Professional Documents
Culture Documents
Operations
Manager 2005
Operations Guide
Monitor
Author: Dan Wesley
Program Manager: Tom Keane
Published: December 2004
Applies To: Microsoft Operations Manager 2005
Document Version: Release 1.0
The information contained in this document represents the current view of Microsoft Corporation
on the issues discussed as of the date of publication. Because Microsoft must respond to
changing market conditions, it should not be interpreted to be a commitment on the part of
Microsoft, and Microsoft cannot guarantee the accuracy of any information presented after the
date of publication.
This White Paper is for informational purposes only. MICROSOFT MAKES NO WARRANTIES,
EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS DOCUMENT.
Complying with all applicable copyright laws is the responsibility of the user. Without limiting
the rights under copyright, no part of this document may be reproduced, stored in or introduced
into a retrieval system, or transmitted in any form or by any means (electronic, mechanical,
photocopying, recording, or otherwise), or for any purpose, without the express written
permission of Microsoft Corporation.
Microsoft may have patents, patent applications, trademarks, copyrights, or other intellectual
property rights covering subject matter in this document. Except as expressly provided in any
written license agreement from Microsoft, the furnishing of this document does not give you any
license to these patents, trademarks, copyrights, or other intellectual property.
Unless otherwise noted, the example companies, organizations, products, domain names, e-mail
addresses, logos, people, places, and events depicted herein are fictitious, and no association
with any real company, organization, product, domain name, e-mail address, logo, person, place,
or event is intended or should be inferred.
2004 Microsoft Corporation. All rights reserved.
Microsoft, MS-DOS, Windows, Windows NT, Windows Server, Active Directory, ActiveSync, and
Windows Mobile are either registered trademarks or trademarks of Microsoft Corporation in the
United States and/or other countries.
The names of actual companies and products mentioned herein may be the trademarks of their
respective owners.
Acknowledgments
Primary Reviewers: James R. Morey, Tom Keane, Doug Bradley, James Hedrick, Ian
Jirka
Managing Editor: Sandra Faucett
Did you find this information useful? Please send your suggestions and comments about
the documentation to momdocs@microsoft.com.
Looking for more MOM information? Experience the power of customer communities!
MOM Community
Monitor
C H A P T E R 3
This chapter describes the monitoring functionality of Microsoft® Operations Manager
(MOM) 2005, and provides detailed information about monitoring specific MOM components to
ensure that MOM is operating correctly.
The chapter also provides information about using the Operator console, which is a new feature
in MOM 2005. Although the chapter’s scope is MOM 2005, many of the best practices,
recommendations, and tips can be used to monitor various applications in an IT environment,
such as domain controllers, Microsoft® SQL Server™, and Exchange Server.
In This Chapter
• Introduction
• Before You Begin
• Monitoring Overview
• The MOM Management Pack
• Configure the Monitoring Environment
• Work with Alerts
• Monitoring MOM
• Using Tracing and Log Files
• Additional Resources
Introduction
The following best practices are recommended to help you support MOM:
Did you find this information useful? Please send your suggestions and comments about
the documentation to momdocs@microsoft.com.
Looking for more MOM information? Experience the power of customer communities!
MOM Community
6 Chapter 3 Monitor
• Use the knowledge base. Encourage employees to enter their knowledge about resolving a
problem into the knowledge base, so that this knowledge is available for everyone, and is not
lost if the employee moves on.
• Enforce a policy that all resolved incidents in the ticketed system are transferred back to a
resolved resolution state in MOM by either the subject matter expert or the help desk.
• Document all processing rule changes, including newly added rules, previous and modified
threshold values, and modified or added scripts.
• Limit the number of MOM Administrator and MOM Author roles to a few individuals who
are responsible for rule changes. Other MOM users, such as Exchange or Active Directory®
Administrators, should only be members of the MOM Users group (unless these users need
to edit rules or runtime tasks).
The information in this chapter is based on a MOM deployment, with distributed components,
that is managing 20 computers. Although your organization’s IT group may support fewer or
more computers, this chapter provides guidance that you can use in your environment.
