locked
Exchange 2010 Monitoring with SCOM 2012 - Correlation Service Issue RRS feed

  • Question

  • We are running SCOM 2012 RTM and would like to use the Exchange 2010 Monitoring MP.

    I've installed the MP and Correlation Service as per the installation instructions for SCOM 2007 (no specific SCOM 2012 Installation Guides are available)

    the problem is that the Correlation Service isn't working, so we aren't getting any alerts.

    When attempting a manual start of the correlation service, I receive the following message:

    "The Microsoft Exchange Monitoring Correlation Service on Local Computer started and then stopped. Some services stop automatically if they are not in use by other services or programs"

    I've tried setting the service's log on account as both the SCOM Data Warehouse Read Account, Local System, and a Domain Admin user, with the same result for all.

    What might be going wrong here?


    Have you tried turning it off and back on again?


    Monday, April 30, 2012 12:50 PM

Answers

  • I think, I could be wrong, the latest correlation engine will not work with 2012.  There is supposed to be a new Exchange 2012 MP available sometime in the future that is going to fix issues with the correlation engine and add some much needed attention to the Exchange 2010 MP in general.  Again, I could be wrong, but I think I recall hearing that the current MP will not work in 2012 environments primarily because of the correlation engine.

    Regards, Blake Email: mengotto<at>hotmail.com Blog: http://discussitnow.wordpress.com/

    • Marked as answer by Yog Li Monday, May 7, 2012 6:55 AM
    Monday, April 30, 2012 3:03 PM
  • Well now that the service is running, it's going to talk to the SDK (this may have changed in SCOM12) and built out it's own instance space so that it can manipulate that for root cause analysis.  Depending on how LARGE your E2K12 environment is, this could take some time.

    Just let it cook in and you will more than likely start to see alerts rolling in for Exchange 2010.  You just want to look at the application log for the events the correlation engine logs.  It will tell you that it's trying to connect to the RMS, if it can't, it will tell you it's going to retry in 30 seconds.  Then you might see warnings from it about unable to process state for 33 monitors out of 150 etc.  Or you will see an informational saying it connected to the RMS and all is good.


    Regards, Blake Email: mengotto<at>hotmail.com Blog: http://discussitnow.wordpress.com/

    • Marked as answer by Yog Li Monday, May 7, 2012 6:56 AM
    Monday, April 30, 2012 3:47 PM

All replies

  • I think, I could be wrong, the latest correlation engine will not work with 2012.  There is supposed to be a new Exchange 2012 MP available sometime in the future that is going to fix issues with the correlation engine and add some much needed attention to the Exchange 2010 MP in general.  Again, I could be wrong, but I think I recall hearing that the current MP will not work in 2012 environments primarily because of the correlation engine.

    Regards, Blake Email: mengotto<at>hotmail.com Blog: http://discussitnow.wordpress.com/

    • Marked as answer by Yog Li Monday, May 7, 2012 6:55 AM
    Monday, April 30, 2012 3:03 PM
  • thanks for the reply Blake.

    I've got the Service running now, setting the log on user as Local Service. however there's still no alerts being generated.

    Maybe you're right about the compatibility with SCOM 2012, i can't find anything useful online suggesting one way or the other. 


    Have you tried turning it off and back on again?

    Monday, April 30, 2012 3:09 PM
  • Well now that the service is running, it's going to talk to the SDK (this may have changed in SCOM12) and built out it's own instance space so that it can manipulate that for root cause analysis.  Depending on how LARGE your E2K12 environment is, this could take some time.

    Just let it cook in and you will more than likely start to see alerts rolling in for Exchange 2010.  You just want to look at the application log for the events the correlation engine logs.  It will tell you that it's trying to connect to the RMS, if it can't, it will tell you it's going to retry in 30 seconds.  Then you might see warnings from it about unable to process state for 33 monitors out of 150 etc.  Or you will see an informational saying it connected to the RMS and all is good.


    Regards, Blake Email: mengotto<at>hotmail.com Blog: http://discussitnow.wordpress.com/

    • Marked as answer by Yog Li Monday, May 7, 2012 6:56 AM
    Monday, April 30, 2012 3:47 PM
  • thanks for the info Blake. SCOM has detected the Exchange servers and their roles (only 5 servers currently in our environment), and they show up in the Exchange 2010 Monitoring space in the SCOM console

    however as per your suggestion I've checked the application event log on the RMS and can see the following error:

    MSExchangeMonitoringCorrelation EventID 714:

    Cannot connect to Operations Manager Root Management Server.

