locked
SCOM DFS Backlog count is giving FALSE alert RRS feed

  • Question

  • Hi  ;

    I've created a backlog count monitor using a 2 state monitor ( which I got from http://arbappy.blogspot.hk/2012/04/create-scom-2007-r2-monitor-to-alert-on.html )

    It is used to monitor 70 of our DFS servers.

    The monitor should be working under this rule :-

    1) if backlog count is greater or equal to 5000 files , status become unhealthy(critical) and alert is generated.

    2) if backlog is less than 5000 , status is healthy and no alert is generated.

    I have configured the subscription only to send critical alerts.

    Problem is that I do get alert for healthy status and it happens only to some servers.On top, it is random. Today could be X server , tomorrow could be Y . Both are healthy ( which meant having less than 5000 files.) . It seems the rule is not working really well. Any help is much appreciated.

    Cheers

    megat

    Friday, March 22, 2013 7:35 AM

All replies


  • Hi,

    Please try the latest version of the Windows File service MP and ensure the “DFS Replication Backlog Monitoring” is enabled according to the MP guide:

    File Services Management Pack for System Center Operations Manager 2007
    http://www.microsoft.com/en-us/download/details.aspx?id=14307

    Thanks.


    Nicholas Li
    TechNet Community Support

    • Proposed as answer by rob1974 Tuesday, March 26, 2013 2:05 PM
    Tuesday, March 26, 2013 7:41 AM
  • The rule is fine, it just doesnt work like you want :) (I'm pretty sure you can see a state change with the value "over threshold" and returning "under threshold" pretty fast e.g. the sample rate you've defined.

    The backlog is difficult and you might be better off using the mp. But if you just want this rule, you have to play around with the settings. E.g. use "consecutive samples over threshold" monitor, so you dont immediately get a message when you have a backlog spike that's gone quickly.

    Collect the counter itself for a few weeks (with scom or perfmon) so you can see what the normal values for these counters are and how you can "finetune" them.


    Rob Korving
    http://jama00.wordpress.com/

    • Proposed as answer by rob1974 Tuesday, March 26, 2013 2:06 PM
    Tuesday, March 26, 2013 2:04 PM
  • Thanks for the feedback . But here's some addtional info :-

    1) I've installed the MPs quite some time ago and that couldn't be the issue.

    2)  As for the suggestion that the spike change of state that could be too fast , I beg to differ . I've done my test as follows :-

    Assuming server X is having 80 backlog files .It showed unheathy in my SCOM whereas it shouldn't be. Next thing I did was to run this command "dfsrdiag backlog xxx\users /rfname:users /sendingmember:cxxxx /receivingmember:xxxx" to query server X backlog and it shows 80. Then , I will reset my SCOM monitor and it will turn green for a while ( I set the monitor to run every 60 sec) before it starts to change to unhealthy with the number of backlog files is still 80 . I rerun back the DFSR command and still it shows 80 . Therefore , it prove that there no sudden change of backlog files, but, yet still the monitor becomes unhealthy. Nevertheless, one thing that I notice with this X server ( and those who are giving this problem) is that they are having type of files which is somehow taking too long to replicate such as PST and ZIP files. Could that be the reason ?

    Monday, April 1, 2013 2:21 AM
  • that's the value you see, but what value does SCOM see (you can see the values at the statechange)?. SCOM doesn't do anything wrong here, but you might be getting different values then you think...

    i think it's just not as simple as picking up a counter. Here's a nice script for checking if you still dont want to use the mp: http://gallery.technet.microsoft.com/scriptcenter/dac62790-219d-4325-a57b-e79c2aa6b58e


    Rob Korving
    http://jama00.wordpress.com/


    • Edited by rob1974 Wednesday, April 3, 2013 10:43 AM
    Wednesday, April 3, 2013 10:38 AM
  • Above diagram refers.Unfortunately SCOM is seeing the same value as the script. Therefore , thats why I think there's something wrong with SCOM.

    Thursday, April 4, 2013 2:01 AM
  • I see just a property of the object, which doesn't have to be related to why the object is in a critical state.

    From here: open health explorer > check the monitors that return the critical (it might be some else, not the backlog count). If it is the backlog count, i want to see the values given at the "statechanges" in the health explorer. Also a post of the monitor you've created could be helpful (the xml).


    Rob Korving
    http://jama00.wordpress.com/


    • Edited by rob1974 Thursday, April 4, 2013 12:47 PM
    Thursday, April 4, 2013 10:28 AM
  • Ok . I've attached all the neccessary diagram (see below) that might give clearer picture. But please take note that eventhough you can see 2 monitors being used for the same purpose , but the problem does exist long before the second one was added. Reason I add the second one is because at first I thought it could be due to the first one is corrupted somehow. But instead, after adding another one, result still the same . At certain extend, I even disable one of it alternately, but yet still the problem persist.

    There are 2 monitor :-

    RW_DFS_BackLog_Count_twoBasedline_MM0 ---> is a 2 state monitor-----> generate alert------>does have subscribers

    RW_DFS_Backlog_MMO--------------------------------> is a 3 state monitor------>generate alert------> DOES NOT have subscribers.

