O R G A N I C / F E R T I L I Z E R: 06.09

Jun 25, 2009

monitoring group changes with opsmgr

this is relatively simple to do, but i wanted to post it here in case you need to do this yourself.  after you get the alert rule set up, we’ll diverge into using notification channel command to handle the emails.  why?  it’s easier in my case.

the first thing we need to do is create an appropriate rule to pick up the events.  there are so many sources of information on how to do this that i’ll just provide a link to them.  here you go: http://tinyurl.com/kv9ddg.  shout out to “stefan the stranger” for showing me that site.

here are some things to note.

  • some sources indicate using event description.  if you can get away from doing this, for performance reasons, it’s recommended.
  • parameter 3 holds the group name if you want to do a group name comparison.
  • if you’re searching for multiple events, use a regex statement.
  • if you want to capture the parameter value, you’ll need to push it into a custom field.

here’s the statement i’m using for my criteria:

( ( Event ID Matches regular expression ^(631|632|633|634|635|636|637|638|650|651|655|656|660|661|665|666)$ ) AND ( Parameter 3 Matches wildcard myGroup* ) )

in the last bullet above, i mentioned pushing the parameter to a custom field.  simply change the alert for the responses.  the custom alert field (in my case 1) should contain this string:

$Data/Params/Param[3]$

at this point, you should be picking up the alerts.  if not, keep trying.  :)

 

i was challenged with either having to create multiple notification subscriptions or using a script to handle the notifications.  i chose the latter.  however, either can be managed fairly well.  if you choose to create notification subscriptions, you may want to view this post.

in order to make a script work, we’ll need to create a command channel.  here are the properties you should include:

  • full path
c:\windows\system32\cmd.exe (or whatever is appropriate for you)
  • command line parameters
/c cscript.exe c:\scripts\scom_groupmonitor.vbs "$Data/Context/DataItem/Custom1$" "$Data/Context/DataItem/TimeRaisedLocal$" "$Data/Context/DataItem/AlertDescription$" "$Data/Context/DataItem/AlertName$"
  • startup folder
c:\scripts (or wherever your script is)
image

as you can see, we’re pushing different fields as arguments into the script.  i can’t figure out how to use the values directly from the script, so why not?  anders details this pretty well on his blog.

after that, create your subscriber and your subscription which should be tied to the alert rule you created above.  now, i didn’t detail the contents of the script yet because we had to get through the minutia.  it’s really pretty simple.  the work happens in the select case statement so we’ll go over that part.

Select Case LCase(Left(sGroup,8))    <-- modify this to match the case
Case "myGroup1"
EmailMe "mygroup1@mydomain.com"
Case "myGroup2"
EmailMe "mygroup2@mydomain.com" <-- if there's a match, email
WriteMe "mygroup2@mydomain.com" <-- or log to a file
Case "myGroup3"
EmailMe "mygroup3@mydomain.com"
Case "myGroup4"
EmailMe "mygroup4@mydomain.com"
Case "myGroup5"
EmailMe "mygroup5@mydomain.com"
Case Else
EmailMe "allmygroups@mydomain.com"
End Select

that’s pretty much it.  i marked it with <—.  the top portion of the select case is what you’d modify to match your group name.  in my example, i want to match the first 8 characters.  if my group was myGroup2200, it would match myGroup2.  hope that makes sense.  you’ll notice there’s a “writeme” sub called too.  this is because i had to make sure the thing was working.  long story.

next, modify the sub below for your mail environment.

Sub EmailMe(sRecipient)
Set oMessage = CreateObject("CDO.Message")
oMessage.Subject = sGroup & " - Group Changed" <-- your subject
oMessage.From = "myMOM@mydomain.com" <-- your sender
oMessage.To = sRecipient
oMessage.TextBody = sMessageBody

oMessage.Configuration.Fields.Item("http://schemas.microsoft.com/cdo/configuration/sendusing") = 2
oMessage.Configuration.Fields.Item("http://schemas.microsoft.com/cdo/configuration/smtpserver") = "smtp.mydomain.com" <-- your mail server
oMessage.Configuration.Fields.Item("http://schemas.microsoft.com/cdo/configuration/smtpserverport") = 25
oMessage.Configuration.Fields.Update

oMessage.Send
End Sub

that’s it.  i condensed the list, but my environment has about 30 different cases to build from.  this is why i thought scripting would be the easier approach.  hope you find it useful.  the full script is below.

