Bryce Kinnamon's profileBryce Kinnamon - Senior ...PhotosBlogListsMore Tools Help

Bryce Kinnamon - Senior Computer Systems Architect

Monitoring Windows Systems with MOM 2005 and System Center Operations Manager!!

Bryce Kinnamon

Occupation
Location
No list items have been added yet.

Feed

The owner hasn't specified a feed for this module yet.
No list items have been added yet.
Photo 1 of 1
More albums (1)
This person's network is empty (or maybe they're keeping it private).
May 13

Bulk SCOM and MOM 2005 Clear Agent Cache Scripts

I thought I would make one for both cause if your like me, you still have some MOM2005 stuff left in your environment as well as all the SCOM trials and tribulations that come with the territory. 
 
Pretty basic scripts.  You create 'C:\Servers.txt' file.  The script loops through the server names, pings them to verify they are reachable, stops the agent service (MOM or Health Service), deletes the appropriate agent files and folders and then restarts the service. 
 
P.S. - if you want to see the servers that the scripts runs on add a 'wscript.echo strComputer' into the script.  Works well if your using Primal Script. 
 
Script comments are pretty self explainatory. 
 
Here's the SCOM Script:
 
'==========================================================================
'
' VBScript Source File -- Created with SAPIEN Technologies PrimalScript 4.1
'
' NAME: Bulk_MOM2005agentclearcache
'
' AUTHOR: Bryce Kinnamon aka Script Money!!
' DATE  : 5/6/2008
'
' COMMENT:Create c:\servers.txt
'         (one server per line)      
'         (use account with appropriate rights to stop services and delete directories under Program File\SCOM07)
'==========================================================================
'''Set File System Objects
Set objFSO = CreateObject("Scripting.FileSystemObject")
Set objTextFile = objFSO.OpenTextFile ("c:\servers.txt", 1, True)
 
''''Start the Loop
Do Until objTextFile.AtEndOfStream
    strComputer = objTextFile.ReadLine
    If Ping(strComputer) Then
     strDestination = "\\" & strComputer & "\c$\Program Files\System Center Operations Manager 2007\Health Service State"
     strServiceName = "HealthService"
  Set objWMIService = GetObject("winmgmts:" & "{impersonationLevel=impersonate}!\\" _
  & strComputer & "\root\cimv2")
  Set colServiceList = objWMIService.ExecQuery ("Select * from Win32_Service " _
  & "Where Name='" & strServiceName & "'")
  
  For Each objService in colServiceList
objService.StopService()
WScript.sleep 10000
objFSO.Deletefolder(strDestination)
objService.StartService()
Next
End If
Loop
objTextFile.Close
Set objFSO=Nothing
Set objTextFile=Nothing
Set objWMIService=Nothing
Set colServiceList=Nothing
Function Ping( myHostName )
' This function returns True if the specified host could be pinged.
' myHostName can be a computer name or IP address.
' The Win32_PingStatus class used in this function requires Windows XP or later.
    ' Standard housekeeping
    Dim colPingResults, objPingResult, strQuery
    ' Define the WMI query
    strQuery = "SELECT * FROM Win32_PingStatus WHERE Address = '" & myHostName & "'"
    ' Run the WMI query
    Set colPingResults = GetObject("winmgmts://./root/cimv2").ExecQuery( strQuery )
    ' Translate the query results to either True or False
    For Each objPingResult In colPingResults
        If Not IsObject( objPingResult ) Then
            Ping = False
        ElseIf objPingResult.StatusCode = 0 Then
            Ping = True
        Else
            Ping = False
        End If
    Next
End Function
 
   
    
Here's the MOM2005 Script:
 
