none
What is Monitored

    Question

  • Hello,

    Can someone please recommend a way to perform the following?

    The Management Team / Team Leads would like to have read access to the SCOM console and view what exactly is monitored for each application.

    Thanks/George

     

    Wednesday, April 13, 2011 2:32 PM

Answers

  • Let's leave the Negative Nancy's in at the bus stop.  The rest of you, check it out!

    Go to the viacode wicki and check out the beta for MP tuner.  For the MP's in the catalog, you can use the online browser to look at what is monitored for each application.

    For your own apps and in-house currently-as-configured view of the same data, download the free beta of MP tuner and you can see what you are monitoring for each of your apps.

    This is a very cool partner value add - and at some point the beta will expire and you'll have a way to buy MP tuner so you can answer these kinds of questions.

    http://mpwiki.viacode.com

    This is an awesome ability to be able to pick up. The online version is free.  The in house version is in beta.  Help them improve their product!

    We now return control to the regularly scheduled whinging ...

     

     


    Microsoft Corporation
    Wednesday, April 13, 2011 7:42 PM
  • There are a few things you can do.  You can run a few tasks "show running rules and monitors" and or "show failed rules and monitors" from the agent object on the box.  Just pick a few classes and save the output as a TXT file, then rename it to .HTML and click through everything.

    Another option is to use the MPViewer to look at the management packs.  The values of performance monitors and what not is visable using the tool and looking at the raw XML.  However, just being able to export those to Excel XML format gives anyone a good idea of what monitoring by application is occuring on your box.

    Finally Jonathan Almquist has a powershell script that can actually show you all the monitors and the values that are running.  I haven't used this yet, but it's on my to do list.  So basically you take all of this data and do your best to compile a single document showing those managers "What is monitored".

    I think a more relavent question for SCOM is what ISN'T monitored, because as you start to use this application you will find that you start to turn a lot of stuff off as compared to add monitoring.

    Negative Nancy's resume the hate.  ;-)


    Regards, Blake Email: mengotto<at>hotmail.com Blog: http://discussitnow.wordpress.com/
    Thursday, April 14, 2011 8:23 AM
    Moderator
  •  

    Hi,

     

    In addition, I would like to share the following with you for your reference:

     

    What Monitors, Rules and Discoveries are running on an OpsMgr Agent?

    http://blogs.technet.com/b/stefan_stranger/archive/2010/11/30/what-monitors-rules-and-discoveries-are-running-on-an-opsmgr-agent.aspx

     

    Hope this helps.

     

    Thanks.


    Nicholas Li - MSFT
    Please remember to click “Mark as Answer” on the post that helps you, and to click “Unmark as Answer” if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.
    Friday, April 15, 2011 6:37 AM
    Moderator
  • [Definition]Negative Nancy = someone that has to actually use SCOM to support a large business enterprise[/Definition]

    I agree "show running rules and monitors" is a good way to see to what is going on, but the output is sheer ugliness.   Configuration viewer is better but allegedly not accurate post R2.  MP viewer is a very good way to look at MP's and I use it often to see what's going on, but it's not something the helps your service customers.

    I've been asked what's running on my servers a number of times and IMO it's a very good question and a server\application owner should have a reasonable expectation of a reasonable answer.  The real answer to what is running on a server is "a whole bunch of stuff".  I've found over 600 workflows running on some systems so how do you show that in a simple report and what would an app owner make of that?  I haven't looked at many systems in thIS way so I don't know if that is a typical number.

