none
agentless monitoring SCOM 2007 R2

    Question

  • Good morning

    I am wondering if there is a way to monitor windows event logs using the agentless feature in SCOM 2007 R2.  We do not currently want to deploy agents into our production enviornment so I am forced to find a way to monitor server health using the agentless feature.  I am currently monitoring 15 servers in my test enviornment but I am not able to view system logs on any of the servers I am monitoring.  Is this possible using the agentless feature?

     

    Thanks
    Dan

    Tuesday, June 14, 2011 12:44 PM

Answers

  • With agentless monitoring you would be left with some of the simple stuf like ping and snmp based monitoring and perhaps some additional stuff. But that wouldnt be good monitoring. Ask management to go for the road to push out agents as it will give them a lot of value.
    Bob Cornelissen - BICTT (My BICTT Blog) - Microsoft Community Contributor 2011 Recipient
    • Marked as answer by Vivian Xing Wednesday, June 22, 2011 9:25 AM
    Tuesday, June 21, 2011 5:48 AM
    Moderator

All replies

  • Hi

    Sadly not - to be honest, I wouldn't recommend using SCOM unless you can actually put agents on the servers. I don't think there is a lot of value to agentless monitoring and (to the best of my knowledge) you still need OpsMgr licenses. Note that most management packs do not support agentless monitoring - e.g. Exchange, AD, SQL ... and you can't have a firewall between the Management Servers and any agentless monitored servers.

    http://technet.microsoft.com/en-us/library/bb432144.aspx

    http://technet.microsoft.com/en-us/library/cc950517.aspx

    Cheers

    Graham


    View OpsMgr tips and tricks at http://systemcentersolutions.wordpress.com/
    Tuesday, June 14, 2011 2:07 PM
    Moderator
  • Graham

    I appreciate the quick response.  Have you heard of or experienced any problems with performance on servers that SCOM agents have been pushed out too?  Our fear is that the agents will negatively effect the performance of our production enviornment.

     

    Thanks

    Dan

    Tuesday, June 14, 2011 2:32 PM
  • Hi Dan

    I'm playing a bit of the devils advocate here but if you don't trust the agent not to overly impact the server then why did your company but OpsMgr? Agentless monitoring will still impact the server and will be an expensive and very limited monitoring solution e.g you can't do SQL, AD, Exchange, SharePoint, IIS etc monitoring agentlessly.

    Servers that have resource issues and are running slowly now will struggle to process the OpsMgr workflows once an agent is installed. You might also want to exercise care with SQL servers that have hundreds of databases on them but in general you shouldn't see a healthy server suddenly become "slow" just because you put an OpsMgr agent on them. There is some bench marking documentation here:

    http://opsmgrunleashed.wordpress.com/2007/05/24/opsmgr-2007-agent-deployment-footprint/

    I'll let others have their say as well - they may well disagree with my thoughts.

    Cheers

    Graham


    View OpsMgr tips and tricks at http://systemcentersolutions.wordpress.com/
    Tuesday, June 14, 2011 4:05 PM
    Moderator
  • Just a quick comment on the licensing - as Graham mentions, you still have to pay for an agent license even if you're doing agentless monitoring - so from a cost perspective you might as well install the agent and get all the benefits.  As for performance, we have over 2000 agents and have never had a performance issue due to scom, but scom has helped us find many other issues that we would have never otherwise known about.
    Layne, 2011 Microsoft Community Contributor Recipient
    Tuesday, June 14, 2011 8:38 PM
  • Just to add my thoughts as Graham asked :-)

    If a machine has no resources at all than ANY monitoring by any product will impact performance. Same for the backup agent, antivirus, cmdb, sccm and so on and so on. They are all overhead processes, but needed for several reasons.

    Performance problems. I have seen a  few, but mostly they are related to something else being broken.

    For instance remember to do your antivirus exclusions first http://www.bictt.com/blogs/bictt.php/2011/06/03/scom-trick-24-antivirus-exclusions.

    Make sure you install the SCOM agent with the latest CU included.

    On some old machines (win2003) the wmi might be broken and need some hotfixes. Perhaps check http://blogs.technet.com/b/kevinholman/archive/2009/01/27/which-hotfixes-should-i-apply.aspx for a list.
    Its not that you will run into all of these.

    In general I also have no trouble with agent performance impacting servers in organizations of all kinds of sizes (from 10 to 2000 agents). Have no fear.


    Bob Cornelissen - BICTT (My BICTT Blog)
    Wednesday, June 15, 2011 9:08 AM
    Moderator
  • Yes, it's possible to monitor the event log and performance counter with agentless monitoring.  Everyone here pointed out some good reasons to stay away from agentless monitoring, and it's not the overall recommended method for monitoring the entire environment.  Most MP's do not even support agentless monitoring, and load will steadily increase on the management server as you agentlessly monitor more computers.  This is one of those products where we really need a service running on the local host to get the full value.
    HTH, Jonathan Almquist - MSFT
    Thursday, June 16, 2011 7:43 PM
    Moderator
  • Jonathan

    How is it possible to monitor event logs with agentless monitoring?  I understand that to get the full value out of SCOM I should push out an agent but at this time it has been decided that we do not want to go down that road. 

     

    Thanks

    Dan

    Friday, June 17, 2011 12:29 PM
  • It's not possible to monitor remote event logs.

    We're a fairly big shop here (2000+ agents, 4 management servers, clustered RMS, 16 gateways) and have no performance issues with the agents. We also have some VERY LARGE SQL clusters that run the agent dual-homed (to our PROD & DEV environments) and they run just fine. If you can't run the agent on servers, there's really no point in deploying SCOM. All of the power of SCOM comes from the management packs (discoveries, collection rules, alert generating rules/monitors), and you need the agents to do that. If your management says "We want to run SCOM and use the Exchange 2010 and SQL2008 MP but you can't have agents" they're telling you to drive a race car with no tires.


    "Fear disturbs your concentration"
    Monday, June 20, 2011 3:33 PM
  • With agentless monitoring you would be left with some of the simple stuf like ping and snmp based monitoring and perhaps some additional stuff. But that wouldnt be good monitoring. Ask management to go for the road to push out agents as it will give them a lot of value.
    Bob Cornelissen - BICTT (My BICTT Blog) - Microsoft Community Contributor 2011 Recipient
    • Marked as answer by Vivian Xing Wednesday, June 22, 2011 9:25 AM
    Tuesday, June 21, 2011 5:48 AM
    Moderator
  • We have a slight problem with agentless stations: only windows 2008 shows not MONITORED

    all 2003 are ok besides 2008 servers not monitored using agentless

    windows operating systems should show healthy but it says not monitored

    and we have installed 2008 MP

    please advice

    thank you



    • Edited by ascp1600 Thursday, March 01, 2012 3:54 PM
    Wednesday, February 29, 2012 7:18 PM
  • Hi,

    i'm trying to delete object/server on Agentless managed in SCOM but still it appearing on console. Is this a bug?

    Please help.

    Thanks,



    • Edited by Shianx Wednesday, February 13, 2013 4:55 AM
    Wednesday, February 13, 2013 4:55 AM