Stuart's profileStuart Renes: The BlogPhotosBlogListsMore  |  Tools Help |
|
|
January 22 MOM 2005 SP1 agent access to Vista/W2K8 Security logs *HOTFIX*Finally we have a hotfix and associated article that addresses this issue (for details, see previous blog entries below). Here's a synopsis and a link to the complete article (961099):
SYMPTOMSAssume that you have an application that uses Microsoft Windows NT event log APIs. However, on a computer that is running Windows Vista or Windows Server 2008, the application cannot read the description of an event log message.
For example, in a network environment, you run Microsoft Operations Manager (MOM) 2005. When the MOM agent is running on a client that is running Windows Vista or Windows Server 2008, the MOM agent cannot read the descriptions of the events in the Windows NT event log. For example, the MOM agent cannot read the following messages. Example 1 Type: Audit Success Example 2
Time: Time Domain: Domain Computer: Computer Description: Unable to find Security source Microsoft-Windows-Security-Auditing message … Source: Microsoft-Windows-Security-Auditing Category: Event Number: Event Number User: N/A Event Id: Event ID Provider Type: Event Log Provider Name: Security Source Domain: Domain Source Computer: Domain Consolidated: False Raises Alert: False Type: Audit Success Time: Time In these examples, the Description section is not displayed correctly.Domain: Domain Computer: Computer Description: Unable to find Security source Microsoft-Windows-Eventlog message 1102 [1102] SID Computer Domain Logon ID Source: Microsoft-Windows-Eventlog Category: Event Number: 1102 User: N/A Event Id: 9afd9646-3599-4da6-a065-5fe0bd51bb6d Provider Type: Event Log Provider Name: Security Source Domain: Domain Source Computer: Computer Consolidated: False Raises Alert: False Note When the MOM agent runs under the Network Service Account, you must grant the Read permission to the following registry entry on the client computer to make sure that MOM agent has permission to read the registry key for the Security log: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Eventlog\Security However, even if you grant the Read permission to the MOM agent for the entry, the description is not displayed correctly.
CAUSEThis issue occurs because in Windows Vista and in Windows Server 2008, the Adtschema.dll component does not have a string table that maps an event ID to the corresponding message description. Therefore, the legacy API cannot format the event description.
RESOLUTIONA hotfix is available to resolve this issue. Install this hotfix on the computer that is running Windows Vista or Windows Server 2008. January 14 Microsoft Windows Time Services Management PackHaving recently suffered through some serious time services issues on our Windows Server 2003 AD forest and getting no help from MOM, I decided to write a Time Services management pack. MOM 2005 provides limited Time Services alerting through the AD MP (and only for Domain Controllers). If you have time critical applications on your forest member servers, you'll want to have some Time Services monitoring to see if they're getting accurate time! If System Center Operations Manager 2007 doesn't have any better support, you might want to grab this MP and convert it for use in SCOM. Attached below you'll find a link to the custom management pack:
Microsoft Windows Time Services Management Pack
December 19 MOM 2005 SP1 agent access to Vista/W2K8 Security logs *UPDATE*This is an update to my original blog entry on February 29th (yes, it's been THAT long ago). It appears that Microsoft may be finally fixing the problem for at least Windows Server 2008. This will allow legacy management tools such as MOM and Tivoli to read the W2K8 security log files. A hotfix is being developed and barring any last minute problems, should be released soon (my words, not theirs). The fix will basically expose a backward-compatible security event log provider for Windows Server 2008. Stay tuned to this space for further details! November 10 Problems with Windows Server 2008 Base OS Management Pack for MOM 2005 SP1 *UPDATED - November 10, 2008*I've updated my original post (see October archive) to include one replacement script that fixes one of the two reported problems with the Windows Server 2008 Base OS Management Pack for MOM 2005. October 02 Problems with Windows Server 2008 Base OS Management Pack for MOM 2005 SP1 *UPDATED - November 10, 2008*
I've found two issues with the current (05.0.5000.0000) release of this management pack (MP). A case to Microsoft CSS has been opened. The first problem occurs when the MP calls the Win32_LogicalMemoryConfiguration class. The alert “A management pack script was unable to complete successfully” is generated based on the MP script result of “The class returned no valid instances”. The Win32_LogicalMemoryConfiguration topic on MSDN (http://msdn.microsoft.com/en-us/library/aa394181(VS.85).aspx) says: The Win32_LogicalMemoryConfiguration WMI class represents the layout and availability of memory on a computer system running Windows. Beginning with Windows Vista, this class is no longer available in the operating system. Windows XP and Windows Server 2003: This class is no longer supported. Use the Win32_OperatingSystem class instead. Windows 2000: This class is available and supported. This issue has been filed as a bug and CSS will be providing an alternate script that uses Win32_OperatingSystem instead of Win32_LogicalMemoryConfiguration. This will be a temporary workaround until the bug can be fixed in the MP. Another problem concerning the Win32_ShadowCopy class has surfaced and is currently under review by CSS. The alert “A management pack script was unable to complete successfully” is generated based on the MP script result of “The class returned no valid instances”. This only happens on x64 Windows Server 2008 platforms. Here is the replacement script that fixes the Win32_LogicalMemoryConfiguration error. Simply copy and paste the contents of the attached script over the script named Microsoft Windows Server 2008 Operating System Discovery.