    Below diagram will show  :-

    1)Health Monitor for a server which I took simulataneously

    2) The configuration for one of the monitor (as I don't know how to get the XML format). I think one will do as the other is almost same except in terms of timing and conditions.


    • Edited by Megat76 Friday, April 5, 2013 5:44 AM
    Friday, April 5, 2013 5:36 AM
  • Friday, April 5, 2013 5:39 AM
  • Friday, April 5, 2013 5:39 AM
  • Friday, April 5, 2013 5:42 AM
  • Friday, April 5, 2013 5:43 AM
  • You only need to export the management pack to get the xml.

    But from what i see here, something funny is going on. You schedule a script to transfer an argument once a day with a sync time of 7:40, but your statechange is not at 7:40.

    Is backlogcountfile already a property of the replicationconnection (it would have if i actually ran this mp lol). What the argument you are feeding this script?


    Rob Korving
    http://jama00.wordpress.com/


    • Edited by rob1974 Friday, April 5, 2013 11:17 AM
    Friday, April 5, 2013 11:15 AM
  • 1. About the different time stamp, I think because the server is located on a different time zone from the RMS. The server is 2 hours earlier .

    2. Backlogcountfile is property of replicationconnection ? I guess so. Nevertheless could you advise to confirm that.

    3. Below is the XML which I managed to export.

    <ManagementPack ContentReadable="true" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsl="http://www.w3.org/1999/XSL/Transform">
      <Manifest>
        <Identity>
          <ID>RWDFSBACKLOGMONITORINGSCRIPTSMMO</ID>
          <Version>1.0.0.0</Version>
        </Identity>
        <Name>RW_DFS_BACKLOG_MONITORING_SCRIPTS_MMO</Name>
        <References>
          <Reference Alias="MicrosoftWindowsDfsReplication6063210">
            <ID>Microsoft.Windows.DfsReplication</ID>
            <Version>6.0.6321.0</Version>
            <PublicKeyToken>31bf3856ad364e35</PublicKeyToken>
          </Reference>
          <Reference Alias="MicrosoftWindowsLibrary6172210">
            <ID>Microsoft.Windows.Library</ID>
            <Version>6.1.7221.0</Version>
            <PublicKeyToken>31bf3856ad364e35</PublicKeyToken>
          </Reference>
          <Reference Alias="SystemLibrary6172210">
            <ID>System.Library</ID>
            <Version>6.1.7221.0</Version>
            <PublicKeyToken>31bf3856ad364e35</PublicKeyToken>
          </Reference>
          <Reference Alias="SystemCenter">
            <ID>Microsoft.SystemCenter.Library</ID>
            <Version>6.1.7221.61</Version>
            <PublicKeyToken>31bf3856ad364e35</PublicKeyToken>
          </Reference>
          <Reference Alias="Health">
            <ID>System.Health.Library</ID>
            <Version>6.1.7221.0</Version>
            <PublicKeyToken>31bf3856ad364e35</PublicKeyToken>
          </Reference>
        </References>
      </Manifest>
      <Monitoring>
        <Monitors>
          <UnitMonitor ID="UIGeneratedMonitor61be896a832e4ffa8868c1e10c6711cc" Accessibility="Public" Enabled="false" Target="MicrosoftWindowsDfsReplication6063210!Microsoft.Windows.DfsReplication.ReplicationConnection" ParentMonitorID="Health!System.Health.AvailabilityState" Remotable="true" Priority="Normal" TypeID="MicrosoftWindowsLibrary6172210!Microsoft.Windows.TimedScript.ThreeStateMonitorType" ConfirmDelivery="false">
            <Category>Custom</Category>
            <AlertSettings AlertMessage="UIGeneratedMonitor61be896a832e4ffa8868c1e10c6711cc_AlertMessageResourceID">
              <AlertOnState>Error</AlertOnState>
              <AutoResolve>true</AutoResolve>
              <AlertPriority>High</AlertPriority>
              <AlertSeverity>Error</AlertSeverity>
              <AlertParameters>
                <AlertParameter1>$Target/Property[Type="MicrosoftWindowsDfsReplication6063210!Microsoft.Windows.DfsReplication.ReplicationConnection"]/ReplicationGroupName$</AlertParameter1>
                <AlertParameter2>$Target/Property[Type="MicrosoftWindowsDfsReplication6063210!Microsoft.Windows.DfsReplication.ReplicationConnection"]/ReplicatedFolderName$</AlertParameter2>
                <AlertParameter3>$Target/Property[Type="MicrosoftWindowsDfsReplication6063210!Microsoft.Windows.DfsReplication.ReplicationConnection"]/SendingMemberName$</AlertParameter3>
                <AlertParameter4>$Target/Property[Type="MicrosoftWindowsDfsReplication6063210!Microsoft.Windows.DfsReplication.ReplicationConnection"]/ReceivingMemberName$</AlertParameter4>
                <AlertParameter5>$Target/Property[Type="MicrosoftWindowsDfsReplication6063210!Microsoft.Windows.DfsReplication.ReplicationConnection"]/BacklogCount$</AlertParameter5>
                <AlertParameter6>$Target/Property[Type="SystemLibrary6172210!System.Entity"]/DisplayName$</AlertParameter6>
              </AlertParameters>
            </AlertSettings>
            <OperationalStates>
              <OperationalState ID="UIGeneratedOpStateId751249f015634144b909f400c3106b84" MonitorTypeStateID="Success" HealthState="Success" />
              <OperationalState ID="UIGeneratedOpStateId7c713b8c8aa44c518dbc05007f38b71e" MonitorTypeStateID="Warning" HealthState="Warning" />