    A query I like to use is what's discovered on a computer.  The assumption being that discovered items may have rules and monitors applied. Not entirely sure this returns everything.  I should be able to relate these discoveries to specific rules and monitors but haven't been able to get to that state yet.

    select distinct bme.DisplayName,mp.mpName, d.discoveryname
    from typedmanagedentity TME
    Join BaseManagedEntity BME ON TME.BaseManagedEntityId = BME.BaseManagedEntityId
    JOIN DiscoverySourceToTypedManagedEntity DSTME ON TME.TypedManagedEntityID = DSTME.TypedManagedEntityID
    JOIN DiscoverySource DS ON DS.DiscoverySourceID = DSTME.DiscoverySourceID
    JOIN Discovery D ON DS.DiscoveryRuleID=D.DiscoveryID
    JOIN ManagementPack mp ON mp.ManagementPackID = d.ManagementPackID
    Where BME.Fullname like '%servername%' 
    order by mp.mpName, d.discoveryname, bme.DisplayName

    BTW I'm busting on MS chops 'cause, but I think SCOM does a lot of things well. It's just that the gaps are evidence of some weird form of tunnel vision.  It's possible the developers don't get out much or are kept hidden in a cave somewhere. :)

    Friday, April 15, 2011 1:02 PM
  • Yes, you are not the only one getting these questions. Mostly these questions come from people who are used to monitoring tools that monitor 10 performance counters and 10 event rules on a system. In most of the times this is already too much for some managers to comprehend because its not their kind of work, but the numbers are manageable. It is hard to explain to them that when using a lot of management packs you are checking for hundreds or thousands of things in the end. And also that you will adjust thresholds for a number of them and not allways for "all computers", which makes answering it more difficult. I use the mpviewer in some cases to show some of it. If there are only a few people who can sit beside you there is a possibility to walk through the health explorer, views, monitors and rules scoped to that application role (exchange or sql or whatever) and in most cases that makes it clear for them as well. The links to Stefans blog and the wiki will also help. I also hope for a nice way to export the whole thing in one time... by the way, that would really make it look cool if the numbers stack up... :-)
    Bob Cornelissen - BICTT (My BICTT Blog)
    Monday, April 18, 2011 7:12 AM
    Moderator
  • I have to agree with Bob on this one and I get many customers asking for this information (since the days of MOM 2000 so it is not a new request). And as Bob says they are used to getting it from other monitoring systems (even it it is easy as they only monitor a handful of things). Just because it is difficult does not mean that it should not be done. It is not unreasonable of the Exchange or AD or Windows support team to request what is being monitored on their behalf.

    Stefan’s script is a good start but as he says himself it can take a long time to run.

    MPViewer is useful but does not give threshold information so is only partly useful.

    Effective Configuration Viewer is also useful but can only be pointed at one server at a time.

    The customer I am working with has looked at MP Tuner and does not think it answers the question.

    And while it is tricky to see what is going on with a particular agent due to overrides there is the overrides report that can be run. I think an improved version of MPViewer with more information available combined with the override report would satisfy most requirements. A proper tool that can do nice looking reports  would be useful and not a bunch of PowerShell scripts.


    Ian Blyth Cosiris - www.cosiris.co.uk OpsMgr Blog - http://ianblythmanagement.wordpress.com/
    Monday, April 18, 2011 8:51 AM
  • i agree with the last few posts, allthough i think i will never make a sheet of what is being monitored. I've made and export of just the rulenames of all rules in mom 2005 and ended up with a document of 600 pages. i'm pretty sure no one ever read it.

    The overview from the mp guides is already more than most managers need to know. The few that want that handfull rules for them to manage,  i'll just point them to the pile mp guides in the corner for them to read. I'll never hear from them again :).  Why would a manager want to manage a threshold limit in a monitoring tool anyway? he should manage the time he has to arrange for more capacity and let the technies translate that time to a threshold or make sure he has a capacity proces running, which is not scom alerting, but more scom collecting data and reporting over it(trendlines).

    For operators who actually work with the console, i'd really like to see an "effective configuration" viewer as well as a "read only" view of the monitor/rule. Operators tend to ignore alerts when they don't understand where they are coming from, so they need to have the means to check themselves what is being monitored exactly AND clickable from the alert or health explorer.

    MP tuner looks nice, but more for the scom admin/author then the manager or the operator.


    Rob Korving
    http://jama00.wordpress.com/
    Monday, April 18, 2011 2:09 PM

All replies

  • Good luck with that. 

    The SCOM team doesn't see this as a need, and they'll start going on about objects and classes and how the whole question is irrelevant.  You'll be left trying to explain that to your customers.