'==========================================================================
'
' VBScript Source File -- Created with SAPIEN Technologies PrimalScript 4.1
'
' NAME: Bulk_MOM2005agentclearcache
'
' AUTHOR: Bryce Kinnamon aka Script Money!!
' DATE  : 5/6/2008
'
' COMMENT:Create c:\servers.txt
'         (one server per line)      
'         (use account with appropriate rights to stop services and delete directories in All Users profile)
'==========================================================================
'''Set File System Objects
Set objFSO = CreateObject("Scripting.FileSystemObject")
Set objTextFile = objFSO.OpenTextFile ("c:\servers.txt", 1, True)
 
''''Start the Loop
Do Until objTextFile.AtEndOfStream
    strComputer = objTextFile.ReadLine
    If Ping(strComputer) Then
     strDestination = "\\" & strComputer & "\c$\Documents and Settings\All Users\Application Data\Microsoft\Microsoft Operations Manager\mommgmt"
     strServiceName = "MOM"
  Set objWMIService = GetObject("winmgmts:" & "{impersonationLevel=impersonate}!\\" _
  & strComputer & "\root\cimv2")
  Set colServiceList = objWMIService.ExecQuery ("Select * from Win32_Service " _
  & "Where Name='" & strServiceName & "'")
  
  For Each objService in colServiceList
objService.StopService()
WScript.sleep 10000
objFSO.Deletefolder(strDestination)
objService.StartService()
Next
End If
Loop
objTextFile.Close
Set objFSO=Nothing
Set objTextFile=Nothing
Set objWMIService=Nothing
Set colServiceList=Nothing
Function Ping( myHostName )
' This function returns True if the specified host could be pinged.
' myHostName can be a computer name or IP address.
' The Win32_PingStatus class used in this function requires Windows XP or later.
    ' Standard housekeeping
    Dim colPingResults, objPingResult, strQuery
    ' Define the WMI query
    strQuery = "SELECT * FROM Win32_PingStatus WHERE Address = '" & myHostName & "'"
    ' Run the WMI query
    Set colPingResults = GetObject("winmgmts://./root/cimv2").ExecQuery( strQuery )
    ' Translate the query results to either True or False
    For Each objPingResult In colPingResults
        If Not IsObject( objPingResult ) Then
            Ping = False
        ElseIf objPingResult.StatusCode = 0 Then
            Ping = True
        Else
            Ping = False
        End If
    Next
End Function
 
  
   
   
 
 
 
 
April 28

Bulk MOMClean.exe script

Here’s what the script does (in this order):

 

  1. Reads Servers from a txt file you create on C:\ into a loop.
  2. The script pings the server to verify it’s reachable.
  3. Then Copies the ‘cleanMOM.exe’ tool and ‘MOMclean.bat’ (which you will create) to ‘c:\’ on the remote server
  4. Then the script creates a remote process ‘Win32_Process’ on the server through WMI for the command line. 
  5. The remote computer then runs the ‘MOMclean.bat’ file locally which has the necessary switches for the cleanMOM.exe utility to completely remove the SCOM agent from the server.
  6. The ‘MOMclean.bat’ then removes the ‘cleanMOM.exe’ utility as well as the batch itself from the remote server. 
  7. Then the script creates and writes to a text file ‘c:\success.txt’ all the computers that successfully passed the ping test and should be cleaned of the SCOM agent.
  8. Finally you should get this message when the script is complete:

finish

 

 

The message states to make sure you go back and delete the gray inactive agents from the console. (you may need to clear your Operations Console cache before you will see the agents go gray).  

 

See the comments section in the top of the Script file for more detailed instructions regarding the MOMClean.bat and where to get the ‘cleanMOM.exe’ utility. 

 

The script doesn’t take very long to run at all.  Maybe 5 seconds per server approximately.  Start with some smaller groups to test it out for yourself but once you’re comfortable with it, you can run as many servers as you want at one time.