              <OperationalState ID="UIGeneratedOpStateIdcda0005310e9480dba2726cc8fc9e1d3" MonitorTypeStateID="Error" HealthState="Error" />
            </OperationalStates>
            <Configuration>
              <IntervalSeconds>60</IntervalSeconds>
              <SyncTime />
              <ScriptName>RW-DFS-SCRIPT-MMO.vbs</ScriptName>
              <Arguments>$Target/Property[Type="MicrosoftWindowsDfsReplication6063210!Microsoft.Windows.DfsReplication.ReplicationConnection"]/BacklogCount$</Arguments>
              <ScriptBody>Set oArgs = WScript.Arguments
    numbers=oArgs(0)
    Dim oAPI, oBag
    Set oAPI = CreateObject("MOM.ScriptAPI")
    Set oBag = OAPI.CreatePropertyBag()
    Call oBag.AddValue("BackLogCountFile",numbers)
    Call oAPI.Return(oBag)</ScriptBody>
              <TimeoutSeconds>1200</TimeoutSeconds>
              <ErrorExpression>
                <SimpleExpression>
                  <ValueExpression>
                    <XPathQuery Type="String">Property[@Name='BackLogCountFile']</XPathQuery>
                  </ValueExpression>
                  <Operator>GreaterEqual</Operator>
                  <ValueExpression>
                    <Value Type="String">5000</Value>
                  </ValueExpression>
                </SimpleExpression>
              </ErrorExpression>
              <WarningExpression>
                <And>
                  <Expression>
                    <SimpleExpression>
                      <ValueExpression>
                        <XPathQuery Type="String">Property[@Name='BackLogCountFile']</XPathQuery>
                      </ValueExpression>
                      <Operator>GreaterEqual</Operator>
                      <ValueExpression>
                        <Value Type="String">100</Value>
                      </ValueExpression>
                    </SimpleExpression>
                  </Expression>
                  <Expression>
                    <SimpleExpression>
                      <ValueExpression>
                        <XPathQuery Type="String">Property[@Name='BackLogCountFile'] </XPathQuery>
                      </ValueExpression>
                      <Operator>Less</Operator>
                      <ValueExpression>
                        <Value Type="String">5000</Value>
                      </ValueExpression>
                    </SimpleExpression>
                  </Expression>
                </And>
              </WarningExpression>
              <SuccessExpression>
                <And>
                  <Expression>
                    <SimpleExpression>
                      <ValueExpression>
                        <XPathQuery Type="String">Property[@Name='BackLogCountFile']</XPathQuery>
                      </ValueExpression>
                      <Operator>GreaterEqual</Operator>
                      <ValueExpression>
                        <Value Type="String">0</Value>
                      </ValueExpression>
                    </SimpleExpression>
                  </Expression>
                  <Expression>
                    <SimpleExpression>
                      <ValueExpression>
                        <XPathQuery Type="String">Property[@Name='BackLogCountFile']</XPathQuery>
                      </ValueExpression>
                      <Operator>Less</Operator>
                      <ValueExpression>
                        <Value Type="String">100</Value>
                      </ValueExpression>
                    </SimpleExpression>
                  </Expression>
                </And>
              </SuccessExpression>
            </Configuration>
          </UnitMonitor>
          <UnitMonitor ID="UIGeneratedMonitor73d3c5593c8e43ef8ff223d94c1c1ebc" Accessibility="Public" Enabled="true" Target="MicrosoftWindowsDfsReplication6063210!Microsoft.Windows.DfsReplication.ReplicationConnection" ParentMonitorID="Health!System.Health.AvailabilityState" Remotable="true" Priority="Normal" TypeID="MicrosoftWindowsLibrary6172210!Microsoft.Windows.TimedScript.TwoStateMonitorType" ConfirmDelivery="false">
            <Category>Custom</Category>
            <AlertSettings AlertMessage="UIGeneratedMonitor73d3c5593c8e43ef8ff223d94c1c1ebc_AlertMessageResourceID">
              <AlertOnState>Error</AlertOnState>
              <AutoResolve>true</AutoResolve>
              <AlertPriority>High</AlertPriority>
              <AlertSeverity>MatchMonitorHealth</AlertSeverity>
              <AlertParameters>
                <AlertParameter1>$Target/Property[Type="MicrosoftWindowsDfsReplication6063210!Microsoft.Windows.DfsReplication.ReplicationConnection"]/ReplicationGroupName$</AlertParameter1>
                <AlertParameter2>$Target/Property[Type="MicrosoftWindowsDfsReplication6063210!Microsoft.Windows.DfsReplication.ReplicationConnection"]/ReplicatedFolderName$</AlertParameter2>
                <AlertParameter3>$Target/Property[Type="MicrosoftWindowsDfsReplication6063210!Microsoft.Windows.DfsReplication.ReplicationConnection"]/SendingMemberName$</AlertParameter3>
                <AlertParameter4>$Target/Property[Type="MicrosoftWindowsDfsReplication6063210!Microsoft.Windows.DfsReplication.ReplicationConnection"]/ReceivingMemberName$</AlertParameter4>
