OpsMgr Group Health Rollup Configuration Task Management Pack

Introduction

In OpsMgr, groups are frequently used when designing service level monitoring and dashboards. The group members’ health rollup behaviours can be configured by creating various dependency monitors targeting against the group.

When creating groups, only instance groups can be created within the OpsMgr console. Unlike computer groups, instance groups do not inherit any dependent monitors from their base class. Therefore when an instance group is created in the OpsMgr console, by default, the health state of the group is “Not monitored” (Uninitialized):

SNAGHTML6ecbad9

In order to configure group members to rollup health state to the group object (so the group can be used in dashboards), one or more dependency monitors must be created manually after the group has been created. This manual process can be time consuming.

Squared Up has recognised this issue, and many of their customers have also asked for a way to simplify the process of configuring health roll-up for the groups (so the groups can be used in Squared Up dashboards).

Squared Up has engaged me and asked me to develop an agent task to configure group health rollup and make it available to the broader OpsMgr community.

The “OpsMgr group health Rollup Configuration Task Management Pack” provides an agent task to create dependency monitors for the selected groups using OpsMgr SDK.

image

Management Pack Overview

In order for the OpsMgr operators to easily navigate to the groups, this management pack provides a state view for all groups (System.Group class):

image

Although a set of required parameters are pre-configured for the agent task, the operators can also modify these parameters using overrides.

The following parameters can be customized via overrides:

image

  • Health Rollup Policy Possible values: ‘BestOf’, ‘WorstOf’,’Percentage’.
  • Worst state of the percentage in healthy state Integer between 1 and 100. Only used when Algorithm is set to ‘Percentage’.
  • Member Unavailable Rollup As Possible Values: ‘Uninitialized’, ‘Success ‘, ‘Warning’ and ‘Error’
  • Member in Maintenance Mode Rollup As ‘Uninitialized’, ‘Success’, ‘Warning’ and ‘Error’
  • Management Pack Name The Management Pack name of which the monitors going to be saved. Only used when the group is defined in a sealed MP.’
  • Increase Management Pack version by 0.0.0.1 Specify if the management pack version should be increased by 0.0.0.1.

NOTE: Please DO NOT select multiple instance groups at once.

After the task is executed against a group, 4 dependency monitors are created:

  • Availability Dependency Monitor
  • Configuration Dependency Monitor
  • Performance Dependency Monitor
  • Security Dependency Monitor

SNAGHTML7326e1c

image

image

Security Consideration

Natively in OpsMgr, only user accounts assigned either authors role or administrators role have access to create monitors. However, users with lower privileges (such as operators and advanced operators) can potentially execute this task and create dependency monitors.

Please keep this in mind when deploying this management pack. You may need to scope user roles accordingly to only allow appropriate users have access to this task.

Credit

Thanks Squared Up for making this management pack free to the community.

Download

This management pack can be downloaded from the link below:

20 comments

  1. Thank you so much for this! What is the risk of doing multiple groups at once? Is it something that can be tweaked in the task in a later version? it would be helpful to be able to do this in batches for scenarios where I have dozens of dynamic groups created and I want to add dependencies all at once.

      1. Thanks for the reply. We don’t have a SMA deployment and that’s a heavy lift for one task that doesn’t come up too frequently. I’m guessing the script in this MP will fail to run and/or cause undesired behavior if we select multiple groups at once? Or is this simply a precaution against poor performance due to heavy MP editing churn?

        1. You don’t need a SMA to run this PowerShell workflow runbook. you can easily modify it a little bit, specify individual parameters instead of using a SMA connection object, then run it manually in PowerShell or PowerShell ISE. the script in the MP is pretty similar to this PowerShell workflow. If you run the OM task on multiple groups at once, multiple threads will try to write to a single MP at once, although I’ve never tested it, I’m guessing it won’t work. plus each thread will open a SDK connection, which can cause performance issues in your management group. so it’s better to leverage this existing runbook, make changes, and process the groups one at a time sequentially.