    Sorry for the sarcasm but this product brings out the worst in me.

    Wednesday, April 13, 2011 3:00 PM
  • This is a fairly accurate statement about SCOM. There's no transparency into what's monitored on a server/application. I heard a rumor that this might be possible in SCOM v.next, but I wouldn't hold my breath. There are some 3rd party apps (like Silect's MP Studio) that attempt to ferret this data out, but with overrides all over the place, it's a damn near impossible task.
    "Fear disturbs your concentration"
    Wednesday, April 13, 2011 3:36 PM
  • >>I heard a rumor that this might be possible in SCOM v.next,

    Nothing like this was mentioned at MMS 2011.  Thinking of how huge this would be I'd like to think MS would be all over promoting it at a venue like that.


    Layne, 2011 Microsoft Community Contributor Recipient
    Wednesday, April 13, 2011 6:48 PM
  • the question might be a bit easier. if you have access to the scom console as an operator you can just see the alerts/monitors etc, but not configuration of the rules/monitors. you will need the author role for that. with the other rule they get a new tab in the console and can scope the monitors/rule views on the classes (applications) they want to investigate. i can't imagine someone from the management can understand it, but hey they didn't ask for stuff they would understand (careful with the author role though, there's not a "view only author" role and they can break stuff with it).
    Rob Korving
    http://jama00.wordpress.com/
    Wednesday, April 13, 2011 7:25 PM
  • >>I heard a rumor that this might be possible in SCOM v.next,

    Nothing like this was mentioned at MMS 2011.  Thinking of how huge this would be I'd like to think MS would be all over promoting it at a venue like that.


    Layne, 2011 Microsoft Community Contributor Recipient
    Actually I did hear it at MMS, but I don't recall what session that was.  A big step forward IMO.
    Wednesday, April 13, 2011 7:27 PM
  • Let's leave the Negative Nancy's in at the bus stop.  The rest of you, check it out!

    Go to the viacode wicki and check out the beta for MP tuner.  For the MP's in the catalog, you can use the online browser to look at what is monitored for each application.

    For your own apps and in-house currently-as-configured view of the same data, download the free beta of MP tuner and you can see what you are monitoring for each of your apps.

    This is a very cool partner value add - and at some point the beta will expire and you'll have a way to buy MP tuner so you can answer these kinds of questions.

    http://mpwiki.viacode.com

    This is an awesome ability to be able to pick up. The online version is free.  The in house version is in beta.  Help them improve their product!

    We now return control to the regularly scheduled whinging ...

     

     


    Microsoft Corporation
    Wednesday, April 13, 2011 7:42 PM
  • There are a few things you can do.  You can run a few tasks "show running rules and monitors" and or "show failed rules and monitors" from the agent object on the box.  Just pick a few classes and save the output as a TXT file, then rename it to .HTML and click through everything.

    Another option is to use the MPViewer to look at the management packs.  The values of performance monitors and what not is visable using the tool and looking at the raw XML.  However, just being able to export those to Excel XML format gives anyone a good idea of what monitoring by application is occuring on your box.

    Finally Jonathan Almquist has a powershell script that can actually show you all the monitors and the values that are running.  I haven't used this yet, but it's on my to do list.  So basically you take all of this data and do your best to compile a single document showing those managers "What is monitored".

    I think a more relavent question for SCOM is what ISN'T monitored, because as you start to use this application you will find that you start to turn a lot of stuff off as compared to add monitoring.

    Negative Nancy's resume the hate.  ;-)


    Regards, Blake Email: mengotto<at>hotmail.com Blog: http://discussitnow.wordpress.com/
    Thursday, April 14, 2011 8:23 AM
    Moderator
  •  

    Hi,

     

    In addition, I would like to share the following with you for your reference:

     

    What Monitors, Rules and Discoveries are running on an OpsMgr Agent?

    http://blogs.technet.com/b/stefan_stranger/archive/2010/11/30/what-monitors-rules-and-discoveries-are-running-on-an-opsmgr-agent.aspx

     

    Hope this helps.

     

    Thanks.