Did you find this information useful? Please send your suggestions and comments about
the documentation to momdocs@microsoft.com.
Looking for more MOM information? Experience the power of customer communities!
MOM Community
Work with Alerts 7
• You have installed all of the Management Packs that you want to use for monitoring MOM
servers.
It is recommended that you download the Microsoft Operations Manager 2005 Resource Kit,
which contains tools and best practices that you can use for monitoring, troubleshooting, and
optimizing your MOM environment. Chapter 8 of this guide, “Tools”, provides information
about the resource kit tools as well as the tools that ship on the product CD.
Monitoring Overview
Because operations management requires actionable data, monitoring is a critical component of
MOM 2005.
The role of MOM
In a monitoring role, MOM:
• Gathers computer attribute information and applies specific rules to monitor these
computers, based on their attributes.
• Obtains data from event logs and other providers, as defined by specific rules.
• Collects performance data based on performance counters.
• Generates alerts based on criteria specified in rules. Criteria are based on occurrence of
specific events or thresholds, which are based on the number of events or performance
counters (this includes combinations of performance counters).
Did you find this information useful? Please send your suggestions and comments about
the documentation to momdocs@microsoft.com.
Looking for more MOM information? Experience the power of customer communities!
MOM Community
8 Chapter 3 Monitor
Best Practices
It is recommended that you review the following best practices for Management Packs.
Changing Management Packs
It is recommended that you do not change any MOM Management Pack settings until you have
performed a thorough analysis to determine whether changes are required. If changes are
required, ensure that these changes are adequately tested.
• If you change company knowledge or enable a disabled setting, you can edit the original
rule. This is possible because these settings are preserved when you import the Management
Pack by using the update option.
• If you change an enabled rule, follow these guidelines:
• Make a copy of the rule that you want to change.
Did you find this information useful? Please send your suggestions and comments about
the documentation to momdocs@microsoft.com.
Looking for more MOM information? Experience the power of customer communities!
MOM Community
Work with Alerts 9
Important
• Before you change any of the MOM Management Pack
settings, refer to The Microsoft Operations Manager 2005
Management Pack Guide, which is available from the MOM
product Web site.
• Additional guidance for Management Pack authoring is
provided in the Microsoft® Operations Manager (MOM)
2005 Management Pack Development Guide.
• Guides for other Management Packs, such as Active
Directory and Exchange Server 2003 are also available at
the MOM Web site, and you should review these
documents before implementing any changes.
Note
Management Pack version numbers are provided to help you
locate the most recent version of the Management Packs. The
Management Packs listed are available from the Download
Center of the MOM Web site.
• Windows Base Operating System - Monitors the performance and availability of Microsoft
Windows Base Operating System 4.0 and later versions (MP version: 05.0.2803.0000).
• SQL Server 2000 - Detects and sends alerts about critical events. Helps indicate, correct, and
prevent service outages or configuration problems (MP version: 05.0.2803.0000).
• Internet Information Services (IIS) - Monitors IIS events in the Windows NT and IIS event
logs. For IIS 5.0 and IIS 6.0, it includes a script that polls and tracks the responsiveness of
your IIS server (MP version: 05.0.2803.0000).
• Microsoft Baseline Security Analyzer (MBSA) - Performs security vulnerability assessments
and security update scans of computers running Microsoft Windows 2000 or later (MP
version: 05.0.2803.0000).
Did you find this information useful? Please send your suggestions and comments about
the documentation to momdocs@microsoft.com.
Looking for more MOM information? Experience the power of customer communities!
MOM Community
10 Chapter 3 Monitor
• Microsoft Windows Server Clusters - Highlights events that may indicate possible service
outages or configuration problems, so that you can take action. The highlighted events
provide information about many parts of a server cluster (MP version: 05.0.2803.0000)
Installing and Tuning Management Packs
It is recommended that you install the Management Packs in batches, and then fine-tune and
optimize each one. This approach is considerably easier than enabling and disabling large
numbers of rules. Most Management Packs should not require you to make large-scale changes,
in order to optimize for your environment. Generally, changing less than 5 rules in an MP is the
most that is required. You can, typically, identify these rules by using the most common event
and alert reports.