    Error: The credentials used to connect to Operations Manager Root Management Server 'localhost' are invalid.  Error message: The user NT AUTHORITY\LOCAL SERVICE does not have sufficient permission to perform the operation.

    So, Local Service is no good for connecting to SCOM. is it possible to grant Local Service the correct permissions? if not then which account should I be using?

    Thanks again!


    Have you tried turning it off and back on again?


    Monday, April 30, 2012 4:12 PM
  • I don't have 2012 deployed with the Exchange 2010 MP, so I can't tell you.  

    Having said that in SCOM 2007 R2 when you install the correlation engine MSFT suggests that you put it on your RMS.  If you put it on the RMS there is a config file that has a connection string in it which by default is set to local host (which if on the RMS would be that local host).

    Now you are not on 2007 R2, so I suspect (guessing) the correlation engine has to be on a management server that is hosting the role that the SDK occupies.  If you only have a simple deployment where you have one management server with all the SCOM 2012 roles, then it seems to me this shouldn't be an issue, if you have multiple servers with different roles, then edit the config file to point to the FQDN of the server hosting the SDK role and bounce the correlation engine.

    Again, if one management server, with all the roles on that box, then maybe change the correlation engine to use one of your SCOM service accounts that has higher levels of access, bounce it and see if it can now connect.

    I haven't had to set this up yet, so these are just basic troubleshooting guesses.


    Regards, Blake Email: mengotto<at>hotmail.com Blog: http://discussitnow.wordpress.com/

    Monday, April 30, 2012 4:22 PM
  • Ah, you have to point this bad boy to the RMS Emulator:

    Setting the RMS Emulator 
    I’m not perfectly sure how SDK Events are handled in 2012 but taking the secure route, I want to redirect the Correlation Engine to the RMS Emulator. 
    By default the Correlation Engine will connect to localhost – in case you installed the engine on the RMS Emulator, no need to make any changes.
    UPDATE: I got confirmation from Microsoft that you have to make the correlation engine connect to the RMS Emulator!

    What’s an RMS Emulator? Basically, there is no RMS in 2012, but for compatibility reasons one server can be defined as the RMS Emulator which you need for rules and monitors targeting the Root Management Server class.

    Which server is the RMS Emulator? Usually the first Management Server in the Management Group, but let’s go back and double check. 
    2012 Shell: 
    Get-SCOMRMSEmulator

    http://www.systemcentercentral.com/BlogDetails/tabid/143/IndexID/92140/Default.aspx

    Peep that write up on SCC I think it will help you with your issue.


    Regards, Blake Email: mengotto<at>hotmail.com Blog: http://discussitnow.wordpress.com/

    Monday, April 30, 2012 4:27 PM
  • Hi!

    thanks a lot for the guide, I've run through it but still can't get the service to work.

    here's the process i've gone through so far:

    -install Exchange 2010 MP from .msi

    -installer throws an error when it can't start the correlation service

    -go into services.msc. change run as account to Local Service

    -return to installer (still showing error) - hit retry to start the service.

    -finish installer. return to services.msc and stop the correlation service

    -change the RMS server name from localhost to the RMS' FQDN

    -copy MOmBidldr.dll to exchange\v14\bin directory

    -import the Management Packs into SCOM

    -change correlation service run as account to SCOM Service account

    -start the correlation service

    now, there's only one error showing in the application event log. however the contents are pretty useless:

    The description for Event ID 4999 from source MSExchange Common cannot be found. Either the component that raises this event is not installed on your local computer or the installation is corrupted. You can install or repair the component on the local computer.
    
    If the event originated on another computer, the display information had to be saved with the event.
    
    The following information was included with the event: 
    
    4404
    E12
    c-RTL-AMD64
    14.02.0071.000
    M.E.Monitoring.CorrelationEngine
    M.EnterpriseManagement.OperationsManager
    M.E.C.TypeSpaceCache.GetType[T]
    M.E.Common.ObjectNotFoundException
    90b4
    06.01.7221.049
    False
    
    the message resource is present but the message is not found in the string/message table

    obviously a placeholder for missing event data.

    Other things checked:

    -found a post stating that the run as account for the correlation service must match the SDK account - however this doesnt seem to apply to SCOM2012 as there is no SDK account.