I'll update this space with additional replacement MP scripts as the case progresses. September 24 MOM 2005 BlackBerry Enterprise Server (BES) Management Pack
PurposeBES Version 4.1.4 introduced a new type of BES, BlackBerry Enterprise Server for Applications. This provides a secure wireless gateway for BlackBerry devices without requiring the device owner to possess an email account. This custom Management Pack provides basic monitoring of BlackBerry Enterprise Server, version 4.x. FeaturesThe following product roles are monitored by this management pack: 1) BlackBerry Enterprise Server services 2) BlackBerry Enterprise Server application events 3) BlackBerry Enterprise Server performance counter thresholds. ConfigurationBy default, alerts for Critical Errors and above are sent to the membership of the BlackBerry Enterprise Administrators notification group. All BlackBerry Enterprise Server performance threshold rules are disabled by default. If you enable any/all of these, you will need to provide Red/Yellow threshold alerting criteria for each. This Management Pack is bound the to members of the BlackBerry Enterprise Servers computer group. Membership in that group is limited to all managed agent computers who have Version 4.x of the product installed (added by computer attribute discovery). *IMPORTANT* - When you import this Management Pack into your MOM instance don't forget to change any existing email addresses in the notification group that comes with the MP! The MP can be downloaded by clicking here: MOM 2005 BES Management Pack August 21 Deploying MOM 2005 agents on Windows Server 2008 Domain ControllersHere's a tip to help you avoid the pitfall of the AD MP scripts not working after agent deployment on Windows Server 2008 DC's. Turns out that you may need to use LocalSystem as the Agent Action account for all of this to work properly. I had been using a Domain Administrator account as my Agent Action account for years until Server 2008 came along. Until I switched my x64-based W2K8 DC's to a LocalSystem agent action account, the agents couldn't create their MOM Latency containers and most of the AD-based script tests would fail with "Access Denied" errors. Here's some background on this account. It exists on every Windows computer -- whether it is a client workstation, domain controller or server and it has total control over the computer and cannot be locked out or denied any privilege. The characteristics of this account include:
On a domain controller, the LocalSystem account has full access to Active Directory because a replica exists on the local computer's file system and is, therefore, considered a local resource. I haven't yet figured out what has changed in Server 2008 to require the use of this all too powerful account as an agent action account but when I do I'll post details here. August 11 .NET 2.0 causes MOM 2005 Computer Discovery ProblemsIf you're planning on managing any Windows Server 2008 machines with MOM 2005, you'll no doubt want to apply the following new MOM 2005 SP1 hotfix: The MOM service does not start and event 9014 is logged when you deploy a Microsoft Operations Manager 2005 agent to a domain controller that is running Windows Server 2008 http://support.microsoft.com/default.aspx/kb/919154 You'll note that the deployment of this hotfix on your MOM DAS server requires .NET 2.0 as a prerequisite! Not good. This is where the problem occurs because adding .NET 2.0 to a MOM 2005 DAS server causes MOM 2005 computer discovery to break. Never fear, this was fixed earlier this year by a little known hotfix: After you install version 2.0 of the .NET Framework on a server that is running Microsoft Operations Manager 2005 with SP1, you can no longer discover computers in Active Directory June 13 Do you know where your Service Principle Names are?If you've running MOM 2005 or SCOM 2007 and you've ever changed the service account used by the SQL backend server you most likely have a duplicate Service Principal Name on the old service account object. You can find this event on a Domain controller in the System event log. The event may look something like this:
Log Name: System
Source: Microsoft-Windows-Kerberos-Key-Distribution-Center Date: 6/13/2008 1:49:57 PM Event ID: 11 Task Category: None Level: Error Keywords: Classic User: N/A Computer: server.child.domain.com Description: The KDC encountered duplicate names while processing a Kerberos authentication request. The duplicate name is MSSQLSvc/MOMDB.child.domain.com:1433 (of type DS_SERVICE_PRINCIPAL_NAME). This may result in authentication failures or downgrades to NTLM. In order to prevent this from occuring remove the duplicate entries for MSSQLSvc/MOMDB.child.domain.com:1433 in Active Directory. If you see any of these events you can use the following two AD-related tools to verify and remove the duplicate SPN: setspn and ADSIedit.
Run setspn on a DC using the following syntax: setspn -X
This will search for and list all duplicate SPNs. In the output you should look for an entry like this:
MSSQLSvc/momdb.child.domain.com:1433 is registered on these accounts:
CN=newsvcacct,OU=Service Accounts,DC=child,DC=domain,DC=com CN=oldsvcacct,OU=Service Accounts,DC=child,DC=domain,DC=com If you see a duplicate SPN listed, use the ADSIedit tool to remove it from the older (not currently in use) SQL service account. Proceed with caution here! If you're not comfortable making AD configuration changes (or don't have the required AD rights), you'll want to ask your AD administrator for assistance.
