This is probably going to be a bit too long for one single blog post. I’ll separate this topic into 2 articles:
- Part 1 includes the background and overview of the rule and it’s workflow
- Part 2 documents all the steps to create all the module types and the rule itself.
This article is the first part of the 2-part series.
Recently, I’ve been writing a SCOM management pack for a new application that my employer is implementing. This application logs any application related alarms into a SQL express database. One of the requirement for the MP is to catch these alarms from the database and generate alerts based on these alarms.
In the database, I’m interested in any records that has the value of “Alarm triggered” in “EventTypeCaption” column.
The the record is added to the database, the application also adds the time stamp in UTC to the “EventDate” field.
Below is a snapshot of a subset of the database. I’ve highlighted the records that I’m interested in:
To achieve this goal, I’ve written some custom modules and created a rule using these modules.
As usual, the rule contains 3 modules:
- Data Source
- Condition Detection
Below is the flow chat for the entire workflow:
To explain the workflow in details:
- The workflow takes 3 inputs:
- IntervalSeconds – how frequent does the rule run
- SQLInstance – Name of the SQL instance
- Database – Name of the database
- The data source member module system.simple.scheduler runs according to the intervalseconds
- The Probe Action member module (a PowerShell script) takes all 3 inputs:
- connect to the database in the SQL instance as specified from the input
- calculate the earliest time (current time minus intervalseconds from the input then convert to UTC). store the earliest time in a datetime variable $starttime
- Build the SQL query: “Select * from <table name> Where EventTypeCaption LIKE ‘Alarm triggered’ AND EventDate >= ‘$StartTime’”
- Execute the SQL query.
- If returned any data:
- Property Bag value “GenerateAlert” = True
- For each record, convert the EventDate from UTC time to local time.
- combine all records from the record set to a multi line string that include converted event date and event description. return this string as Property Bag value “LogEntry”
- return Property Bag Value “LogEntryCount”
- Condition Detection module detects Property Bag value “GenerateAlert” = True
- If passed Condition Detection Module, the Write Action module generates alert with LogEntry and LogEntryCount in alert description field.
Note: I’m using PowerShellPropertyTriggerOnlyProbe rather than VBscript because I found it’s easier to convert UTC and local time back and forth as I can simply use .NET class System.TimeZoneInfo and powershell datetime object ToUTC() method to do the conversion. if we are to use VBScript, there is no equivalent trigger only probe for VBScript. I’ll try to cover this in a separate blog post.
I’ll go through how to create each module types and the rule itself in part 2 of this series.
To be continued…
- Subscribe via RSS
- June 2013 (2)
- May 2013 (2)
- April 2013 (5)
- March 2013 (7)
- February 2013 (1)
- January 2013 (3)
- December 2012 (2)
- November 2012 (2)
- October 2012 (4)
- September 2012 (4)
- August 2012 (6)
- July 2012 (1)
- June 2012 (1)
- May 2012 (4)
- April 2012 (4)
- March 2012 (4)
- February 2012 (5)
- January 2012 (9)
- December 2011 (1)
- November 2011 (1)
- October 2011 (5)
- September 2011 (1)
- August 2011 (4)
- July 2011 (2)
- June 2011 (3)
- May 2011 (7)
- April 2011 (2)
- March 2011 (1)
- February 2011 (2)
- January 2011 (3)
- November 2010 (3)
- September 2010 (3)
- August 2010 (3)
- July 2010 (9)
- June 2010 (3)
Tags70-400 Alerts Console Crash Daylight Saving Email Notifications Emails Exams Exchange 2007 Exchange 2010 Failover Management Servers Featured Hardware Inventory Health Check Hyper-V Inventory Management Pack MOM Morning Check MP Authoring NTFS Permission Others Powershell Powershell Remoting Primary Management Server remote execution policy SCCM SCCM 2012 SCCM Reports SCOM SCOM agent assignments SCOM Management Pack SCOM Migration SCOM Notifications SCOM Reporting SCVMM Secondary Site SMTP SQL Stopping MOM Agents TMG URL Encoding VBScript Web Console Windows Windows Scheduled Tasks
- OpsMgr: Self Maintenance Management Pack - Operations Manager - SCOM on OpsMgr Self Maintenance Management Pack
- Vinz on ENHANCED SCOM Alerts Notification Emails!
- Steve on PowerShell Script To Enable SCOM Agent Proxy in a More Efficient Way
- Tao Yang on OpsMgr Self Maintenance Management Pack
- Jamie on OpsMgr Self Maintenance Management Pack