                <AlertParameter5>$Target/Property[Type="MicrosoftWindowsDfsReplication6063210!Microsoft.Windows.DfsReplication.ReplicationConnection"]/BacklogCount$</AlertParameter5>
                <AlertParameter6>$Target/Property[Type="SystemLibrary6172210!System.Entity"]/DisplayName$</AlertParameter6>
              </AlertParameters>
            </AlertSettings>
            <OperationalStates>
              <OperationalState ID="UIGeneratedOpStateIdd2ce36df64964c848bd1a155c2d3d56b" MonitorTypeStateID="Success" HealthState="Success" />
              <OperationalState ID="UIGeneratedOpStateId77f67a08c47d4d4b9677a854aef66cc9" MonitorTypeStateID="Error" HealthState="Error" />
            </OperationalStates>
            <Configuration>
              <IntervalSeconds>86400</IntervalSeconds>
              <SyncTime>07:40</SyncTime>
              <ScriptName>RW_DFS_TwoBasedLine.vbs</ScriptName>
              <Arguments>$Target/Property[Type="MicrosoftWindowsDfsReplication6063210!Microsoft.Windows.DfsReplication.ReplicationConnection"]/BacklogCount$</Arguments>
              <ScriptBody>Set oArgs = WScript.Arguments
    numbers=oArgs(0)
    Dim oAPI, oBag
    Set oAPI = CreateObject("MOM.ScriptAPI")
    Set oBag = OAPI.CreatePropertyBag()
    Call oBag.AddValue("BackLogCountFile",numbers)
    Call oAPI.Return(oBag)</ScriptBody>
              <TimeoutSeconds>3600</TimeoutSeconds>
              <ErrorExpression>
                <SimpleExpression>
                  <ValueExpression>
                    <XPathQuery Type="String">Property[@Name='BackLogCountFile']</XPathQuery>
                  </ValueExpression>
                  <Operator>GreaterEqual</Operator>
                  <ValueExpression>
                    <Value Type="String">5000</Value>
                  </ValueExpression>
                </SimpleExpression>
              </ErrorExpression>
              <SuccessExpression>
                <And>
                  <Expression>
                    <SimpleExpression>
                      <ValueExpression>
                        <XPathQuery Type="String">Property[@Name='BackLogCountFile']</XPathQuery>
                      </ValueExpression>
                      <Operator>GreaterEqual</Operator>
                      <ValueExpression>
                        <Value Type="String">0</Value>
                      </ValueExpression>
                    </SimpleExpression>
                  </Expression>
                  <Expression>
                    <SimpleExpression>
                      <ValueExpression>
                        <XPathQuery Type="String">Property[@Name='BackLogCountFile']</XPathQuery>
                      </ValueExpression>
                      <Operator>Less</Operator>
                      <ValueExpression>
                        <Value Type="String">5000</Value>
                      </ValueExpression>
                    </SimpleExpression>
                  </Expression>
                </And>
              </SuccessExpression>
            </Configuration>
          </UnitMonitor>
        </Monitors>
      </Monitoring>
      <Presentation>
        <Folders>
          <Folder ID="Folder_dcff3c90ef4740ff97397eb40d82225f" Accessibility="Public" ParentFolder="SystemCenter!Microsoft.SystemCenter.Monitoring.ViewFolder.Root" />
        </Folders>
        <StringResources>
          <StringResource ID="UIGeneratedMonitor61be896a832e4ffa8868c1e10c6711cc_AlertMessageResourceID" />
          <StringResource ID="UIGeneratedMonitor73d3c5593c8e43ef8ff223d94c1c1ebc_AlertMessageResourceID" />
        </StringResources>
      </Presentation>
      <LanguagePacks>
        <LanguagePack ID="DAN" IsDefault="false">
          <DisplayStrings>
            <DisplayString ElementID="RWDFSBACKLOGMONITORINGSCRIPTSMMO">
              <Name>RW_DFS_BACKLOG_MONITORING_SCRIPTS_MMO</Name>
            </DisplayString>
            <DisplayString ElementID="Folder_dcff3c90ef4740ff97397eb40d82225f">
              <Name>RW_DFS_BACKLOG_MONITORING_SCRIPTS_MMO</Name>
            </DisplayString>
            <DisplayString ElementID="UIGeneratedMonitor61be896a832e4ffa8868c1e10c6711cc">
              <Name>RW_DFS-R BACKLOG COUNT MONITOR</Name>
            </DisplayString>
            <DisplayString ElementID="UIGeneratedMonitor61be896a832e4ffa8868c1e10c6711cc" SubElementID="UIGeneratedOpStateId751249f015634144b909f400c3106b84">
              <Name>Healthy</Name>
            </DisplayString>
            <DisplayString ElementID="UIGeneratedMonitor61be896a832e4ffa8868c1e10c6711cc" SubElementID="UIGeneratedOpStateIdcda0005310e9480dba2726cc8fc9e1d3">
              <Name>Unhealthy</Name>
            </DisplayString>
            <DisplayString ElementID="UIGeneratedMonitor61be896a832e4ffa8868c1e10c6711cc" SubElementID="UIGeneratedOpStateId7c713b8c8aa44c518dbc05007f38b71e">
              <Name>Degraded</Name>
            </DisplayString>
            <DisplayString ElementID="UIGeneratedMonitor61be896a832e4ffa8868c1e10c6711cc_AlertMessageResourceID">
              <Name>Replication Backlog Alert</Name>
              <Description>Incident Team :- Backlog of DFS Server