If you want to disable multiple rules, either disable processing rule groups associated with
computer groups, or just computer groups, rather than disabling all processing rule groups or all
rules.
Importing and Exporting Reports
Note the following information related to importing and exporting reports:
• The report import/export component of the Import/Export Management Packs Wizard
does not support either the import or export of linked reports.
• When exporting reports using the import/export utility, password information is not exported
if the underlying data source uses Structured Query Language (SQL) authentication for
security reasons. When these reports are imported on a different computer, the reports will
be broken because they will not contain the password. In this scenario, the work-around is to
edit the data source and enter the required password.
Importing Management Packs with Custom Tasks
When you use MOM to import a Management Pack that contains a custom task, the custom task
is not visible in the Administrator console navigation pane after the import is completed.
Although the custom task is successfully imported and created, you may have to refresh the
Tasks folder, in the MOM 2005 Administrator console, for the custom task to be displayed
correctly. To do this, use the following procedure.
Refresh the Tasks list in the Administrator console
1. In the Navigation pane, expand the Management Packs node to show the Tasks folder.
2. Right-click Tasks, and then click Refresh.
Management Pack Monitoring Scenarios
The following tables provide summary information about the monitoring scenarios for each of
the recommended Management Packs including the Management Pack for MOM 2005. This
information is extracted from each of the guides that are available for each Management Pack.
Did you find this information useful? Please send your suggestions and comments about
the documentation to momdocs@microsoft.com.
Looking for more MOM information? Experience the power of customer communities!
MOM Community
Work with Alerts 11
Did you find this information useful? Please send your suggestions and comments about
the documentation to momdocs@microsoft.com.
Looking for more MOM information? Experience the power of customer communities!
MOM Community
12 Chapter 3 Monitor
Did you find this information useful? Please send your suggestions and comments about
the documentation to momdocs@microsoft.com.
Looking for more MOM information? Experience the power of customer communities!
MOM Community
Work with Alerts 13
Note
Previous versions of the Microsoft Management Packs, for
MOM 2000 and MOM 2000 SP1, will work with MOM 2005.
However, older Management Packs do not support new
features such as state awareness and run-time tasks.
Did you find this information useful? Please send your suggestions and comments about
the documentation to momdocs@microsoft.com.
Looking for more MOM information? Experience the power of customer communities!
MOM Community
14 Chapter 3 Monitor
Did you find this information useful? Please send your suggestions and comments about
the documentation to momdocs@microsoft.com.
Looking for more MOM information? Experience the power of customer communities!
MOM Community
Work with Alerts 15
Did you find this information useful? Please send your suggestions and comments about
the documentation to momdocs@microsoft.com.
Looking for more MOM information? Experience the power of customer communities!
MOM Community
16 Chapter 3 Monitor
thresholds
• Separate threshold for:
• Logs and databases
• System databases
• TempDb
• User databases
Service pack compliance • Check computers running SQL Server for
compliance with a minimum (user-defined)
service pack or hotfix level
• Generate success and failure alerts for
auditing
• Service pack and compliance reports
display version, build, and service pack
levels
Configuration monitoring Alert on configuration inconsistencies in your
enterprise for each database, including:
• Auto Close
• Auto Create Stats
• Auto Shrink
• Auto Update Stats
• Cross Database Chaining
• Torn Page Detection
Blocked processes • Monitors blocking system process IDs
(SPIDs) based on a blocking duration
threshold time. Alert details include:
• Blocked SPID
• Blocked by SPID
• Program Name
• Block duration
• Login Name
• Database Name
• Resource
• Topped blocked report allows further
details on data, including top blocking
users, application, and average
blocking time
Did you find this information useful? Please send your suggestions and comments about
the documentation to momdocs@microsoft.com.
Looking for more MOM information? Experience the power of customer communities!
MOM Community
Work with Alerts 17
Did you find this information useful? Please send your suggestions and comments about
the documentation to momdocs@microsoft.com.
Looking for more MOM information? Experience the power of customer communities!