 

 

'==========================================================================
' NAME: scom_groupmonitor.vbs
' AUTHOR: Marcus Oh
' DATE: 6/23/2009
' COMMENT: Emails SG admins when group changes are detected.
'==========================================================================

' Alert Name - $Data/Context/DataItem/AlertName$
' CustomField1 - $Data/Context/DataItem/Custom1$
' Local Time Raised - $Data/Context/DataItem/TimeRaisedLocal$
' Description - $Data/Context/DataItem/AlertDescription$

sGroup = Wscript.Arguments.Item(0)
sTime = WScript.Arguments.Item(1)
sEventDesc = WScript.Arguments.Item(2)
sAlertName = WScript.Arguments.Item(3)


' Redeem the value of our soul by massaging the description to be legible
myTempString = Split(sEventDesc,"\n \n")
For Each line In myTempString
myNewStuff = myNewStuff & VbCrLf & line
Next
sEventDesc = myNewStuff


sMessageBody = "Time: " & sTime & VbCrLf &_
sAlertName & VbCrLf &_
VbCrLf & sEventDesc

Select Case LCase(Left(sGroup,5))
Case "mygroup1"
EmailMe "mygroup1@mydomain.com"
Case "mygroup2"
EmailMe "mygroup2@mydomain.com"
WriteMe "mygroup2@mydomain.com"
Case "mygroup3"
EmailMe "mygroup3@mydomain.com"
Case "mygroup4"
EmailMe "mygroup4@mydomain.com"
Case "mygroup5"
EmailMe "mygroup5@mydomain.com"
Case Else
EmailMe "allmygroups@mydomain.com"
End Select

Sub EmailMe(sRecipient)
Set oMessage = CreateObject("CDO.Message")
oMessage.Subject = sGroup & " - Group Changed"
oMessage.From = "myMOM@mydomain.com"
oMessage.To = sRecipient
oMessage.TextBody = sMessageBody

oMessage.Configuration.Fields.Item("http://schemas.microsoft.com/cdo/configuration/sendusing") = 2
oMessage.Configuration.Fields.Item("http://schemas.microsoft.com/cdo/configuration/smtpserver") = "smtp.mydomain.com"
oMessage.Configuration.Fields.Item("http://schemas.microsoft.com/cdo/configuration/smtpserverport") = 25
oMessage.Configuration.Fields.Update

oMessage.Send
End Sub

Sub WriteMe(sRecipient)
Dim oFSO, oLogFile

Set oFSO = CreateObject("Scripting.FileSystemObject")
Set oLogFile = oFSO.OpenTextFile("GroupMonitor.log", 8, True)

oLogFile.WriteLine(vbcrlf & sRecipient & " : " & sGroup & VbCrLf & sMessageBody)
oLogFile.Close
End Sub

Jun 24, 2009

configmgr console crashes with “the given key was not present in the dictionary"

Frustration

Image by bdgamer via Flickr

one of our site servers seemed to exhibit this puzzling problem.  i stumbled upon this because the site server’s reporting page would not come up correctly.  i also noticed that when i tried to fire a report from the console, it was trying to go to http://myServer:0/smsreporting_xyz.  i knew that couldn’t be right because the port was usually set to 80 or some other value.

i tried to get into the reporting components and received an error.  i thought it was related to the local console at first.  i tried it under my credentials, other credentials, on the server, on my workstation, from the local site server, and from the central site server – which all failed nicely.

as a last resort, i used what little i learned in school and actually read the failure message.  if you’ve been reading my blog awhile, then you’re probably well aware that i got nothing out of this message. :)

image

you won’t be able to read the stack trace in the screenshot, but I’ve copied the contents and dropped it in below.  the important value to capture is right at the top “The given key was not present in the dictionary”.