    Replication Group:

    {0}

    Replicated Folders:
    {1}

    Sending member:
    {2}

    Receiving member:
    {3}

    Backlog Count:
    {4}

    Display Name : {5}</Description>
            </DisplayString>
            <DisplayString ElementID="UIGeneratedMonitor73d3c5593c8e43ef8ff223d94c1c1ebc">
              <Name>RW_DFS_Backlog_Count_TwoBasedLine_MMO</Name>
              <Description>This monitor is for Incident Team</Description>
            </DisplayString>
            <DisplayString ElementID="UIGeneratedMonitor73d3c5593c8e43ef8ff223d94c1c1ebc" SubElementID="UIGeneratedOpStateId77f67a08c47d4d4b9677a854aef66cc9">
              <Name>Unhealthy</Name>
            </DisplayString>
            <DisplayString ElementID="UIGeneratedMonitor73d3c5593c8e43ef8ff223d94c1c1ebc" SubElementID="UIGeneratedOpStateIdd2ce36df64964c848bd1a155c2d3d56b">
              <Name>Healthy</Name>
            </DisplayString>
            <DisplayString ElementID="UIGeneratedMonitor73d3c5593c8e43ef8ff223d94c1c1ebc_AlertMessageResourceID">
              <Name>RW_DFS_Backlog_Count_TwoBasedLine_MMO</Name>
              <Description>Incident Team :- DFS Backlog Files ( run at 0400 daily)

    Replication Group:

    {0}

    Replicated Folders:
    {1}

    Sending member:
    {2}

    Receiving member:
    {3}

    Backlog Count:
    {4}

    Display Name : {5}</Description>
            </DisplayString>
          </DisplayStrings>
        </LanguagePack>
        <LanguagePack ID="ENU" IsDefault="false">
          <DisplayStrings>
            <DisplayString ElementID="RWDFSBACKLOGMONITORINGSCRIPTSMMO">
              <Name>RW_DFS_BACKLOG_MONITORING_SCRIPTS_MMO</Name>
            </DisplayString>
            <DisplayString ElementID="Folder_dcff3c90ef4740ff97397eb40d82225f">
              <Name>RW_DFS_BACKLOG_MONITORING_SCRIPTS_MMO</Name>
            </DisplayString>
            <DisplayString ElementID="UIGeneratedMonitor61be896a832e4ffa8868c1e10c6711cc">
              <Name>RW_DFS-R BACKLOG COUNT MONITOR</Name>
            </DisplayString>
            <DisplayString ElementID="UIGeneratedMonitor61be896a832e4ffa8868c1e10c6711cc" SubElementID="UIGeneratedOpStateId751249f015634144b909f400c3106b84">
              <Name>Healthy</Name>
            </DisplayString>
            <DisplayString ElementID="UIGeneratedMonitor61be896a832e4ffa8868c1e10c6711cc" SubElementID="UIGeneratedOpStateIdcda0005310e9480dba2726cc8fc9e1d3">
              <Name>Unhealthy</Name>
            </DisplayString>
            <DisplayString ElementID="UIGeneratedMonitor61be896a832e4ffa8868c1e10c6711cc" SubElementID="UIGeneratedOpStateId7c713b8c8aa44c518dbc05007f38b71e">
              <Name>Degraded</Name>
            </DisplayString>
            <DisplayString ElementID="UIGeneratedMonitor61be896a832e4ffa8868c1e10c6711cc_AlertMessageResourceID">
              <Name>RW_DFS-R BACKLOG_COUNT_MONITOR_MMO</Name>
              <Description>This alert is run every one hour to see any back log. Kindly contact
    Megat for further details.</Description>
            </DisplayString>
            <DisplayString ElementID="UIGeneratedMonitor73d3c5593c8e43ef8ff223d94c1c1ebc">
              <Name>RW_DFS_Backlog_Count_TwoBasedLine_MMO</Name>
              <Description>This monitor is for Incident Team</Description>
            </DisplayString>
            <DisplayString ElementID="UIGeneratedMonitor73d3c5593c8e43ef8ff223d94c1c1ebc" SubElementID="UIGeneratedOpStateId77f67a08c47d4d4b9677a854aef66cc9">
              <Name>Unhealthy</Name>
            </DisplayString>
            <DisplayString ElementID="UIGeneratedMonitor73d3c5593c8e43ef8ff223d94c1c1ebc" SubElementID="UIGeneratedOpStateIdd2ce36df64964c848bd1a155c2d3d56b">
              <Name>Healthy</Name>
            </DisplayString>
            <DisplayString ElementID="UIGeneratedMonitor73d3c5593c8e43ef8ff223d94c1c1ebc_AlertMessageResourceID">
              <Name>RW_DFS_Backlog_Count_TwoBasedLine_MMO</Name>
              <Description>Incident Team :- Backlog of DFS Server_TwoBasedLine