MOM Community
18 Chapter 3 Monitor
Service
• File Transfer Protocol (FTP)
• Network News Transport Protocol
(NNTP)
• Simple Mail Transfer Protocol
(SMTP)
• HTTP Filter
• IIS Admin
Application • Alerts and reports on client ● ●
availability and detected errors, including Server
integrity Too Busy
• Detects configuration problems
with Web sites and applications
Security • Performs basic detection of ● ●
unauthorized access attempts
• Detects brute force attacks and
denial of service attacks
• Automatically blocks attackers by
IP address
Site Integrity • Detects missing links from Web ● ●
logs
• Detects invalid URLs
• Detects de-activated Web sites
World Wide Web • Worker process failures ● ●
Publishing Service • Service configuration problems
specific with Web site stopped states
• Configuration issues
• Web site binding issues
• Misconfigured bindings
• Logging issues
Related services • Unexpected failures ●
• Configuration related failures
• Inability to create application
pools
• Identity issues
• Service startup and shutdown
Did you find this information useful? Please send your suggestions and comments about
the documentation to momdocs@microsoft.com.
Looking for more MOM information? Experience the power of customer communities!
MOM Community
Work with Alerts 19
timeouts
• Worker process recycle requests
and events
Did you find this information useful? Please send your suggestions and comments about
the documentation to momdocs@microsoft.com.
Looking for more MOM information? Experience the power of customer communities!
MOM Community
20 Chapter 3 Monitor
Did you find this information useful? Please send your suggestions and comments about
the documentation to momdocs@microsoft.com.
Looking for more MOM information? Experience the power of customer communities!
MOM Community
Work with Alerts 21
Did you find this information useful? Please send your suggestions and comments about
the documentation to momdocs@microsoft.com.
Looking for more MOM information? Experience the power of customer communities!
MOM Community
22 Chapter 3 Monitor
Did you find this information useful? Please send your suggestions and comments about
the documentation to momdocs@microsoft.com.
Looking for more MOM information? Experience the power of customer communities!
MOM Community
Work with Alerts 23
• Failed resources
• Disk mount errors
Rule Overrides
Rule overrides is a valuable tool, provided by MOM, to enable you to override a rule for a
computer or computer group. Overrides can be used and shared by rules, scripts, and the MOM
APIs.
For example, in a scenario where there is a server with performance capabilities that are lower
than other servers in the group, it can trigger a performance alert before the other servers in the
same group. Rather than lower the performance threshold in the rule for all of the servers, you
can create an override that identifies the server and the rule.
You must be a member of, at a minimum, the MOM Authors group to create an override in the
Administrator console.
Use the following procedure to create an override for an event rule. You can use the same
procedure to create an override for alert rules and performance rules.
Create an override for an event rule
1. In the Navigation pane, locate the rule group for the rule.
2. In the Details pane, right-click the rule name and click Properties.
3. On the General tab, select the check-box for Enable rule-disable overrides for this rule.
Note
If the rule is disabled, the prompt for the check-box is Enable
rule-enable overrides for this rule.
4. Click the Set Criteria button to open the Set Override Criteria property page, and then
click Add.
5. Click the right-arrow button beside the Target: input area, and then pick Computer Group
or Computer to specify the target.
6. In the Add Computer property page, select a computer to add, and then click OK. Repeat
steps 5 and 6 if you want to add more computers.
7. By default, the Value: is Disable (0) if the rule is already enabled. Click OK.
8. Click OK to close the Set Override Criteria property page, and then click OK to close the
property page for the rule.
Did you find this information useful? Please send your suggestions and comments about
the documentation to momdocs@microsoft.com.
Looking for more MOM information? Experience the power of customer communities!
MOM Community
24 Chapter 3 Monitor
Did you find this information useful? Please send your suggestions and comments about
the documentation to momdocs@microsoft.com.
Looking for more MOM information? Experience the power of customer communities!
MOM Community
Work with Alerts 25
The following tasks are labeled according to the process shown in Figure 3.1, and each task
heading identifies the minimum MOM local group membership that is required to undertake the
task.
Did you find this information useful? Please send your suggestions and comments about
the documentation to momdocs@microsoft.com.
Looking for more MOM information? Experience the power of customer communities!
