Bryce Kinnamon's profileBryce Kinnamon - Senior ...PhotosBlogListsMore ![]() | Help |
Bryce Kinnamon - Senior Computer Systems ArchitectMonitoring Windows Systems with MOM 2005 and System Center Operations Manager!! |
||||||||||||||||||||
Other MOM related Blogs
|
May 13 Bulk SCOM and MOM 2005 Clear Agent Cache ScriptsI thought I would make one for both cause if your like me, you still have some MOM2005 stuff left in your environment as well as all the SCOM trials and tribulations that come with the territory.
Pretty basic scripts. You create 'C:\Servers.txt' file. The script loops through the server names, pings them to verify they are reachable, stops the agent service (MOM or Health Service), deletes the appropriate agent files and folders and then restarts the service.
P.S. - if you want to see the servers that the scripts runs on add a 'wscript.echo strComputer' into the script. Works well if your using Primal Script.
Script comments are pretty self explainatory.
Here's the SCOM Script:
'==========================================================================
' ' VBScript Source File -- Created with SAPIEN Technologies PrimalScript 4.1 ' ' NAME: Bulk_MOM2005agentclearcache ' ' AUTHOR: Bryce Kinnamon aka Script Money!! ' DATE : 5/6/2008 ' ' COMMENT:Create c:\servers.txt ' (one server per line) ' (use account with appropriate rights to stop services and delete directories under Program File\SCOM07) '========================================================================== '''Set File System Objects
Set objFSO = CreateObject("Scripting.FileSystemObject") Set objTextFile = objFSO.OpenTextFile ("c:\servers.txt", 1, True) ''''Start the Loop
Do Until objTextFile.AtEndOfStream strComputer = objTextFile.ReadLine If Ping(strComputer) Then strDestination = "\\" & strComputer & "\c$\Program Files\System Center Operations Manager 2007\Health Service State"
strServiceName = "HealthService" Set objWMIService = GetObject("winmgmts:" & "{impersonationLevel=impersonate}!\\" _ & strComputer & "\root\cimv2") Set colServiceList = objWMIService.ExecQuery ("Select * from Win32_Service " _ & "Where Name='" & strServiceName & "'") For Each objService in colServiceList objService.StopService() WScript.sleep 10000 objFSO.Deletefolder(strDestination) objService.StartService() Next End If Loop objTextFile.Close
Set objFSO=Nothing Set objTextFile=Nothing Set objWMIService=Nothing Set colServiceList=Nothing Function Ping( myHostName )
' This function returns True if the specified host could be pinged. ' myHostName can be a computer name or IP address. ' The Win32_PingStatus class used in this function requires Windows XP or later. ' Standard housekeeping
Dim colPingResults, objPingResult, strQuery ' Define the WMI query
strQuery = "SELECT * FROM Win32_PingStatus WHERE Address = '" & myHostName & "'" ' Run the WMI query
Set colPingResults = GetObject("winmgmts://./root/cimv2").ExecQuery( strQuery ) ' Translate the query results to either True or False
For Each objPingResult In colPingResults If Not IsObject( objPingResult ) Then Ping = False ElseIf objPingResult.StatusCode = 0 Then Ping = True Else Ping = False End If Next End Function Here's the MOM2005 Script:
'==========================================================================
' ' VBScript Source File -- Created with SAPIEN Technologies PrimalScript 4.1 ' ' NAME: Bulk_MOM2005agentclearcache ' ' AUTHOR: Bryce Kinnamon aka Script Money!! ' DATE : 5/6/2008 ' ' COMMENT:Create c:\servers.txt ' (one server per line) ' (use account with appropriate rights to stop services and delete directories in All Users profile) '========================================================================== '''Set File System Objects
Set objFSO = CreateObject("Scripting.FileSystemObject") Set objTextFile = objFSO.OpenTextFile ("c:\servers.txt", 1, True) ''''Start the Loop
Do Until objTextFile.AtEndOfStream strComputer = objTextFile.ReadLine If Ping(strComputer) Then strDestination = "\\" & strComputer & "\c$\Documents and Settings\All Users\Application Data\Microsoft\Microsoft Operations Manager\mommgmt"
strServiceName = "MOM" Set objWMIService = GetObject("winmgmts:" & "{impersonationLevel=impersonate}!\\" _ & strComputer & "\root\cimv2") Set colServiceList = objWMIService.ExecQuery ("Select * from Win32_Service " _ & "Where Name='" & strServiceName & "'") For Each objService in colServiceList objService.StopService() WScript.sleep 10000 objFSO.Deletefolder(strDestination) objService.StartService() Next End If Loop objTextFile.Close