    Replication Group:

    {0}

    Replicated Folders:
    {1}

    Sending member:
    {2}

    Receiving member:
    {3}

    Backlog Count:
    {4}

    Display Name : {5}</Description>
            </DisplayString>
          </DisplayStrings>
        </LanguagePack>
      </LanguagePacks>
    </ManagementPack>

    Friday, April 5, 2013 12:44 PM
  • i think you just target wrong or don't filter (unfortunately i dont really know a thing about DFS :))

    Your target is against " MicrosoftWindowsDfsReplication6063210!Microsoft.Windows.DfsReplication.ReplicationConnection", however i think you expect the result to be only for "$Target/Property[Type="MicrosoftWindowsDfsReplication6063210!Microsoft.Windows.DfsReplication.ReplicationConnection"]/ReplicationGroupName$" and/or "$Target/Property[Type="MicrosoftWindowsDfsReplication6063210!Microsoft.Windows.DfsReplication.ReplicationConnection"]/ReplicatedFolderName$"

    What i think you do is evaluate all "backlogcount" values for each group/folder but map them to a specific one. If this is true, scom is correct you do have issues with some folders/groups. Your can simple test this by adding the replication group and folder to your input arguments of you script and add them as value. Then the output will show which folder/group is affected (Call oBag.AddValue("BackLogGroup",inputargument) and Call oBag.AddValue("BackLogFolder",inputarg).

    You dont need to use a script btw. You directly use a property that's already available in SCOM > "$Target/Property[Type="MicrosoftWindowsDfsReplication6063210!Microsoft.Windows.DfsReplication.ReplicationConnection"]/BacklogCount$".


    Rob Korving
    http://jama00.wordpress.com/

    Tuesday, April 9, 2013 1:38 PM
  • Ok .. Here's what I've done . I've deleted all of it and create a new ones. Here's the latest config.