 

 

 

 

/////////////////////////////////Here's the script\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\

 

'==========================================================================
'
' VBScript Source File -- Created with SAPIEN Technologies PrimalScript 4.1
'
' NAME: Bulk_MOMClean for SCOM
'
' AUTHOR: Bryce Kinnamon (aka Script Money)
' DATE  : 04/24/2008
'
' COMMENTS: Create "C:\Servers.txt" file with the servers you want to clean (one server per line)
'          Get the Resouce Kit from MS (http://www.microsoft.com/downloads/details.aspx?familyid=14FF7073-C71B-4AD0-805A-A8E458D2C9E0&displaylang=en)
'          Copy CleanMOM.exe tool from the resource kit "C:\"
'          Create "C:\MOMClean.bat" and copy these lines into the file:
'     c:\SCOM_Cleanup\cleanMOM.exe /cleanagents
'
'     rd c:\SCOM_Cleanup /s /q
'
'     del /q c:\MOMClean.bat
'
'!!!!!!!!!You will still need to delete the gray inactive agents from the SCOM console, under administration/Agent Managed
'
'*****Obviously you will need an account with the appropriate permissions to run this script.      
'==========================================================================

On Error Resume Next

'''Set File System Objects
Set objFSO = CreateObject("Scripting.FileSystemObject")
Set objTextFile = objFSO.OpenTextFile ("c:\servers.txt", 1, True)
objFSO.CreateTextFile "c:\Success.txt"
Set objtextFile2 = objFSO.OpenTextFile ("c:\Success.txt", 8, False)

''''Start the Loop
Do Until objTextFile.AtEndOfStream
    strComputer = objTextFile.ReadLine
    If isAlive(strComputer) Then 
    strDestination = "\\" & strComputer & "\c$\SCOM_Cleanup\"
   
   ''''If the folder already exists than get it
    If ObjFSO.FolderExists(strDestination)= False Then      
      Set objFolder = objFSO.CreateFolder(strDestination)      
    Set objFolder = objFSO.GetFolder(strDestination)
  Else
      Set objFolder = objFSO.GetFolder(strDestination)
  End If
  
 ''''Copy WMIDiag.vbs file
 objFSO.copyfile "C:\cleanMOM.exe", strDestination, True
 objFSO.copyfile "C:\MOMClean.bat", "\\" & strComputer & "\c$\", True
 
 
 '''' Connect to WMI
 set objWMIService = getobject("winmgmts://" & strComputer & "/root/cimv2")
 strExe = "c:\MOMClean.bat"
 
 '''' Obtain the Win32_Process class of object.
 Set objProcess = objWMIService.Get("Win32_Process")
  Set objProgram = objProcess.Methods_("Create").InParameters.SpawnInstance_
  objProgram.CommandLine = strExe 
 
 'Write succesfully pinged computers to C:\Success.txt
 
 objTextFile2.WriteLine(strComputer) 
  
 'Execute the program now at the command line on the remote computer.
  Set strShell = objWMIService.ExecMethod( _
  "Win32_Process", "Create", objProgram)

End If
Loop

objTextFile.Close
objTextFile2.Close
Set objFSO=Nothing
Set objTextFile=Nothing
Set objtextFile2=Nothing
Set objFolder=Nothing
Set objWMIService=Nothing
Set objProcess=Nothing
Set objProgram=Nothing
Set strShell=Nothing

 

MsgBox("MOM Bulk Clean has completed.  Please check 'c:\Success.txt' to see the list of servers the script ran on.  Also make sure to delete the gray inactive agents from the Operations Console under 'Administration\Agent Managed'.")