          1. Thanks dear for this MP
            i have some problems the result after execute is:_
            ———————————————————————-
            Configure Health Rollup
            Task Description

            Status:Success
            Scheduled Time:1/9/2017 9:10:10 AM
            Start Time:1/9/2017 9:10:10 AM
            Submitted By:********************
            Run As:
            Run Location:
            Target:
            Target Type:Group
            Category:Operations
            Health Rollup Policy – Possible values: ‘BestOf’,’WorstOf’,’Percentage’. Worst state of the percentage in healthy state – Integer between 1 and 100. Only used when Algorithm is set to ‘Percentage’. Member Unavailable Rollup As – Possible Values: ‘Uninitialized’,’Success ‘,’Warning’,’Error’ Member in Maintenance Mode Rollup As – ‘Uninitialized’,’Success ‘,’Warning’,’Error’ Management Pack Name – The Management Pack name of which the monitors going to be saved. only used when the group is defined in a sealed MP.’ Increase Management Pack version by 0.0.0.1 – Specify if the management pack version should be increased by 0.0.0.1. NOTE: Please DO NOT select multiple instance groups at once.

            Task Output:

            Connecting to Management Group via HQ-*********-P01…
            Group Instance Monitoring Object Id: ‘{fc2e672f-8c6f-6514-15bd-011ac4750974}’.
            Algorithm: ‘WorstOf’.
            Getting the group class ‘Microsoft.SQLServer.InstanceGroup’.
            Check if ‘Microsoft.SQLServer.InstanceGroup’ is a group.
            Group Type: ‘SystemGroup’
            The group ‘Microsoft.SQLServer.InstanceGroup’ is defined in a sealed MP. Getting the desintation MP ”.
            Script_5cc7a754168e406aa559c7e76e1427a7 : Unable to find the management pack
            ” in the management group. Unable to continue.
            + CategoryInfo : NotSpecified: (:) [Write-Error], WriteErrorExcep
            tion
            + FullyQualifiedErrorId : Microsoft.PowerShell.Commands.WriteErrorExceptio
            n,Script_5cc7a754168e406aa559c7e76e1427a7

            False

  2. Hi Tao,
    This is a great MP and many thanks to you for this.
    I have some groups in SCOM, which being created/reference in a sealed MP. when i try to run the task from this MP, i’m getting the below error, let me know if there is any fix for this.

    Connecting to Management Group via …
    Group Instance Monitoring Object Id: ‘{21cddda8-688a-3617-a74d-f9d8e16f0f1a}’.
    Algorithm: ‘WorstOf’.
    Getting the group class ‘GroupPopulation.FRM’.
    Check if ‘GroupPopulation.FRM’ is a group.
    Group Type: ‘SystemGroup’
    The group ‘GroupPopulation.FRM’ is defined in a sealed MP. Getting the desintation MP ”.
    Script_b861161150bc49c88df7746aa8f483a6 : Unable to find the management pack
    ” in the management group. Unable to continue.
    + CategoryInfo : NotSpecified: (:) [Write-Error], WriteErrorExcep
    tion
    + FullyQualifiedErrorId : Microsoft.PowerShell.Commands.WriteErrorExceptio
    n,Script_b861161150bc49c88df7746aa8f483a6
    False

        1. I’m afraid you cannot use sealed MPs to store the monitors in this case because SDKs can’t directly write to sealed MPs. Can you email me your MP containing the groups and I’ll try to figure out what’s the issue?

  3. Hey Tao,

    Getting the following error (server names and mp names altered) when running the task but only on some groups. Works perfect on others! Groups with errors have on occasions more than one error but they all follow the pattern below. Any ideas?