May 12 SCOM console Vista crash hotfix availableSystem Center Operations Manager 2007 console may crash in Windows Server 2008 or in Windows Vista when you open the Health Explorer windowSYMPTOMSConsider the following scenario:
In this scenario, the System Center Operations Manager 2007 console may crash. Therefore, you cannot use Health Explorer to see any monitored objects in Windows Server 2008 or in Windows Vista.
CAUSEThe issue is caused by the tooltip module. This module does not correctly check the NULL condition. Therefore, the console crashes if it receives a NULL pointer.
SNMP Event Log extension fix for W2K8Those of you running HP Systems Insight Manager 5.1 against Windows Server 2008 should take a look at this recently-released hotfix to fix SNMP extension agent processing:The SNMP Event Log Extension Agent does not initialize correctly on a computer that is running Windows Vista with Service Pack 1 or Windows Server 2008
SYMPTOMS The Simple Network Management Protocol (SNMP) Event Log Extension Agent does not initialize correctly on a computer that is running Windows Vista with Service Pack 1 (SP1) or Windows Server 2008. Therefore, network management middleware cannot use SNMP to retrieve event log information.
April 21 System Center Operations Manager Tools (Updated on June 19, 2008)
Here are some useful tools that you might want to check out when working with System Center Operations Manager 2007:
Updated HP BladeSystem Management Pack (v1.6.2)Updated HP BladeSystem Management Pack, version 1.6.2 is now availableDownload the updated HP BladeSystem Management Pack, version 1.6.2 here. Version 1.6.2 addresses the following: Bug Fixes: Fixed the HP BladeSystem Enclosure Monitor Manager to support the regional and language settings on Windows Operating System. Fixed the HP BladeSystem Management Pack for Alert Parameter Replacement Failure on Operations Manager 2007 SP1. April 01 Bug in new RSAT tools for Vista SP1RSAT and ADUC: Getting the Terminal Services Tabs to Appear in AD Users and Computers
If those acronyms don't mean anything to you, you can skip the rest of this post. Otherwise, please take a look at the blog entry from Net Pyle of the Directory Services Team regarding a bug (and a fix!) in the new RSAT tools for Vista SP1:
March 13 HP Management Pack updates for Operations Manager 2007HP BladeSystem Management Pack Version 1.6 for Operations Manager 2007
Version Information
Download HP BladeSystem Management Pack for Operations Manager 2007 here.
HP ProLiant Server Management Pack Version 1.1 for Operations Manager 2007
Version Information February 29 MOM 2005 SP1 agent access to Vista / W2K8 Security logs (UPDATED: June 27th)Here’s some information that I've recently discovered trying to get a MOM 2005 SP1 agent to read the Security logs on Vista/Windows Server 2008 clients:
I've opened a case with Microsoft CSS and I'll post updates as this issue unfolds.
*UPDATE*
It appears that Microsoft will be releasing at least one hotfix to address this and other issues that will allow MOM 2005 and System Center Operations Manager 2007 to manage and be hosted on Windows Server 2008. The support for this was scheduled to be announced the last week of June but has now been delayed until the end of July.
-Stuart February 26 MOM 2005 Task Scheduler Management PackWhen Microsoft introduced the new Task Scheduler interface in an early version of Internet Explorer, most folks immediately began using it and stopped using the older AT-style task scheduling mechanism. Unfortulately to this day, none of Microsoft's operating systems have WMI-provider support for the new stype Task Scheduler which makes it difficult to write any form of management interface.
Luckily, Microsoft did provide a utility (schtasks.exe) that allowed you to manage the scheduler. The output of this tool can be parsed by a script as part of a MOM management pack. As luck would have it, the output of schtasks.exe tool is different between client and server Os's and isn't present on Windows 2000 so the MP below is for Windows Server 2003 only.
The MP and associated report can be downloaded by clicking on the following Icons:
MOM 2005 Notification Workflow Management PackIf you've got a lot of folks managing servers with MOM 2005, you've probably already stumbled into Microsoft's Notification Workflow Solution Accelerator. It's a great add-on for MOM 2005 that provides very customizable and granular alert notifications.
Like any other product, it needs a management pack so you can monitor it's health. Here's my own Notification Workflow MP:
MOM 2005 Internet Authentication Service Management PackHere's another home-made management pack. This one's for IAS. While it's an often used product, Microsoft never wrote a management pack for it. So I did.
Unfortunately, IAS doesn't put a lot of useful stuff in the event logs. But it does have lots of performance counters!
You can download the MP by clicking on the Icon below:
MOM 2005 AntiVirus Management PacksOver the last two years I've written several management packs to help monitor several popular Antivirus packages used on Windows servers (and clients) in the corporate world.
Here are Management packs for two such products from Computer Associates and McAfee.
You can download the MP's by clicking on the Icons below:
|
|
|