    <?xml version="1.0" encoding="utf-8"?><ManagementPack ContentReadable="true" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsl="http://www.w3.org/1999/XSL/Transform">
      <Manifest>
        <Identity>
          <ID>RWReplicationConnectionMMO</ID>
          <Version>1.0.0.0</Version>
        </Identity>
        <Name>RW_ReplicationConnection_MMO</Name>
        <References>
          <Reference Alias="SystemCenter">
            <ID>Microsoft.SystemCenter.Library</ID>
            <Version>6.1.7221.81</Version>
            <PublicKeyToken>31bf3856ad364e35</PublicKeyToken>
          </Reference>
          <Reference Alias="MicrosoftWindowsDfsReplication6063210">
            <ID>Microsoft.Windows.DfsReplication</ID>
            <Version>6.0.6321.0</Version>
            <PublicKeyToken>31bf3856ad364e35</PublicKeyToken>
          </Reference>
          <Reference Alias="SystemLibrary6172210">
            <ID>System.Library</ID>
            <Version>6.1.7221.0</Version>
            <PublicKeyToken>31bf3856ad364e35</PublicKeyToken>
          </Reference>
          <Reference Alias="MicrosoftWindowsLibrary6172210">
            <ID>Microsoft.Windows.Library</ID>
            <Version>6.1.7221.0</Version>
            <PublicKeyToken>31bf3856ad364e35</PublicKeyToken>
          </Reference>
          <Reference Alias="Health">
            <ID>System.Health.Library</ID>
            <Version>6.1.7221.0</Version>
            <PublicKeyToken>31bf3856ad364e35</PublicKeyToken>
          </Reference>
        </References>
      </Manifest>
      <Monitoring>
        <Monitors>
          <UnitMonitor ID="UIGeneratedMonitor282d0eda5fb34cd7bd28018bd8d3395f" Accessibility="Public" Enabled="true" Target="MicrosoftWindowsDfsReplication6063210!Microsoft.Windows.DfsReplication.ReplicationConnection" ParentMonitorID="Health!System.Health.AvailabilityState" Remotable="true" Priority="Normal" TypeID="MicrosoftWindowsLibrary6172210!Microsoft.Windows.TimedScript.TwoStateMonitorType" ConfirmDelivery="false">
            <Category>Custom</Category>
            <AlertSettings AlertMessage="UIGeneratedMonitor282d0eda5fb34cd7bd28018bd8d3395f_AlertMessageResourceID">
              <AlertOnState>Error</AlertOnState>
              <AutoResolve>true</AutoResolve>
              <AlertPriority>Normal</AlertPriority>
              <AlertSeverity>MatchMonitorHealth</AlertSeverity>
              <AlertParameters>
                <AlertParameter1>$Target/Property[Type="MicrosoftWindowsDfsReplication6063210!Microsoft.Windows.DfsReplication.ReplicationConnection"]/ReplicationGroupName$</AlertParameter1>
                <AlertParameter2>$Target/Property[Type="MicrosoftWindowsDfsReplication6063210!Microsoft.Windows.DfsReplication.ReplicationConnection"]/ReplicatedFolderName$</AlertParameter2>
                <AlertParameter3>$Target/Property[Type="MicrosoftWindowsDfsReplication6063210!Microsoft.Windows.DfsReplication.ReplicationConnection"]/SendingMemberName$</AlertParameter3>
                <AlertParameter4>$Target/Property[Type="MicrosoftWindowsDfsReplication6063210!Microsoft.Windows.DfsReplication.ReplicationConnection"]/ReceivingMemberName$</AlertParameter4>
                <AlertParameter5>$Target/Property[Type="MicrosoftWindowsDfsReplication6063210!Microsoft.Windows.DfsReplication.ReplicationConnection"]/BacklogCount$</AlertParameter5>
                <AlertParameter6>$Data/Context/Property[@Name='BacklogCountFile']$</AlertParameter6>
              </AlertParameters>
            </AlertSettings>
            <OperationalStates>
              <OperationalState ID="UIGeneratedOpStateId7b163a691bee44538212d01543625749" MonitorTypeStateID="Error" HealthState="Error" />
              <OperationalState ID="UIGeneratedOpStateId206d73b257874e4a9ab0a81c05be53e3" MonitorTypeStateID="Success" HealthState="Success" />
            </OperationalStates>
            <Configuration>
              <IntervalSeconds>600</IntervalSeconds>
              <SyncTime />
              <ScriptName>ReplicationBacklog.vbs</ScriptName>
              <Arguments>$Target/Property[Type="MicrosoftWindowsDfsReplication6063210!Microsoft.Windows.DfsReplication.ReplicationConnection"]/BacklogCount$</Arguments>
              <ScriptBody>Set oArgs = WScript.Arguments
    numbers=oArgs(0)
    Dim oAPI, oBag
    Set oAPI = CreateObject("MOM.ScriptAPI")
    Set oBag = OAPI.CreatePropertyBag()
    Call oBag.AddValue("BackLogCountFile",numbers)
    Call oAPI.Return(oBag)</ScriptBody>
              <TimeoutSeconds>300</TimeoutSeconds>
              <ErrorExpression>
                <SimpleExpression>
                  <ValueExpression>
                    <XPathQuery Type="String">Property[@Name='BackLogCountFile']</XPathQuery>
                  </ValueExpression>
                  <Operator>Greater</Operator>
                  <ValueExpression>
                    <Value Type="String">5000</Value>
                  </ValueExpression>
                </SimpleExpression>
              </ErrorExpression>
              <SuccessExpression>
                <SimpleExpression>
                  <ValueExpression>
                    <XPathQuery Type="String">Property[@Name='BackLogCountFile']</XPathQuery>
                  </ValueExpression>
                  <Operator>Less</Operator>
                  <ValueExpression>
                    <Value Type="String">5000</Value>
                  </ValueExpression>
                </SimpleExpression>
              </SuccessExpression>
            </Configuration>
          </UnitMonitor>
        </Monitors>
      </Monitoring>
      <Presentation>
        <Folders>
          <Folder ID="Folder_48f677ddd8284893b01a1efb4e78891b" Accessibility="Public" ParentFolder="SystemCenter!Microsoft.SystemCenter.Monitoring.ViewFolder.Root" />
        </Folders>
        <StringResources>
          <StringResource ID="UIGeneratedMonitor282d0eda5fb34cd7bd28018bd8d3395f_AlertMessageResourceID" />
        </StringResources>
      </Presentation>
      <LanguagePacks>
        <LanguagePack ID="DAN" IsDefault="false">
          <DisplayStrings>
            <DisplayString ElementID="RWReplicationConnectionMMO">
              <Name>RW_ReplicationConnection_MMO</Name>
            </DisplayString>
            <DisplayString ElementID="Folder_48f677ddd8284893b01a1efb4e78891b">
              <Name>RW_ReplicationConnection_MMO</Name>
            </DisplayString>
            <DisplayString ElementID="UIGeneratedMonitor282d0eda5fb34cd7bd28018bd8d3395f">
              <Name>RW_DFS_ReplicationBackLogReal_MMO</Name>
              <Description />
            </DisplayString>
            <DisplayString ElementID="UIGeneratedMonitor282d0eda5fb34cd7bd28018bd8d3395f" SubElementID="UIGeneratedOpStateId7b163a691bee44538212d01543625749">
              <Name>Unhealthy</Name>
            </DisplayString>
            <DisplayString ElementID="UIGeneratedMonitor282d0eda5fb34cd7bd28018bd8d3395f" SubElementID="UIGeneratedOpStateId206d73b257874e4a9ab0a81c05be53e3">
              <Name>Healthy</Name>
            </DisplayString>
            <DisplayString ElementID="UIGeneratedMonitor282d0eda5fb34cd7bd28018bd8d3395f_AlertMessageResourceID">
              <Name>DFS Backlog Alert -MMO</Name>
              <Description>Replication Group:
    {0}