Server stack trace: 
at System.ThrowHelper.ThrowKeyNotFoundException()
at System.Collections.Generic.Dictionary`2.get_Item(TKey key)
at Microsoft.ConfigurationManagement.AdminConsole.SiteSystems.ReportingPointControl.InitializePageControl()
at Microsoft.ConfigurationManagement.AdminConsole.SmsPropertyPage.OnInitialize()
at Microsoft.ManagementConsole.SnapInBase.ProcessNotification(Notification notification)
at System.Runtime.Remoting.Messaging.StackBuilderSink._PrivateProcessMessage(IntPtr md, Object[] args, Object server, Int32 methodPtr, Boolean fExecuteInContext, Object[]& outArgs)
at System.Runtime.Remoting.Messaging.StackBuilderSink.SyncProcessMessage(IMessage msg, Int32 methodPtr, Boolean fExecuteInContext)

Exception rethrown at [0]:
at System.Runtime.Remoting.Proxies.RealProxy.HandleReturnMessage(IMessage reqMsg, IMessage retMsg)
at System.Runtime.Remoting.Proxies.RealProxy.PrivateInvoke(MessageData& msgData, Int32 type)
at Microsoft.ManagementConsole.Internal.IMessageClient.ProcessNotification(Notification notification)
at Microsoft.ManagementConsole.Executive.SnapInNotificationOperation.ProcessNotification()
at Microsoft.ManagementConsole.Executive.Operation.OnThreadTransfer(SimpleOperationCallback callback)

alright, so i knew the condition that was causing this.  every time i tried to view the reporting component options, the mmc would crash.  i could reproduce this on every machine available for this particular site server.  at this point, you may want to stop reading.  (if you’re my microsoft support rep, you can stop reading, too.)  i had to hack the dreaded site control file (sitectrl.ct0).  it’s pretty cryptic so you’re not exactly supposed to know what you’re doing – hence the statement that you jeopardize support if you do this type of operation.

i’m making it sound more complicated than it was.  i compared the control files from the broken site and a working site.

bad:

BEGIN_SYSTEM_RESOURCE_USE
RESOURCE<Windows NT Server><["Display=\\myServer\"]MSWNET:["SMS_SITE=XYZ"]\\myServer\>
ROLE<SMS Reporting Point>
PROPERTY <ReportingPointFolder><><SMSReporting_XYZ><0>
PROPERTY <Server Remote Name><myServer.myDomain.com><><0>
PROPERTY <Server Remote Public Name><><><0>
BEGIN_PROPERTY_LIST
<Objects Polled By Site Status>
<["
Display=\\myServer\x$\SMS\"]MSWNET:["SMS_SITE=XYZ"]\\myServer\x$\SMS\>
END_PROPERTY_LIST
END_SYSTEM_RESOURCE_USE

good:

BEGIN_SYSTEM_RESOURCE_USE
RESOURCE<Windows NT Server><["Display=\\myServer\"]MSWNET:["SMS_SITE=XYZ"]\\myServer\>
ROLE<SMS Reporting Point>
PROPERTY <ReportingPointFolder><><SMSReporting_XYZ><0>
PROPERTY <Protocol><><><0>
PROPERTY <PortNumber><><><80>
PROPERTY <Server Remote Name><myServer.myDomain.com><><0>
PROPERTY <Server Remote Public Name><><><0>
BEGIN_PROPERTY_LIST
<Objects Polled By Site Status>
<["
Display=\\myServer\x$\SMS\"]MSWNET:["SMS_SITE=XYZ"]\\myServer\x$\SMS\>
END_PROPERTY_LIST
END_SYSTEM_RESOURCE_USE

now that we know what we’re working with, here’s what i did:

  1. copy the sitectrl.ct0 file to sitectrl.mco
  2. edit the contents of sitectrl.mco to match the good site (just the tags marked “PROPERTY” were different)
  3. stopped the sms executive
  4. renamed the sitectrl.ct0 to sitectrl.bak
  5. dropped in sitectrl.mco as sitectrl.ct0
  6. fired up sms executive

after that, i restarted the console and tested the reporting component properties.  worked fine.  i tested the reporting page.  that worked, too!

Jun 19, 2009

using powershell to create notification subscriptions for alerts

i must need a refresher on sharpening up my google skillz.  it appears not everyone has adopted the use of “opsmgr” as a short form for system center operations manager 2007.  some prefer just “scom” or “scom 2007”.  anyway, good lesson learned since i tried to find something like this for over a day.

stefan koell of code4ward.net (creators of royal ts) wrote up this very handy powershell script to expose what the ui or the system center shell does not.  anyway, there’s little value in repeating the subject in which stefan elaborates quite well.  here’s his blog post on this subject and the powershell script.

Jun 17, 2009

atlanta southeast management user group - 6/26/2009

we're holding our 2nd meeting of the year. it's only been ... what six months? we did mms kind of interrupt the usual quarterly schedule. :) anyway, we've got a great line up with some very timely and relevant information. hope you can join us!

click here for the agenda details.
click here to register for the event!

dell is sponsoring our lunches so please be sure to register so we can get an accurate headcount.

Jun 12, 2009

retrieving dell warranty data via powershell

first of all, i have to give mad props to mow. he’s crazy good with powershell and deserves massive amounts of respect for his knowledge. i managed to piece together this script from his script on gathering statistical data from the social security website. it was a lot like having 10 of the same pair of everything in different colors and getting dressed in the dark. (no slight to the way you dress, scott. :o)

the concept is pretty straight-forward. dell actually (believe it or not) has a URL that you can append a serial to and retrieve warranty data! through the use of such a novel, sophisticated system, we can employ the html scraping method in powershell to retrieve some data.

for my own edification, we will walk through the script. i’m well aware you know all this.

to begin with, we retrieve the serial # from the command prompt. if it doesn’t exist, we’ll simply quit.

$sSerial = ""

if ($Args[0] -eq $Null) {
  Write-Warning "Please provide a serial number."
  exit
} else {
  $sSerial = $Args[0]
}

moving on, we connect to the dell site and scrape the html source into a variable.

$oWeb = New-Object System.Net.WebClient
$sUrl = "http://support.dell.com/support/topics/global.aspx/support/my_systems_info/details?c=us&l=en&s=gen&~ck=anavml&servicetag=$($sSerial)"
$sData = $oWeb.DownloadString($sUrl)
next, we use a variety of methods to split apart, break up, and seek out the information that we want (since i simply suck at doing good pattern matching, regular expressions, or any other fanciful methods for chunking the data into appropriate bite-size morsels).  NOTE: updated to work with warranty information that’s returned with italics.  i’m certain this fix won’t last long.
$sData = $sData | ForEach-Object { $_ -replace "<i>", "" }
$sData = $sData | ForEach-Object { $_.Split("<") }
$sData = $sData | Select-String "contract"
$sData = $sData | ForEach-Object { $_ -replace $_,"$_`n" }

that last line was because powershell displays things differently than it holds them, it seems. i had to force line breaks in so that my regex statements would match line by line. that’s exactly what we do below. afterwards, we push it back into the variable with just the required values.
$oRegEx = [regex]'"contract_.*row">(.*)'
$cMatches = $oRegEx.Matches($sData)
$cMatches = $cMatches | ForEach-Object { $_.Groups[1].value }
the for loop below uses a method that i found on mow’s site. i have no idea about $foreach.current and $foreach.movenext(). awesome stuff. because of formatting restrictions (should be interpreted as my lack of skill) i’m skipping the first value which is always blank. for the last value, if it’s blank, we’ll insert 0 for the number of days left. otherwise, we insert the value.
$cMyData = @()
foreach ($i in 0..($cMatches.count -1)) {
  $cRecord = New-Object -TypeName system.Object
  [void] $foreach.MoveNext()
  $cRecord | Add-Member -MemberType noteProperty -Name 'Provider' $cMatches[$foreach.current]
  [void] $foreach.MoveNext()
  $cRecord | Add-Member -MemberType noteProperty -Name 'Start Date' $cMatches[$foreach.current]
  [void] $foreach.MoveNext()
  $cRecord | Add-Member -MemberType noteProperty -Name 'End Date' $cMatches[$foreach.current]
  [void] $foreach.MoveNext()
  if ($cMatches[$foreach.current] -ne "") {
      $cRecord | Add-Member -MemberType noteProperty -Name 'Days Left' $cMatches[$foreach.current]
  } else {
      $cRecord | Add-Member -MemberType noteProperty -Name 'Days Left' "0"
  }  
  $cMyData += $cRecord
}

here’s how it looks when you execute it.

