluster state when executing workflows..The agent only knows the situation after a resource moves from one node to another, and you can identify that by looking at the ops manager event log after a cluster fails application resources over to another node.


    Regards, Blake Email: mengotto<at>hotmail.com Blog: http://discussitnow.wordpress.com/
    Wednesday, June 8, 2011 8:17 PM
  • Hello Blake,

    For us also each node is set up to be able to host various resources, but is the owner of a particular set of resources. 

    "In some instances, when Exchange resources fail to another node, but the cluster resource is hosted by the node that no longer owns the Exchange resources, I see SCOM workflows fail because they are trying to access a WMI namespace for applications that no longer are sitting on that node.  All of these clustered resources services are set to MANUAL.  Therefore, any service monitor in SCOM that has a requirement that the service be set to AUTOMATIC in order for it to be monitored, will not monitor any of these clustered resources (unless I override the monitors)."

    I am exactly in this environment...

    " For a clustered application like Exchange, I have never seen an active and passive node running the same service at the same time.  You would have a resource conflict if that was the case."

    How to identify for sure the active-active or active-apssive for sure? I know when A is Active B is not but how to confirm this ?

    Did you build these clusters? 

    No

    Do you know if ForeFront is supposed to be clustered?  Supported in a cluster environment? 

    Yes & Yes from the http://technet.microsoft.com/en-us/library/bb795077.aspx
    http://technet.microsoft.com/en-us/library/bb892168.aspx
    http://support.microsoft.com/kb/929081

    "Is this an active active cluster or active passive?  "

    I need to research this... any steps to do so?

    "Is event log replication disabled in this cluster?  IF not, you should disable that for certain."

    The event log seems to be shared??

    Thanks,

    Dom


    System Center Operations Manager 2007 / System Center Configuration Manager 2007 R2 / Forefront Client Security / Forefront Identity Manager
    Thursday, June 9, 2011 4:11 AM
  •  

    Hi Dom,

     

    Please also let us know which management pack you are using to monitor Forefront for Exchange. Meanwhile, please see if the following is what you need.

     

    Forefront Protection 2010 for Exchange Server Management Pack for System Center Operations Manager 2007

    http://www.microsoft.com/downloads/en/details.aspx?FamilyID=74ba19df-0fc2-4dd3-86cc-07cb086a47c8

     

    Forefront Security for Exchange Server 10.1 MP for OpsMgr 2007

    http://www.microsoft.com/downloads/en/details.aspx?FamilyID=ec2a6c3a-6d75-44df-87d7-9dbb3dbfce37&displaylang=en

     

    Regarding the Events in the Forefront server, please try the following:

     

    The FSCController service cannot start successfully if a corrupted .fdb configuration file is loaded

    http://support.microsoft.com/kb/951921

     

    In addition, considering this issue is related to Forefront server, it is also recommended that you go to the corresponding forum for help:

     

    Forefront Products and Technologies Forums

    http://social.technet.microsoft.com/Forums/en/category/forefront

     

    Hope this helps.

     

    Thanks.
    Nicholas Li - MSFT
    Please remember to click “Mark as Answer” on the post that helps you, and to click “Unmark as Answer” if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.
    Thursday, June 9, 2011 6:53 AM
  • Hello Nicholas,

    first answers:

    Microsoft Forefront Protection 2010 for Exchange Server Management Pack: 11.0.325.0
    Microsoft Forefront Exchange (Converted) 6.0.5000.0
    Microsoft Forefront Exchange SP1(Converted) 1.0.0.1

    Exchange Server 2007 08.02.0301.000

    Let me know if it is correct, too much and some should be removed.

    Hello Blake,

    I opened a thread on FSE as well

    http://social.technet.microsoft.com/Forums/en/FSENext/thread/2479d50a-8f43-419f-8473-311c60a183c5

    Thanks,

    DOm


    System Center Operations Manager 2007 / System Center Configuration Manager 2007 R2 / Forefront Client Security / Forefront Identity Manager
    Thursday, June 9, 2011 2:20 PM
  •  

    Hi,

     

    Thank you for your response.

     

    Could you please let us know which version you are using, Microsoft Forefront Protection 2010 for Exchange Server or Microsoft Forefront Security for Exchange Server?  I think the corresponding management pack is needed.

     

    Thanks.
    Nicholas Li - MSFT
    Please remember to click “Mark as Answer” on the post that helps you, and to click “Unmark as Answer” if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.
    Friday, June 10, 2011 7:06 AM
  • Hello,

    On the Exchange Server concerned we have

    Microsoft Forefront Security for Exchange Server: 10.2.0956.0 Service Pack 2

    In SCOM :

    Both Management Packs are installed.

    1) Microsoft.ForefrontServer10.Library  10.2.321.0, Microsoft.ForeFront.Exchange 6.0.5000.0, FSMPack2007_FSE 1.0.0.1,

    2) Microsoft.ForefrontProtection.FPE 11.0.325.0

    Thanks,
    Dom


    System Center Operations Manager 2007 / System Center Configuration Manager 2007 R2 / Forefront Client Security / Forefront Identity Manager

    Friday, June 10, 2011 6:34 PM