MOM Community
26 Chapter 3 Monitor
Note
All members of the Local Administrators group are
automatically added to the MOM Administrators group.
Use the following procedure to add users or domain groups to the MOM Users group.
Add a user to the MOM Users group
1. Log on to the MOM Management Server with an account that has sufficient privileges to add
users to a local group.
2. On the Start menu, point to Programs, point to Administrative Tools, and then click
Computer Management.
3. Expand Local Users and Groups, and then click Groups.
4. Right-click MOM Users and pick Add to Group to open the MOM Users Properties page.
Note
In Windows Server 2000, the dialog is named Select Users or
Groups, and the format for adding a user is: domain\user.
Did you find this information useful? Please send your suggestions and comments about
the documentation to momdocs@microsoft.com.
Looking for more MOM information? Experience the power of customer communities!
MOM Community
Work with Alerts 27
To create an Operator
1. In the Navigation pane, expand Management Packs.
2. In the Navigation pane, right-click Operators.
3. Pick Create Operator to open the dialog for creating an operator.
4. Follow the instructions in the dialog.
Note
Any changes that you make to a Management Pack are not
immediately deployed to managed computers. By default, the
MOM Management Server scans for rule changes every five
minutes. Refer to Chapter 7, “Administrator Console
Reference” for more information about Global Settings. See
Also: “Commit Configuration Changes”.
Note
After you have finished creating operators for your MOM environment, you can add them to one
of the existing Notification Groups provided by the MOM Management Pack, or you can create a
new notification group.
You use the Administrator console to create a notification group.
Note
Predefined notification groups are determined by the
Management Packs that you install. The MOM Management
Pack creates the Operations Manager Administrators group
Did you and
find the
thisOperations
informationManager Notification
useful? Please send Testing group. A and comments about
your suggestions
newly created notification group needs to be referenced by a
the documentation to momdocs@microsoft.com.
rule response before notifications are sent to the group.
Looking for more MOM information? Experience the power of customer communities!
MOM Community
28 Chapter 3 Monitor
Did you find this information useful? Please send your suggestions and comments about
the documentation to momdocs@microsoft.com.
Looking for more MOM information? Experience the power of customer communities!
MOM Community
Work with Alerts 29
Did you find this information useful? Please send your suggestions and comments about
the documentation to momdocs@microsoft.com.
Looking for more MOM information? Experience the power of customer communities!
MOM Community
30 Chapter 3 Monitor
2. Click Console Scopes to display the existing console scope in the Details pane.
3. In the Details pane, right-click the name of the scope that you want to modify, and then pick
Properties.
4. Use the General and Users tabs to make the changes that you want, and then click OK to
close the properties dialog box.
Note
The task that you create will be saved at the location where
you started the wizard. For example, starting the wizard from
the Microsoft Operations Manager folder (below the Tasks
folder) results in the new task getting stored at that location in
the folder hierarchy.
Tip
When you right-click Tasks you also have the option to create
a folder that you can use for organizing any new tasks that
you create.
Note
If the Operator console was open when the task was created,
you have to refresh the console to see the new task.
CreateNote
a rule group
Before you can modify existing rules you have to enable
Did you find this information useful? Please send your suggestions and comments about
Authoring mode. Authoring mode activates user interface
the documentation to momdocs@microsoft.com.
features in MOM that enable you to create and edit vendor
specific knowledge. Enabling Authoring mode also enables
Looking advanced
for more MOM information?
properties on rules,Experience
groups andthe power
other of customer
items that are communities!
read-only
MOM Community or disabled by default. The Microsoft Operations
Manager 2005 Management Pack Guide provides detailed
information about Authoring mode.
Work with Alerts 31
Note
If the Operator console was open when the rule was created,
you have to refresh the console to see the new rule.
Note
The supported number of Operator consoles per management
group is 15.
The default appearance of the Operator console is shown in Figure 3.2. The primary work areas
are labeled.
Figure 3.2 Primary work areas of the Operator console
Did you find this information useful? Please send your suggestions and comments about
the documentation to momdocs@microsoft.com.
Looking for more MOM information? Experience the power of customer communities!