    Nicholas Li - MSFT
    Please remember to click “Mark as Answer” on the post that helps you, and to click “Unmark as Answer” if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.
    Friday, April 15, 2011 6:37 AM
    Moderator
  • [Definition]Negative Nancy = someone that has to actually use SCOM to support a large business enterprise[/Definition]

    I agree "show running rules and monitors" is a good way to see to what is going on, but the output is sheer ugliness.   Configuration viewer is better but allegedly not accurate post R2.  MP viewer is a very good way to look at MP's and I use it often to see what's going on, but it's not something the helps your service customers.

    I've been asked what's running on my servers a number of times and IMO it's a very good question and a server\application owner should have a reasonable expectation of a reasonable answer.  The real answer to what is running on a server is "a whole bunch of stuff".  I've found over 600 workflows running on some systems so how do you show that in a simple report and what would an app owner make of that?  I haven't looked at many systems in thIS way so I don't know if that is a typical number.

    A query I like to use is what's discovered on a computer.  The assumption being that discovered items may have rules and monitors applied. Not entirely sure this returns everything.  I should be able to relate these discoveries to specific rules and monitors but haven't been able to get to that state yet.

    select distinct bme.DisplayName,mp.mpName, d.discoveryname
    from typedmanagedentity TME
    Join BaseManagedEntity BME ON TME.BaseManagedEntityId = BME.BaseManagedEntityId
    JOIN DiscoverySourceToTypedManagedEntity DSTME ON TME.TypedManagedEntityID = DSTME.TypedManagedEntityID
    JOIN DiscoverySource DS ON DS.DiscoverySourceID = DSTME.DiscoverySourceID
    JOIN Discovery D ON DS.DiscoveryRuleID=D.DiscoveryID
    JOIN ManagementPack mp ON mp.ManagementPackID = d.ManagementPackID
    Where BME.Fullname like '%servername%' 
    order by mp.mpName, d.discoveryname, bme.DisplayName

    BTW I'm busting on MS chops 'cause, but I think SCOM does a lot of things well. It's just that the gaps are evidence of some weird form of tunnel vision.  It's possible the developers don't get out much or are kept hidden in a cave somewhere. :)

    Friday, April 15, 2011 1:02 PM
  • Thanks for sharing the perspecite.  It is fair to keep your needs and wants well articulated.

    In general, it is a Microsoft strategy to focus on the core elements as a product progresses, and from release to release add a mix of new and backfill previously uncovered gaps.  These gaps are significant part of our partner strategy however, and third parties thrive in these gaps.  This is the case with the MP wiki - a free and no cost way to improve the functionality of MP examination, plus a for profit opportunity for these third parties (the beta of mp tuner is free, and shows compelling value).  If you haven't checked it out, give it a try.


    Microsoft Corporation
    Friday, April 15, 2011 9:51 PM
  • Yes, you are not the only one getting these questions. Mostly these questions come from people who are used to monitoring tools that monitor 10 performance counters and 10 event rules on a system. In most of the times this is already too much for some managers to comprehend because its not their kind of work, but the numbers are manageable. It is hard to explain to them that when using a lot of management packs you are checking for hundreds or thousands of things in the end. And also that you will adjust thresholds for a number of them and not allways for "all computers", which makes answering it more difficult. I use the mpviewer in some cases to show some of it. If there are only a few people who can sit beside you there is a possibility to walk through the health explorer, views, monitors and rules scoped to that application role (exchange or sql or whatever) and in most cases that makes it clear for them as well. The links to Stefans blog and the wiki will also help. I also hope for a nice way to export the whole thing in one time... by the way, that would really make it look cool if the numbers stack up... :-)
    Bob Cornelissen - BICTT (My BICTT Blog)
    Monday, April 18, 2011 7:12 AM
    Moderator
  • I have to agree with Bob on this one and I get many customers asking for this information (since the days of MOM 2000 so it is not a new request). And as Bob says they are used to getting it from other monitoring systems (even it it is easy as they only monitor a handful of things). Just because it is difficult does not mean that it should not be done. It is not unreasonable of the Exchange or AD or Windows support team to request what is being monitored on their behalf.