    Where can i go from here?

    surely i'm not the first person to try using Exchange 2010 MP with SCOM 2012??


    Have you tried turning it off and back on again?


    Tuesday, May 8, 2012 10:25 AM
  • MSExchange Common 4999 is a mailbox database issue - though i've not seen anything mentioning the Correlation Service needing a connection to any mailbox databases. is this a red herring? there's no other information as to why 'the service started and then stopped'. I've been on this problem all day and Google has run out of options.

    Is there anyone out there who's successfully got this working?? please help me, i'm at my wits end!


    Have you tried turning it off and back on again?

    Tuesday, May 8, 2012 3:02 PM
  • another update on this.

    after uninstalling then reinstalling the exchange 2010 management pack and correlation service, i finally got the service to start and to stay running.

    However, as soon as import the management packs into SCOM, the correlation service stops, and won't start again. the only event log is the MSExchange common 4999 as mentioned previously.

    Any Ideas? Anyone?


    Have you tried turning it off and back on again?

    Tuesday, May 15, 2012 3:22 PM
  • I had issues with the corellation engine after upgrading scom 2012 to R2.

    The MomBidLdr.dll version changed in the SCOM directories, and needs to be updated in the:

    C:\Program Files\Microsoft\Exchange Server\v14\Bin directory.

    That seemed to stop the errors for me.

    Wednesday, March 5, 2014 3:53 AM
  • another update on this.

    after uninstalling then reinstalling the exchange 2010 management pack and correlation service, i finally got the service to start and to stay running.

    However, as soon as import the management packs into SCOM, the correlation service stops, and won't start again. the only event log is the MSExchange common 4999 as mentioned previously.

    Any Ideas? Anyone?


    Have you tried turning it off and back on again?

    Did you ever find a solution to this?  I'm running into this exact issue at the moment.

    • Proposed as answer by Nakatomi2233 Wednesday, September 2, 2015 7:06 PM
    • Unproposed as answer by Nakatomi2233 Wednesday, September 2, 2015 7:07 PM
    Wednesday, September 2, 2015 2:30 PM
  • My solution to this issue could be found here:

    https://social.technet.microsoft.com/Forums/systemcenter/en-US/12802a01-5258-40df-9da4-9690fff53b18/exchange-2010-management-pack-for-scom-2012

    Essentially you query the database with this:

    Use OperationsManager SELECT * FROM dbo.ImageReference JOIN dbo.[Resource] on ([Resource].ResourceId = ImageReference.ImageId) LEFT JOIN dbo.[Category] ON [Category].CategoryTarget = [Resource].ResourceId LEFT JOIN dbo.[EnumType] ON [EnumType].EnumTypeId = [Category].CategoryValue JOIN dbo.MPElementView ON (ImageReference.ReferenceId = MPElementView.MPElementId) INNER JOIN dbo.[ManagementPack] ON dbo.ManagementPack.ManagementPackId = [ImageReference].ManagementPackId AND dbo.ManagementPack.ContentReadable = 1 WHERE dbo.[ImageReference].[ReferenceId] IN (select dbo.ManagedType.ManagedTypeId from dbo.ManagedType) and dbo.[Resource].ResourceType = 4 AND [EnumType].EnumTypeName IS NULL

    If the issue is the NetApp DataOntap, like it was for me, then run the following:

    UPDATE dbo.Category SET CategoryTarget='1469A3E7-BC77-3551-3AA7-290DBEA7C72D' where CategoryName='Cat.DataONTAP.Cluster.DataVserver.Volume.SMBShare.Image.Large'

    UPDATE dbo.Category
    SET CategoryTarget='6AF8CD6B-C876-E0D2-00C0-5EEB0F134729'
    where CategoryName='Cat.DataONTAP.Cluster.NodeVserver.FCPAdapter.Image.Small'

    This resolved my issue.

    • Proposed as answer by Nakatomi2233 Wednesday, September 2, 2015 7:07 PM
    Wednesday, September 2, 2015 7:06 PM
  • This issue listed above with the DB query and fixing the NULL values also fixed my issue. I was having the same Correlation Service issue starting and stopping, and the Event ID 4999 as well. The issue started when we installed the NetApp management pack.  Hence the Data OnTap NULL categories that needed attention.
    Thursday, October 22, 2015 7:34 PM