.\get-dellwarranty.ps1 ABC123D | ft –AutoSize

Provider Start Date End Date Days Left -------- ---------- -------- --------- QLX 4/24/2008 4/24/2010 316 DELL 4/25/2007 4/24/2010 316

and finally, here’s the completed script.

$sSerial = ""

if ($Args[0] -eq $Null) {
Write-Warning "Please provide a serial number."
exit
} else {
$sSerial = $Args[0]
}

$oWeb = New-Object System.Net.WebClient
$sUrl = "http://support.dell.com/support/topics/global.aspx/support/my_systems_info/details?c=us&l=en&s=gen&~ck=anavml&servicetag=$($sSerial)"
$sData = $oWeb.DownloadString($sUrl)

$sData = $sData | ForEach-Object { $_ -replace "<i>", "" }
$sData = $sData | ForEach-Object { $_.Split("<") }
$sData = $sData | Select-String "contract"
$sData = $sData | ForEach-Object { $_ -replace $_,"$_`n" }

$oRegEx = [regex]'"contract_.*row">(.*)'
$cMatches = $oRegEx.Matches($sData)
$cMatches = $cMatches | ForEach-Object { $_.Groups[1].value }

$cMyData = @()
foreach ($i in 0..($cMatches.count -1)) {
$cRecord = New-Object -TypeName system.Object
[void] $foreach.MoveNext()
$cRecord | Add-Member -MemberType noteProperty -Name 'Provider' $cMatches[$foreach.current]
[void] $foreach.MoveNext()
$cRecord | Add-Member -MemberType noteProperty -Name 'Start Date' $cMatches[$foreach.current]
[void] $foreach.MoveNext()
$cRecord | Add-Member -MemberType noteProperty -Name 'End Date' $cMatches[$foreach.current]
[void] $foreach.MoveNext()
if ($cMatches[$foreach.current] -ne "") {
$cRecord | Add-Member -MemberType noteProperty -Name 'Days Left' $cMatches[$foreach.current]
} else {
$cRecord |
Add-Member -MemberType noteProperty -Name 'Days Left' "0"
}
$cMyData += $cRecord
}

$cMyData

Jun 11, 2009

issue with conditional forwarding

when working with windows dns, it appears that non-recursive queries do not return conditional forwarders.  it’s tragic in a split-brain situation!  let’s take this scenario for example.

i query against my name server for kitchen.home.marcusoh.com.  My name server has a delegation for home.marcusoh.com to another pair of DNS servers.  These servers are for forwarding only and have two conditional forwarders – one that points back to dnsServersA that hold the zone for marcusoh.com and another that points to home.marcusoh.com on dnsServersC.

dnsServersA (marcusoh.com) dnsServersB (forwarding) dnsServersC (home.marcusoh.com)

zone – marcusoh.com

delegated domain – home

forwarder – home.marcusoh.com

forwarder - marcusoh.com

zone – home.marcusoh.com

record – kitchen.home.marcusoh.com

forwarder – marcusoh.com

 

(everything above is all internal.  there’s a marcusoh.com which is also publicly available – hence split-brain.)

if i query dnsServersC directly for the kitchen.home.marcusoh.com record, i get a successful response.

if i query dnsServersB directly for the kitchen.home.marcusoh.com record, i get a successful response.

if i query dnsServersA directly for the kitchen.home.marcusoh.com record, i get a rcode - “server failure”.

although, the trace indicates that dnsServersA queries dnsServersB successfully, the resulting rcode indicates that something failed.  on closer examination, it appears that the packet from B to A does not include any records for kitchen.home.marcusoh.com.  it simply responds with a set of name servers, which are external.

i don’t have access to the name servers noted as dnsServersB or C.  i guess this will be a “to be continued” story until i get more information.