    Stefan’s script is a good start but as he says himself it can take a long time to run.

    MPViewer is useful but does not give threshold information so is only partly useful.

    Effective Configuration Viewer is also useful but can only be pointed at one server at a time.

    The customer I am working with has looked at MP Tuner and does not think it answers the question.

    And while it is tricky to see what is going on with a particular agent due to overrides there is the overrides report that can be run. I think an improved version of MPViewer with more information available combined with the override report would satisfy most requirements. A proper tool that can do nice looking reports  would be useful and not a bunch of PowerShell scripts.


    Ian Blyth Cosiris - www.cosiris.co.uk OpsMgr Blog - http://ianblythmanagement.wordpress.com/
    Monday, April 18, 2011 8:51 AM
  • I think part of the problem is that "what is being monitored" means different things to different people. The thread started off with a question about "management" wanting to know what is being monitored but has quickly turned far more technical. If anyone wants to give the output from Stefans script to their line manager then I'd love to be there to see the managers reaction when they "read" through it ;-)

    - Pre-sales => this could be covered by clear documentation and should be straight forward to achieve.

    - Management => Almost pre-sales level .. I'm not convinced they need to know every rule \ monitor and override and I'm not sure they know what they want from the question "what is being monitored." . In general, if the guide has good info on this (and I do think the guides are generally much better at providing this information these days), then I still just copy \ paste this info and it is usually sufficient.

     - Techie \ Troubleshooting => is my override in place? what are the actual settings of specific rules \ monitors \ discoveries? Which Run As Profile is the rule \ monitor executing under? I'd agree with Ian that we have a collection of tools, all of which provide some useful information around this but none of which actually does a comprehensive job of answering this question from a technical point of view. Effective configuration viewer for instance, doesn't actually give a full detailed output of effective configuration (thresholds etc).

    "In general, it is a Microsoft strategy to focus on the core elements as a product progresses" - what could be more "core" to a monitoring application than the question "what am I monitoring?". 

     


    View OpsMgr tips and tricks at http://systemcentersolutions.wordpress.com/
    Monday, April 18, 2011 9:38 AM
    Moderator
  • i agree with the last few posts, allthough i think i will never make a sheet of what is being monitored. I've made and export of just the rulenames of all rules in mom 2005 and ended up with a document of 600 pages. i'm pretty sure no one ever read it.

    The overview from the mp guides is already more than most managers need to know. The few that want that handfull rules for them to manage,  i'll just point them to the pile mp guides in the corner for them to read. I'll never hear from them again :).  Why would a manager want to manage a threshold limit in a monitoring tool anyway? he should manage the time he has to arrange for more capacity and let the technies translate that time to a threshold or make sure he has a capacity proces running, which is not scom alerting, but more scom collecting data and reporting over it(trendlines).

    For operators who actually work with the console, i'd really like to see an "effective configuration" viewer as well as a "read only" view of the monitor/rule. Operators tend to ignore alerts when they don't understand where they are coming from, so they need to have the means to check themselves what is being monitored exactly AND clickable from the alert or health explorer.

    MP tuner looks nice, but more for the scom admin/author then the manager or the operator.


    Rob Korving
    http://jama00.wordpress.com/
    Monday, April 18, 2011 2:09 PM
  • Thanks for the comment Rob, i agree with you on this. I have also done things like that... printing a lot of pages and pushing them all to the requesters and suddenly things went quiet while I was still exporting and converting to word or excel and printing. Also pointing to guides and pointing out that they will need to read about 40 of those to start with... Somehow some managers want to micromanage and when the answers come they dont know what to do with it. Most of the times a middle road already does the trick. mpviewer output (which doesnt contain thresholds etc) for a few management packs usually convinces them that a lot more is monitored than they thought. Also mentioning product teams wrote them and best practises are used for thresholds and things like that. Followed by the mentions that some have been tuned according to the customer specific environment and using community best practises.
    Bob Cornelissen - BICTT (My BICTT Blog)
    Monday, April 18, 2011 3:32 PM
    Moderator