    Connecting to Management Group via SCOM MANAGEMENT SERVER NAME…
    Group Instance Monitoring Object Id: ‘{d9e9a750-c18a-8792-d2c8-8ad1e3b3a07e}’.
    Algorithm: ‘WorstOf’.
    Getting the group class ‘UINameSpace3893168460d14461b4cad63190792442.Group’.
    Check if ‘UINameSpace3893168460d14461b4cad63190792442.Group’ is a group.
    Group Type: ‘InstanceGroup’
    The group ‘UINameSpace3893168460d14461b4cad63190792442.Group’ is defined in an unsealed MP ‘MANGEMENT PACK NAME’. the dependency monitors will be stored in the same MP.
    The dependency monitors will be created in management pack ‘MANAGEMENT PACK NAME’.
    Determining depdency monitor names.
    Getting parent monitors.
    Getting relationship type.
    Creating Availability Dependency monitor ‘UINameSpace3893168460d14461b4cad63190792442.Group.Availability.Dependency.Monitor’.
    Creating Configuration Dependency monitor ‘UINameSpace3893168460d14461b4cad63190792442.Group.Configuration.Dependency.Monitor’.
    Creating Performance Dependency monitor ‘UINameSpace3893168460d14461b4cad63190792442.Group.Performance.Dependency.Monitor’.
    Creating Security Dependency monitor ‘UINameSpace3893168460d14461b4cad63190792442.Group.Security.Dependency.Monitor’.
    Script_07b2eac170314dcc8cc711957f4e7dd3 : : Verification failed with 43 errors:
    ——————————————————-
    Error 1:
    Found error in 2|MANAGEMENT PACK NAME|1.0.0.1|MANAGEMENT PACK NAME|| with message:
    Detected malicious verification code when verifying element of type
    Microsoft.EnterpriseManagement.Configuration.ManagementPackImageReference with
    inner exception:
    Microsoft.EnterpriseManagement.Common.ObjectNotFoundException: An object of
    class ManagementPackElement with ID 3970b185-6773-a0e9-5ee8-061966cc6c7e was
    not found.
    at Microsoft.EnterpriseManagement.Configuration.ManagementPackElementReferen
    ce1.FetchElement(IManagementPackSearch searcher)
    at Microsoft.EnterpriseManagement.Configuration.ManagementPackElementReferen
    ce
    1.GetElement()
    at Microsoft.EnterpriseManagement.Configuration.ManagementPackElementInfo.Ve
    rify(VerificationContext context)
    at Microsoft.EnterpriseManagement.Configuration.ManagementPackImageReference
    .Verify(VerificationContext context)
    at Microsoft.EnterpriseManagement.Configuration.Verification.VerificationEng
    ine.VerifyCollectionItems(Object context)

  4. I had the same errors, I removed the mp where the groups were stored, reimported them and the errors were gone!

  5. Hello, great piece of script but I have an error after running it – “Rule/Monitor “UINameSpaceaa12fefee13e43c8acbe8cb47a897b1c.Group.Availability.Dependency.Monitor” running for instance “TestGroup” with id:”{14DCBA4B-91F9-1CAB-A43E-B74C73A20100}” cannot be initialized and will not be loaded. Management group “MGT” – obviously there are 4 events like that. I have tried running the script manually and I can see it runs without any error (PowerShell errors) and everything is created in the MP, but the monitors do not initialise.

  6. So here’s a challenge for this… I’d like to have health rollups that are a little more intelligent.
    Say I’ve got a group of 4 webservers where I know without a shadow of a doubt that I can tolerate losing 2 of those 4 without the service dramatically degrading. In that case I have 2 critical servers but I’d like the health to say warning not flip straight to critical and not just sit there at healthy, this gives an indication that the service is degraded but still operational.
    If say a third server goes red then the rollup goes to red even though there is still one healthy server.
    I seem to be asking for a more customisable health rollup where threshold can be set for both warning and critical states with some defined logic. Rather than the current best of, worst of and percentages that from an operational point of view could be misleading to a support desk representative who may be making assumptions about a seemingly critical service that isn’t truly critical.

    1. Hello Rob,

      Unless Tao has worked a miracle again, this probably can’t be done. SCOM has no algorithm to calculate a state. It selects a monitor based on the rollup algorithm (best state, worst state and so on) and then copies the state of that monitor to the rollup.

  7. I made a group, view members shows all of its member i expect to see in it. When I enable a dependency monitor on this group it goes Red. Looking in the properties of the monitor dependency, I think the problem lies in Object (Contains Entities) / Entity Health / Availability being empty.

    I can’t figure out why this not working.

  8. Hi Tao,

    I’m experiencing some troubles after the health rollup has been defined. The group contains several critical objects, however the healthstate of the group gets reset to healthy every few minutes, I can’t seem to understand why this is happening, it should be critical all the time.
    This same behavior is occurring on several groups I’m using,
    I’m using version 1.0.0.0 of the management pack.

    Best regards,
    Bert

Leave a Reply

%d bloggers like this: