Each Management Pack guide states if the agent proxying setting is a requirement, so it is best practice to check for this, prior to importing a management pack.

The following management packs (and additional ones not listed here) require the respective servers to have the agent proxying setting enabled:

– Physical nodes of clusters

– Domain Controllers

– Exchange Servers

– SQL Servers

– BizTalk Servers

– DNS Servers

The agent proxying tool can be extremely useful for enabling the proxying setting on multiple agents:

http://blogs.msdn.com/b/boris_yanushpolsky/archive/2007/08/02/enabling-proxying-for-agents.aspx

Queue Size

The default size of the Queue on agents is 15360kb (15MB) and the default size of the Q on an MS is 102400KB (100MB)

The size of the queue (in kb) can be configured at this registry key on both agents and management servers:

HKLM\SYSTEM\CurrentControlSet\Services\HealthService\Parameters\Management Groups\[MGname]\MaximumQueueSizeKb

Renaming Default Management Pack to ‘DO NOT USE – Default Management Pack’

A golden rule of Operations Manager is not to store anything in the Default Management Pack. When creating overrides or new rules and monitors, the default management pack appears as the first option.

Therefore it is a recommended good practice to change the display name of ‘Default Management Pack’ to ‘DO NOT USE – Default Management Pack’ which adds an extra safeguard, making it less likely for users to store elements in the default management pack.

Reporting Overview

Steps for running reports can be found in the 101 document I created – http://blogs.technet.com/b/kevinholman/archive/2010/09/02/operations-manager-101-download.aspx

Run as accounts and Run as profiles

A Run as Account is a set of credentials (username and password) that is stored in Operations Manager and distributed to agents for use.

A Run as Profile is a collection of Monitoring – for instance AD Replication Monitoring.

A Run as profile can be associated with a run as profile, so that all the monitoring that is part of that profile, runs under the associated run as account.

By default, local system (default agent action account) is used for all local monitoring on an agent, unless any of that monitoring is part of a run as profile that has a run as account specified.

If monitoring that is part of a run as profile is actively running on an agent, and no run as account has been specified, the default action account (local system by default) is reverted to for use.

The steps for managing Run as accounts and profiles are as follows:

1) Create a run as Account by specifying the credentials.

2) Distribute the run as accounts to agents that will be using it. (In the Runs As account, use the ‘Distribution’ tab)

3) Associate the appropriate run As Profile with the newly specified run as account.

SCCM Dashboard for Operations Manager:

https://www.scom2k7.com/how-to-create-a-custom-scom-dashboard-to-show-key-management-group-information/

SCOM Tricks

http://www.bictt.com/blogs/bictt.php

Security Auditing Events

The following links list Security Event Details for Events that occur when a given Security Scenario occurs. This is useful for creating Security auditing style event-collection or alert-generating rules (or both):

http://technet.microsoft.com/en-us/library/cc737542(WS.10).aspx

http://technet.microsoft.com/en-us/library/dd772663(WS.10).aspx

http://technet.microsoft.com/en-us/library/dd772693(WS.10).aspx

Server Overview Report

http://blogs.technet.com/momteam/archive/2009/09/25/some-sample-reports.aspx

This is a report that I see many customer’s getting a lot of use out of. Just download the samplereportslibrary.xml and import it like a normal management pack. Once the Sample Reports folder comes up and you see Server overview report, run it against the Agent Managed Computer Group, and change the ‘From’ parameter from ‘Today’ to ‘Yesterday’.

Subscriptions

It is important to note the difference between ‘Alerts’ and ‘Notifications’. Alerts are seen in the console. Notifications are items such as emails that users receive outside of the Operations console. Notifications are created based upon the configured subscriptions that map alerts to notifications. Very granular subscriptions can be created using the ‘Created by Specific Rules or Monitors’ options. These subscriptions can be created or added to, using the ‘Create’ and ‘Modify’ Subscription tasks that are available on the Actions Pane in the right-hand side of the console, when clicking on any alert in the monitoring space.

There is also an advantage of creating a ‘catch-all’ subscription (criteria = all alerts) and having those notifications go to a mailbox for that specific purpose (service account mailbox for example) . And then the mailbox can be reviewed for identifying alerts that are good candidates to add to the more important granular subscriptions with wider audiences.

Subscription Channel Format

The subject format can be modified by moving $Data/Context/DataItem/ResolutionStateName$ to the front of the subject line and getting rid of the words ‘Resolution State’ like so:

With this change, notification emails will appear as New Alert: Alert Name or Closed Alert: Alert Name.

A great list of available variables is available here:

http://blogs.technet.com/b/kevinholman/archive/2007/12/12/adding-custom-information-to-alert-descriptions-and-notifications.aspx

Support for System Center Operations Manager 2007 R2 that runs on a SQL Server 2008 R2 database

http://support.microsoft.com/kb/2425714

Synthetic Transactions

A Synthetic Transaction is monitoring from the client perspective. For example, web sites are monitored using the IIS Management Pack and although a website shows as healthy from the IIS perspective, a client may not be able to get to it, due to a network issue. This is where synthetic transactions can be used. As part of creating Synthetic transaction monitors, it is possible to specify one or more watcher nodes, which is where the synthetic transaction is ran from.

Wizards are provided (Authoring>Management Pack templates) for creating Synthetic transaction monitors for

OLE DB Data Source
TCP Ports
Web applications

Targeting Best Practices

In Operations Manager, we should not use groups for the purposes of targeting. Instead, we should always target rules and monitors at a singular object. For instance ‘All Windows Computers’ (which is a group) is not a valid target to use when creating a rule or monitor that you wish to become active on all Windows Computers. However the singular object ‘Windows Computer’ is an appropriate object that could be used in this scenario. The best-practice poster for targeting can be found here:

http://download.microsoft.com/download/f/a/7/fa73e146-ab8a-4002-9311-bfe69a570d28/BestPractices_Rule_Monitor_REV_110607.pdf

Troubleshooting gray agent states in System Center Operations Manager 2007 and System Center Essentials

http://support.microsoft.com/kb/2288515

Troubleshooting ‘Script or Executable Failed’ Alerts or ‘WMI Probe Execution Failed’ Alerts

These alerts occur as a result of a script or executable in a different workflow (rule, monitor or object discovery) failing.

It can be difficult to ascertain from this alert which rule, monitor or discovery’s script or executable caused the alert.

In order to find this out, take the workflow name from the alert details. For instance:

Workflow name: Microsoft.SQLServer.2005.ReportingServicesDiscoveryRule.Server

Then Open SQL Management Studio and click the connect button.

Hit the “New Query” button at the top left then just underneath that, change the dropdown where it says “master” to “OperationsManager”.

Then in the query window on the right hand side (where you should see a flashing cursor) type:

select * from localizedtext where elementname like ‘%workflowname%’

In the example provided, use:

select * from localizedtext where elementname like ‘%2005.reportingservicesdiscoveryrule.server%’

(note the % is a wildcard for any characters before or after the string. Also note the localized text table is just a place where we store display names that you see in the console.)

Then click the !Execute button or press F5 to execute the query.

In most cases, this returns 2 results.

One is the workflow name and one is the workflow’s description.

Scroll across to view the LTValue which will contain the ‘friendly name’ of the discovery name and description.

Once we have the LTValue for the discovery / rule / monitor name, we need to search for it in the console.

In the ops manager console, go to authoring>Management Pack Objects>Object Discoveries. (note – it can be a trial and error process to discover whether the workflow is a monitor, rule or an object discovery – in this case it is an object discovery. If it is a monitor or rule, you will need to click monitors or rules and search in those nodes)

Make sure the view is not scoped and in the look for box, type the friendly name of the rule, monitor or discovery and hit search.

The monitoring object will be returned and can be overridden to increase the timeout.

After overriding it, resolve the alert and then see if it reoccurs.

If there is still a problem after increasing the timeout, it may be necessary to investigate other reasons why that particular workflow may be failing, but knowing which monitor, rule or discovery is the root cause helps in this troubleshooting process.

Unix / Linux Agent Deployment

High-Level Steps for Deployment:

http://technet.microsoft.com/en-us/library/dd788943.aspx

Manual Installation required on Unix Server

http://technet.microsoft.com/en-us/library/dd789016.aspx

Manually Sign and deploy Certificate, then Discover Server in Operations Manager

http://technet.microsoft.com/en-us/library/dd788989.aspx

If you don’t have SSH enabled, you will need to manually sign the certificates (used for communication) and also manually install the agents as per the steps in the links above.

Unix Privileged Account vs. Unix Action Account and root-level access context

http://blogs.msdn.com/b/scxplat/archive/2010/01/12/more-on-unix-privileged-account-vs-unix-action-account-and-root-level-access-context.aspx

User Roles

User roles can be used to control security for operators, authors and administrators.

There are three levels of operator:

Read-only Operator – can only read data in the console
Operator – can set alerts to new, closed or other resolution states
Advanced Operator – can override to configure /enable or disable rules and monitors.

Consider creating additional User Roles to further open up the specific areas of the console, to those who need it.