MOM Community
32 Chapter 3 Monitor
In Figure 3.2, note that all of the panes are displayed, and a single pane is provided for results.
Also, by default, all of the available toolbars are visible. You can show or hide panes, configure
the display of information in the Results pane, save data in the results pane, and show or hide
toolbars. Use the following procedures to work with panes and toolbars.
Show or hide panes
• On the Menu and toolbar, click View and then select or deselect the check-box of the item
that you want to change. If you hide the Tasks pane, you can use the Tasks button to
show/hide this pane whenever you want.
Use the following procedure to configure the display of information in the Results pane for all of
the views except the Diagram view.
Configure the display of information in the Results pane
1. Right-click within the Results pane,and pick Personalize View to open the Personalize
View dialog box. This dialog displays Available columns: and Displayed columns:, areas
that list the information fields that are available for the view and that are currently displayed
in the view.
Did you find this information useful? Please send your suggestions and comments about
the documentation to momdocs@microsoft.com.
Looking for more MOM information? Experience the power of customer communities!
MOM Community
Work with Alerts 33
2. To change the order of a field that is displayed, click the field name and click either the
Move Up or Move Down button to move the item.
3. To remove a field that is displayed, click the field name and then click the Remove button.
4. To add a field to the displayed fields, click the field name shown in the Available columns:
list, and then click the Add button.
5. When you have finished customizing the view, click OK to save the results.
When you are working with items in the Results pane, you can copy all of the information that is
displayed for an item and save it as a text file.
To copy and save information displayed in the results pane
1. In the Results pane, click the name of the view item that you want to save.
2. Right-click the item and then click Copy Formatted Data.
3. Create a new file using any text editor and paste the data that you copied into the file.
Note
You can bulk-select items in the Results pane and copy
everything that you selected.
Note
Referring to Figure 3.2:
• The State Indicators toolbar consists of buttons A, B, and
C, which are health indicators. (A = Critical, B = Warning,
and C = Successful)
• The View toolbar consists of buttons D, E, and F. (D = Alert
View Properties, E = Personalize View, and F = Edit view
time filter)
2. An option that IT staff may want to use is the multi-pane capability of the Operator console.
This option is illustrated in Figure 3.3.
Figure 3.3 Customized Operator console
Did you find this information useful? Please send your suggestions and comments about
the documentation to momdocs@microsoft.com.
Looking for more MOM information? Experience the power of customer communities!
MOM Community
34 Chapter 3 Monitor
Using Figure 3.2 as a reference, follow these steps to create the three-pane view illustrated in
Figure 3.3.
Enable multiple Results panes
1. In the Menu and Command bar, click File and then pick Console Settings to open the
Console Settings dialog box.
2. At the View pane configuration: prompt, use the list box and select three panes.
3. Click OK to save the configuration.
There are now three results panes shown in the console, with the top one pre-selected for the
Alerts view.
Associate a view with a Results pane
1. Click the pane below the Alerts results pane and click the Computers and Groups
navigation button to associate that view with the second pane.
Did you find this information useful? Please send your suggestions and comments about
the documentation to momdocs@microsoft.com.
Looking for more MOM information? Experience the power of customer communities!
MOM Community
Work with Alerts 35
2. Click the pane below the Alerts results pane and click the Computers and Groups
navigation button to associate that view with the second pane.
3. Click the pane below the Computers results pane and click the State navigation button to
associate the State view with this active pane.
4. Click View on the Menu and Command bar; clear the check-box beside the Navigation
pane and the Tasks pane to hide these views.
5. Click File on the Menu and Command bar and then click Save As to save the current
Operator console configuration. The console is saved as an .omc file using the name that you
provide. Operators can create and save multiple custom consoles that they can either use
individually, or share.
In addition to the views that are provided, an Operator console user can create private or public
views.
All of the predefined views provided with MOM are public, and are created and populated by the
Management Packs that are installed. If a view is created in the Public Views folder, it is visible
to anyone who uses the Operator console. Private views must be created in the My Views folder,
and are only seen by the Operator who created the view. The following procedure for creating a
view can be used for creating a view for either the Public Views or My Views folders.
Create a view
1. Click the My Views navigation button to show the contents of the folder in the Navigation
pane.
2. In the Navigation pane, click All My Views and pick New. You have the option of creating
a new folder or picking the type of view that you want to create. If you plan to have many
views, it is recommended that you use folders to organize the views that you create.
3. Pick the type of view that you want to create to open a Create New - [View Type] dialog.
4. Use the dialog to create the new view.
Note
The MOM online Help provides detailed information about
criteria that are available for defining the different types of
views.
Did you find this information useful? Please send your suggestions and comments about
the documentation to momdocs@microsoft.com.
Looking for more MOM information? Experience the power of customer communities!
MOM Community
36 Chapter 3 Monitor
manage, resolve alerts, perform diagnostics, and run tasks against selected computers — within
the boundaries of the console scope that they are using.
Did you find this information useful? Please send your suggestions and comments about
the documentation to momdocs@microsoft.com.
Looking for more MOM information? Experience the power of customer communities!
MOM Community
Work with Alerts 37
Did you find this information useful? Please send your suggestions and comments about
the documentation to momdocs@microsoft.com.
Looking for more MOM information? Experience the power of customer communities!
MOM Community
38 Chapter 3 Monitor
• There are several points where latency can occur and where data transfer can be interrupted;
namely: between the agent and the Management Server, and between the Management
Server and the operational database. See also: Monitor MOM Components.
Important
Latency and potential disruption in the data flow are important
considerations for configuring high-service availability and
performance tuning.
Did you find this information useful? Please send your suggestions and comments about
the documentation to momdocs@microsoft.com.
Looking for more MOM information? Experience the power of customer communities!
MOM Community
Work with Alerts 39
8. When you finish configuring the custom service level exception, click OK.
Did you find this information useful? Please send your suggestions and comments about
the documentation to momdocs@microsoft.com.
Looking for more MOM information? Experience the power of customer communities!
MOM Community
40 Chapter 3 Monitor
Note
The enabled columns only display data that is available. For
example, if an Owner is not assigned to the alert, no
information is displayed.
Did you find this information useful? Please send your suggestions and comments about
the documentation to momdocs@microsoft.com.
Looking for more MOM information? Experience the power of customer communities!
MOM Community
Work with Alerts 41
Note
This information can be generated programmatically by
integrating a ticketing system with MOM 2005. For guidance
on ticketing solutions, refer to the “Autoticketing Solution”
described in Chapter 8 of this guide.
• Custom Fields (5) for adding information that can be used by other users in the IT support
group.
Events
Provides the following summary information about the event that generated the alert: Type
(Information, Error or Warning), Time, Source Computer, Provider Type, Provider Name, and
Source.
To view more information about the event, right-click anywhere in the display area and pick
View Events.
Product Knowledge
Displays the appropriate Management Pack knowledge for the alert.
To view the knowledge in the browser window, click the View button.
Company Knowledge
Depending on the console scope, enables the user to view, copy, print, or add to the company
knowledge base.
If the user is a member of the MOM Authors or MOM Administrators groups, they can click Edit
to open a text editor and create knowledge for the alert.
Note
When changes are made to the company knowledge, these
changes are not tracked in the alert history.
History
Displays summary information about the history of the alert, such as the management group it
was created in and the notification group.
A user can add comments to the alert history by clicking the Append button to open the Alert
History dialog box.
Did you find this information useful? Please send your suggestions and comments about
the documentation to momdocs@microsoft.com.
Looking for more MOM information? Experience the power of customer communities!
MOM Community
42 Chapter 3 Monitor
Did you find this information useful? Please send your suggestions and comments about
the documentation to momdocs@microsoft.com.
Looking for more MOM information? Experience the power of customer communities!
MOM Community
Work with Alerts 43
The host process is running too many tasks or is gathering data form too many
providers at one time.
The host process is running scripts that are not freeing resources.
Resolutions
To troubleshoot and fix this problem:
1. Make sure that the managed computer is not low on resources.
2. If the managed computer rarely uses more than 70% of its RAM memory, you can
increase the amount of memory allotted to the MOMHost.exe process.