Set objFSO=Nothing Set objTextFile=Nothing Set objWMIService=Nothing Set colServiceList=Nothing Function Ping( myHostName )
' This function returns True if the specified host could be pinged. ' myHostName can be a computer name or IP address. ' The Win32_PingStatus class used in this function requires Windows XP or later. ' Standard housekeeping
Dim colPingResults, objPingResult, strQuery ' Define the WMI query
strQuery = "SELECT * FROM Win32_PingStatus WHERE Address = '" & myHostName & "'" ' Run the WMI query
Set colPingResults = GetObject("winmgmts://./root/cimv2").ExecQuery( strQuery ) ' Translate the query results to either True or False
For Each objPingResult In colPingResults If Not IsObject( objPingResult ) Then Ping = False ElseIf objPingResult.StatusCode = 0 Then Ping = True Else Ping = False End If Next End Function April 28 Bulk MOMClean.exe scriptHere’s what the script does (in this order):
The message states to make sure you go back and delete the gray inactive agents from the console. (you may need to clear your Operations Console cache before you will see the agents go gray).
See the comments section in the top of the Script file for more detailed instructions regarding the MOMClean.bat and where to get the ‘cleanMOM.exe’ utility.
The script doesn’t take very long to run at all. Maybe 5 seconds per server approximately. Start with some smaller groups to test it out for yourself but once you’re comfortable with it, you can run as many servers as you want at one time.
/////////////////////////////////Here's the script\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\
'========================================================================== On Error Resume Next '''Set File System Objects ''''Start the Loop End If objTextFile.Close
MsgBox("MOM Bulk Clean has completed. Please check 'c:\Success.txt' to see the list of servers the script ran on. Also make sure to delete the gray inactive agents from the Operations Console under 'Administration\Agent Managed'.") WScript.Quit Function IsAlive(strHost)
June 20 SQL Reporting - Separate Event Parameters into columns***The Query below can be copied into query analyzer and run without any changes against your SystemCenterReporting DB.***
SELECT SUBSTRING(Message, PATINDEX('%Member Name:%', Message) + 12, PATINDEX('%Member ID:%', Message) - PATINDEX('%Member Name:%',Message) - 12) AS MName, SUBSTRING(Message, PATINDEX('%Member ID:%', Message) + 11, PATINDEX('%Target Account Name:%', Message) - PATINDEX('%Member ID:%', Message) - 11) AS MemberID, SUBSTRING(Message, PATINDEX('%Target Account Name:%', Message) + 20,PATINDEX('%Target Domain:%', Message) - PATINDEX('%Target Account Name:%', Message) - 20) AS TAName, SUBSTRING(Message,PATINDEX('%Target Domain:%', Message) + 14, PATINDEX('%Target Account ID:%', Message) - PATINDEX('%Target Domain:%', Message) - 14) AS TDomain, NTEventID, UserName AS Admin, TimeGenerated
FROM SDKEventView
WHERE (NTEventID IN (636, 632, 660, 650, 655, 665)) and (SUBSTRING(Message, PATINDEX('%Target Account Name:%', Message) + 20,PATINDEX('%Target Domain:%', Message) - PATINDEX('%Target Account Name:%', Message) - 20) LIKE '%admin%')
ORDER BY TimeGenerated
If you audit your event logs for admin group add's or any audit events for that matter then the above code will surely help you with your reporting. What I found annoying about developing reports for audit events was the description field is all blocked together in the Message column of your SDKEventView in SystemCenterReporting. This makes reporting messy to read as there is plenty of information that you absolutely do not require in the report IMHO. The above code will parse out all the data from the 'Message' column that I find to be unnecessary, and it will break out the remaining parameter information into separate fields in your report thus allowing a great deal more versatility in filtering the data once it's been pulled from the view. The code is easy to edit if you choose to add or remove parameters. It's using a basic PATINDEX function from sql to define the starting position and length of the strings. Lets use the description for Audit event 632 in this example. Each line is a parameter in the description for this event.