Which hotfixes should I apply

http://blogs.technet.com/b/kevinholman/archive/2009/01/27/which-hotfixes-should-i-apply.aspx

Technet homepage:

http://technet.microsoft.com/en-us/systemcenter/om/default.aspx

Product documentation

http://technet.microsoft.com/en-us/systemcenter/om/bb498235.aspx

Security Guide (includes how to change account passwords)

http://download.microsoft.com/download/B/F/D/BFDD0F66-1637-4EA3-8E6E-8D03001E5E66/OM2007R2_SecurityGuide.docx

Supported Configurations

http://technet.microsoft.com/en-us/library/bb309428.aspx

Hotfixes – Which hotfixes should I apply

http://blogs.technet.com/b/kevinholman/archive/2009/01/27/which-hotfixes-should-i-apply.aspx

Admin Resource Kit

http://www.microsoft.com/downloads/en/details.aspx?FamilyID=e37ab90b-ec7b-4130-8e3f-9691a76530db

Authoring Resource Kit

http://www.microsoft.com/downloads/en/details.aspx?FamilyID=9104af8b-ff87-45a1-81cd-b73e6f6b51f0&displaylang=en

CU4 Service Restart issue:

http://support.microsoft.com/default.aspx?scid=kb;EN-US;2526113

SCCM Dashboard – Using for Operations Manager:

https://www.scom2k7.com/how-to-create-a-custom-scom-dashboard-to-show-key-management-group-information/

Powershell Cheat sheet

http://blogs.msdn.com/b/powershell/archive/2007/01/24/powershell-cheat-sheet.aspx

Regular Expressions

http://www.zytrax.com/tech/web/regex.htm#experiment

Unseal a Management Pack:

http://blogs.msdn.com/b/boris_yanushpolsky/archive/2007/08/16/unsealing-a-management-pack.aspx

Introducing the Next Version of Operations Manager (GREAT VIDEO TO WATCH TO SEE WHAT’S COMING J)

http://www.msteched.com/2010/Europe/MGT205

Visio Stencils for Operations Manager 2007 R2

http://myitforum.com/cs2/files/folders/utilities/entry112734.aspx

R2 sizing guide

http://www.microsoft.com/downloads/en/details.aspx?displaylang=en&FamilyID=b0e059e9-9f19-47b9-8b01-e864aebf210c

DW Retention and grooming:

http://blogs.technet.com/b/kevinholman/archive/2010/01/05/understanding-and-modifying-data-warehouse-retention-and-grooming.aspx

DW retention tool

http://blogs.technet.com/b/momteam/archive/2008/05/14/data-warehouse-data-retention-policy-dwdatarp-exe.aspx

Useful Queries

http://blogs.technet.com/b/kevinholman/archive/2007/10/18/useful-operations-manager-2007-sql-queries.aspx

Boris Yanushpolsy’s blog (wrote effective config viewer, Mp viewer and Override Explorer, and the Proxy UI tool)

http://blogs.msdn.com/b/boris_yanushpolsky/

System Center Marketplace (New MP Catalog):

http://systemcenter.pinpoint.microsoft.com/en-US/Default.aspx

Publishing Reports to SharePoint

http://blogs.technet.com/b/momteam/archive/2008/02/29/publish-reports-to-sharepoint.aspx

MOF Reliability Workbook for System Center Operations Manager:

http://go.microsoft.com/fwlink/?LinkId=181535

Webcasts

https://msevents.microsoft.com/CUI/AdvancedSearch.aspx?culture=en-US#culture=en-US;advanced=true;sortKey=;sortOrder=;pageEvent=false;startDate=5/13/2010;endDate=8/11/2010;kwdAny=;countryId=US;languageCode=en;products=24;eventType=0;searchcontrol=yes;s=1

Microsoft Download Notifications (New MPs / Updates):

http://www.microsoft.com/downloads/en/DownloadNotifications.aspx

Webcasts and Virtual Labs:

http://technet.microsoft.com/en-us/systemcenter/om/bb499676.aspx

Override Explorer (was used in more prominently in the previous SP1 version, which did not have the ‘overrides’ node available in the authoring Space):

http://blogs.msdn.com/boris_yanushpolsky/archive/2007/08/09/override-explorer-v3-3.aspx

Logfile Monitoring

http://blogs.technet.com/timhe/archive/2007/09/11/howto-create-a-generic-text-log-alert-in-scom-2007-or-sce.aspx

Adding Custom Information to alerts and Notifications:

http://blogs.technet.com/kevinholman/archive/2007/12/12/adding-custom-information-to-alert-descriptions-and-notifications.aspx

Some great resources on R2 and the new features available on the right hand side of this page:

http://www.microsoft.com/systemcenter/operationsmanager/en/us/default.aspx

(There is also a great video there that walks through the new features of R2.)

ACS for Cross Platform Agents

http://blogs.msdn.com/scxplat/archive/2009/12/17/cross-platform-audit-collection-services-released.aspx

Estimating Database Sizes

http://ops-mgr.spaces.live.com/blog/cns!3D3B8489FCAA9B51!171.entry