WScript.Quit

Function IsAlive(strHost)
'---------- Test to see if host or url alive through ping -----------------
' Returns True if Host responds to ping
'
' Though there are other ways to ping a computer, Win2K,
' XP and different versions of PING return different error
' codes. So the only reliable way to see if the ping
' was sucessful is to read the output of the ping
' command and look for "TTL="
'
' strHost is a hostname or IP
    Const OpenAsASCII = 0
     Const FailIfNotExist = 0
     Const ForReading =  1
     Dim objShell, objFSO, sTempFile, fFile
    Set objShell = CreateObject("WScript.Shell")
     Set objFSO = CreateObject("Scripting.FileSystemObject")
    sTempFile = objFSO.GetSpecialFolder(2).ShortPath & "\" & objFSO.GetTempName
    objShell.Run "%comspec% /c ping.exe -n 2 -w 500 " & strHost & ">" & sTempFile, 0 , True
    Set fFile = objFSO.OpenTextFile(sTempFile, ForReading, FailIfNotExist, OpenAsASCII)
    x=fFile.ReadAll
    Select Case InStr(x, "TTL=")
         Case 0
            IsAlive = False
         Case Else
            IsAlive = True
    End Select
  
    fFile.Close
     objFSO.DeleteFile(sTempFile)
    Set objFSO = Nothing
    Set objShell = Nothing
End Function



 

 

 

June 20

SQL Reporting - Separate Event Parameters into columns

***The Query below can be copied into query analyzer and run without any changes against your SystemCenterReporting DB.*** 
 
SELECT     SUBSTRING(Message, PATINDEX('%Member Name:%', Message) + 12, PATINDEX('%Member ID:%', Message) - PATINDEX('%Member Name:%',Message) - 12) AS MName, SUBSTRING(Message, PATINDEX('%Member ID:%', Message) + 11, PATINDEX('%Target Account Name:%', Message) - PATINDEX('%Member ID:%', Message) - 11) AS MemberID, SUBSTRING(Message, PATINDEX('%Target Account Name:%', Message) + 20,PATINDEX('%Target Domain:%', Message) - PATINDEX('%Target Account Name:%', Message) - 20) AS TAName, SUBSTRING(Message,PATINDEX('%Target Domain:%', Message) + 14, PATINDEX('%Target Account ID:%', Message) - PATINDEX('%Target Domain:%', Message) - 14) AS TDomain, NTEventID, UserName AS Admin, TimeGenerated
 
FROM         SDKEventView
 
WHERE       (NTEventID IN (636, 632, 660, 650, 655, 665)) and (SUBSTRING(Message, PATINDEX('%Target Account Name:%', Message) + 20,PATINDEX('%Target Domain:%', Message) - PATINDEX('%Target Account Name:%', Message) - 20) LIKE '%admin%') 
 
ORDER BY   TimeGenerated
 

If you audit your event logs for admin group add's or any audit events for that matter then the above code will surely help you with your reporting.  What I found annoying about developing reports for audit events was the description field is all blocked together in the Message column of your SDKEventView in SystemCenterReporting.  This makes reporting messy to read as there is plenty of information that you absolutely do not require in the report IMHO.  The above code will parse out all the data from the 'Message' column that I find to be unnecessary, and it will break out the remaining parameter information into separate fields in your report thus allowing a great deal more versatility in filtering the data once it's been pulled from the view. 
 
The code is easy to edit if you choose to add or remove parameters.  It's using a basic PATINDEX function from sql to define the starting position and length of the strings.  Lets use the description for Audit event 632 in this example.  Each line is a parameter in the description for this event. 
 
 Security Enabled Global Group Member Added:
  Member Name: -
  Member ID: %{S-I-D-SI-DSIDSIDSID-SIDSIDSIDS-IDSIDSIDS-IDSID}
  Target Account Name: None
  Target Domain: YOUDOMAIN OR LOCAL MACHINE
  Target Account ID: GroupName
  Caller User Name: UserName
  Caller Domain: Domain
  Caller Logon ID: (0x0,0x00000)
  Privileges: -
 
 
The basic logic is this, if u want to break out Parameter 2 'Member Name:' in your SQL Report then you'll have to use this line of code in your Select Statement to do that:

SUBSTRING(Message, PATINDEX('%Member Name:%', Message) + 12, PATINDEX('%Member ID:%', Message) - PATINDEX('%Member Name:%',Message) - 12) AS MName

In this example, lets say "Member Name:" begins in position 51 (and lets call that A).  And lets say "Member ID:" starts in 91 (and lets call that B).  Then the PatIndex would need to use params substring (Message,(A,B-A)). See why that works? B=91 A=51 then the LENGTH of the literal string is 40.  So the string would start at position 51 and then go out another 40 positions only.  You can apply this logic with any of the the above Parameters. 
 