Security Enabled Global Group Member Added:
Member Name: - Member ID: %{S-I-D-SI-DSIDSIDSID-SIDSIDSIDS-IDSIDSIDS-IDSID} Target Account Name: None Target Domain: YOUDOMAIN OR LOCAL MACHINE Target Account ID: GroupName Caller User Name: UserName Caller Domain: Domain Caller Logon ID: (0x0,0x00000) Privileges: - The basic logic is this, if u want to break out Parameter 2 'Member Name:' in your SQL Report then you'll have to use this line of code in your Select Statement to do that:
SUBSTRING(Message, PATINDEX('%Member Name:%', Message) + 12, PATINDEX('%Member ID:%', Message) - PATINDEX('%Member Name:%',Message) - 12) AS MName In this example, lets say "Member Name:" begins in position 51 (and lets call that A). And lets say "Member ID:" starts in 91 (and lets call that B). Then the PatIndex would need to use params substring (Message,(A,B-A)). See why that works? B=91 A=51 then the LENGTH of the literal string is 40. So the string would start at position 51 and then go out another 40 positions only. You can apply this logic with any of the the above Parameters. If you have any questions about how to build a Event Report from scratch in Visual Studio, here is a great link for it.
Any questions, feel free to post here.
Regards,
Bryce February 26 Custom DNS Clear Cache script for MOMCreate rule to schedule your C:\dnscmd.exe /clearcache on your DNS servers
1.You should create a timed event provider to set interval times that you would like to flush the DNS cache on your DNS servers.
2.You'll need to add the script to your scripts folder in the admin console.
3.Make sure you create your custom event rule in the custom rule group that has the respective computer groups associated that contain your DNS servers or just use the builtin DNS rule groups from the DNS MP that are bound to the builtin DNS servers groups from the MP.
3.Keep in mind, this rule runs on the Agent, not the Management server so make sure you create the rule to run on the Agent. If you have any question about the custom script creation process you can reference some of the notes from this article:
Link to MOM resource how to section:
Right click the 'Implementing Custom Scripts' and save the PDF to your computer.
Here is your script:
'==========================================================================================================
' ' VBScript Source File -- Created with SAPIEN Technologies PrimalScript 3.1 ' ' NAME: DNS Clear Cache Script (dnscmd.exe /clearcache) ' ' AUTHOR: Bryce Kinnamon - Social Security Administration (assisted by Phil Gibson - Intellinet) ' DATE : 2/1/2007 ' ' Parameters: You must make sure the DNSCMD.exe tool is located on C:\ on the respective DNS Servers ' (or whatever respective location) **note--I had problems if the path had spaces in it anywhere** ' When you create the script in MOM the run location is Agent Computer!! '========================================================================================================== 'On Error Resume Next
Dim objAlert
Set WshShell = CreateObject("WScript.Shell")
WshShell.Run ("C:\dnscmd.exe /clearcache")
If err.number <> 0 Then
Set objAlert = ScriptContext.CreateAlert() objAlert.Name = "Clear DNS Cache" objAlert.AlertLevel = 50 'Critical Error objAlert.Description = "Unsuccessfully cleared DNS Cache. Error number = " & Err.number & ". Error Description = " & Err.description ScriptContext.Submit objAlert Else Set objAlert = ScriptContext.CreateAlert()
objAlert.Name = "Clear DNS Cache" objAlert.AlertLevel = 10 'Success objAlert.Description = "Successfully cleared DNS Cache." ScriptContext.Submit objAlert End If Set objAlert = nothing Recover from MOM OnePoint DB Reindex job failuresThe T-SQL command that executes for the default OnePoint Reindex job on SQL SP3a should look something like this:
EXECUTE master.dbo.xp_sqlmaint '-PlanName OnePointReindex -RebldIdx 100 -WriteHistory'
While this should work it's possible that your SQL Agent Job to reindex the MOM OnePoint might fail anyway. This is known issue with Microsoft that can happen with SQL SP3a. The only resolution I could find forced me to update my SQL SP to SP4. Once I updated my SQL to SP4 I had to add a few switches to the execute command line for the job. This is what my command line looked like when I was done:
EXECUTE master.dbo.xp_sqlmaint N'-S <MYSERVER> -PlanID 8BFC9580-EFAC-4001-B3DF-692AE9D20DD6 -WriteHistory -RebldIdx 100 -SupportComputedColumn'
This resolved the issue I was having with my Reindex issue. For more complete details, refer to this knowledge base article.
Any questions feel free to hit me up directly. |
|
||||||||||||||||||
|
|