    Replicated Folders:
    {1}

    Sending member:
    {2}

    Receiving member:
    {3}

    Backlog Count:

    {4}

    Parameter Passed To Rules :
    {5}</Description>
            </DisplayString>
          </DisplayStrings>
        </LanguagePack>
        <LanguagePack ID="ENU" IsDefault="false">
          <DisplayStrings>
            <DisplayString ElementID="RWReplicationConnectionMMO">
              <Name>RW_ReplicationConnection_MMO</Name>
            </DisplayString>
            <DisplayString ElementID="Folder_48f677ddd8284893b01a1efb4e78891b">
              <Name>RW_ReplicationConnection_MMO</Name>
            </DisplayString>
            <DisplayString ElementID="UIGeneratedMonitor282d0eda5fb34cd7bd28018bd8d3395f">
              <Name>RW_DFS_ReplicationBackLogReal_MMO</Name>
              <Description />
            </DisplayString>
            <DisplayString ElementID="UIGeneratedMonitor282d0eda5fb34cd7bd28018bd8d3395f" SubElementID="UIGeneratedOpStateId7b163a691bee44538212d01543625749">
              <Name>Unhealthy</Name>
            </DisplayString>
            <DisplayString ElementID="UIGeneratedMonitor282d0eda5fb34cd7bd28018bd8d3395f" SubElementID="UIGeneratedOpStateId206d73b257874e4a9ab0a81c05be53e3">
              <Name>Healthy</Name>
            </DisplayString>
            <DisplayString ElementID="UIGeneratedMonitor282d0eda5fb34cd7bd28018bd8d3395f_AlertMessageResourceID">
              <Name>DFS Backlog Alert -MMO</Name>
              <Description>Replication Group:
    {0}

    Replicated Folders:
    {1}

    Sending member:
    {2}

    Receiving member:
    {3}

    Backlog Count:

    {4}

    Parameter Passed To Rules :
    {5}</Description>
            </DisplayString>
          </DisplayStrings>
        </LanguagePack>
      </LanguagePacks>
    </ManagementPack>

    Now  , what I notice happens is ( I just take 2 example) :-

    Thursday, April 11, 2013 3:03 AM
  • Thursday, April 11, 2013 3:04 AM
  • Thursday, April 11, 2013 3:04 AM
  • Thursday, April 11, 2013 3:05 AM
  • As you can see that there's two big issue there :-

    1) The parameter passed to the argument is correct but the rule condition doesn't work.

    2) Somehow, not all group is being applied with the rule.

    Btw , you did suggest  " You dont need to use a script btw. You directly use a property that's already available in SCOM > "$Target/Property[Type="MicrosoftWindowsDfsReplication6063210!Microsoft.Windows.DfsReplication.ReplicationConnection"]/BacklogCount$". " . What would be the type of monitor that I can use ?

    Thursday, April 11, 2013 3:08 AM
  • Any update on this?  I'm running into the same thing where any backlog count at all triggers a critical alert.  It does seem the condition isn't correct. 
    Monday, July 14, 2014 4:37 PM
  • BTW, there is an attribute, but that collection occurs every 4 hours.  If you want to know the status of backlogs more frequently, you'll probably have to run the script more often.
    Monday, July 14, 2014 4:40 PM
  • Just another thought, is the script just grabbing the value of that attribute from the Management Server and not actually getting it from the servers involved in the connection?

    That still doesn't explain the logic problem, unless it generates an alert on ALL connections as long as just ONE is over the critical threshold.

    Monday, July 14, 2014 4:50 PM
  • I think that the reason is :

    the values in "Unhealthy expression" and "Healthy expression" are evaluated as Strings not as Integers

    So "70" is greather than "500" but "15002" is less than "500"


    Check this blog:

    http://rickjury.blogspot.fr/2014/04/scom-script-monitor-numeric-expressions.html

    Thursday, February 26, 2015 9:51 AM