If you have any questions about how to build a Event Report from scratch in Visual Studio, here is a great link for it. 
 
 
Any questions, feel free to post here. 
 
Regards,
Bryce
February 26

Custom DNS Clear Cache script for MOM

Create rule to schedule your C:\dnscmd.exe /clearcache on your DNS servers
 
1.You should create a timed event provider to set interval times that you would like to flush the DNS cache on your DNS servers.
2.You'll need to add the script to your scripts folder in the admin console. 
3.Make sure you create your custom event rule in the custom rule group that has the respective computer groups associated that contain your DNS servers or just use the builtin DNS rule groups from the DNS MP that are bound to the builtin DNS servers groups from the MP.
3.Keep in mind, this rule runs on the Agent, not the Management server so make sure you create the rule to run on the Agent.   
 
If you have any question about the custom script creation process you can reference some of the notes from this article:
 
Link to MOM resource how to section:
 
Right click the 'Implementing Custom Scripts' and save the PDF to your computer.
 
 
Here is your script:
 
'==========================================================================================================
'
' VBScript Source File -- Created with SAPIEN Technologies PrimalScript 3.1
'
' NAME: DNS Clear Cache Script (dnscmd.exe /clearcache)
'
' AUTHOR: Bryce Kinnamon - Social Security Administration (assisted by Phil Gibson - Intellinet)
' DATE  : 2/1/2007
'
' Parameters: You must make sure the DNSCMD.exe tool is located on C:\ on the respective DNS Servers
'          (or whatever respective location)  **note--I had problems if the path had spaces in it anywhere**
'          When you create the script in MOM the run location is Agent Computer!!
'==========================================================================================================
'On Error Resume Next
Dim objAlert
Set WshShell = CreateObject("WScript.Shell")
WshShell.Run ("C:\dnscmd.exe /clearcache")
 
If err.number <> 0 Then
    
                Set objAlert = ScriptContext.CreateAlert()
                objAlert.Name = "Clear DNS Cache"
                objAlert.AlertLevel = 50 'Critical Error
                objAlert.Description = "Unsuccessfully cleared DNS Cache. Error number = " & Err.number & ". Error Description = " & Err.description
                ScriptContext.Submit objAlert    
      
Else              
                Set objAlert = ScriptContext.CreateAlert()
                objAlert.Name = "Clear DNS Cache"
                objAlert.AlertLevel = 10 'Success
                objAlert.Description = "Successfully cleared DNS Cache."
                ScriptContext.Submit objAlert
    
End If
Set objAlert = nothing

Recover from MOM OnePoint DB Reindex job failures

 

The T-SQL command that executes for the default OnePoint Reindex job on SQL SP3a should look something like this:
 
EXECUTE master.dbo.xp_sqlmaint '-PlanName OnePointReindex -RebldIdx 100 -WriteHistory'
 
While this should work it's possible that your SQL Agent Job to reindex the MOM OnePoint might fail anyway.  This is  known issue with Microsoft that can happen with SQL SP3a.  The only resolution I could find forced me to update my SQL SP to SP4.  Once I updated my SQL to SP4 I had to add a few switches to the execute command line for the job.  This is what my command line looked like when I was done:
 
EXECUTE master.dbo.xp_sqlmaint N'-S <MYSERVER> -PlanID 8BFC9580-EFAC-4001-B3DF-692AE9D20DD6 -WriteHistory -RebldIdx 100 -SupportComputedColumn'
 
This resolved the issue I was having with my Reindex issue.  For more complete details, refer to this knowledge base article. 
 
 
Any questions feel free to hit me up directly.