To increase or decrease the amount of memory allotted to the MOMHost.exe process:
In Regedit.exe (or some similar Registry editor), change the following registry
key:
HKEY_LOCAL_MACHINE\SOFTWARE\Mission Critical Software\OnePoint
MaxDefaultHostPrivateBytes REG_DWORD <bytes>
NOTE - the default setting for this key value is 0x6400000 (100MB).
3. Continue to monitor the process by looking for this alert. If you see this
alert for the host process on a specific computer and you have already increased
the memory allocation, consider enabling tracing for the computer.
To enable or disable tracing for a specific agent:
In Regedit.exe (or some similar Registry editor), change the following registry
key:
HKEY_LOCAL_MACHINE\SOFTWARE\Mission Critical Software
TraceLevel REG_DWORD = 1 - 6
-1 = disabled (default)
0-2 = error level tracing only
3-5 = error and warning level tracing only
6 = error, warning and information level tracing
NOTE - Setting the registry key value to 4 or higher will affect the performance
of the MOM Service on the managed computer.
Tip
If there are multiple alerts that originate from a single
computer, you can bulk-select the alerts and set a resolution
state for all of them.
Did you find this information useful? Please send your suggestions and comments about
the documentation to momdocs@microsoft.com.
Looking for more MOM information? Experience the power of customer communities!
MOM Community
44 Chapter 3 Monitor
3. Click the state that you want, on the list that is provided, to set the state for the alert.
Note
Some alerts will automatically be resolved when the alert
state changes, or might get removed from the operational
database during database grooming.
Note
It is recommended that you do not use a time interval of less
than 5 minutes for maintenance mode. Due to timing cycles,
the Management Server can keep a computer in maintenance
mode for a minimum of 5 minutes.
4. Click OK to close the property page and put the computer in maintenance mode.
Tip
The Microsoft Operations Manager 2005 SDK contains a
sample that shows how to put a computer in maintenance
mode, programmatically.
Run tasks
The tasks that are provided in the Operator console enable an operator, depending on their
console scope, to run preliminary diagnostics to determine the cause of a problem. Table 3.8
summarizes all of the tasks that are provided with MOM 2005.
Did you find this information useful? Please send your suggestions and comments about
the documentation to momdocs@microsoft.com.
Looking for more MOM information? Experience the power of customer communities!
MOM Community
Work with Alerts 45
Did you find this information useful? Please send your suggestions and comments about
the documentation to momdocs@microsoft.com.
Looking for more MOM information? Experience the power of customer communities!
MOM Community
46 Chapter 3 Monitor
Note
Tasks that are not available to the current scope will either
have the Run option grayed out, or else nothing happens
when you click the task name.
Tasks that require a higher level of privilege will display an
“Access is denied” error message when you run them. In some
cases, you may have to look at the Task Status view to obtain
this information.
Did you find this information useful? Please send your suggestions and comments about
the documentation to momdocs@microsoft.com.
Looking for more MOM information? Experience the power of customer communities!
MOM Community
Work with Alerts 47
groups View
State Icons
When an agent heartbeat has a Service Unavailable error for a computer, every state icon for the
other roles (for example, Exchange Server and Active Directory) associated the other are suspect,
and are visually depicted as gray line icons that are identical representations of the full color
ones. For example, the gray circle-x is interpreted as follows: the last known state for this role is
critical error, but since the agent is either not heart-beating, or the agent is flagged as service
unavailable, the data for the other role is suspect.
Until the MOM agent is up again, and heart-beating normally, the gray versions of the state icons
will remain. When the agent is OK again, the icons will return to the colored versions. The logic
is that, since the agent performs the communication, if it is down, information that it
communicates is also suspect.
State Alert
MOM 2005 provides an alert named the state alert. This alert has two problem state values:
Active and Inactive. Each of this states handle rule response processing differently.
For example:
When % Processor time crosses a specified threshold, an alert is created with a problem state of
Active, and any specified responses are run. If the counter drops below the threshold, another
alert with a problem state of Inactive is created; however, none of the responses specified for the
rule are run.
State Rollup
The state of a computer group is based on a roll-up policy, which can be configured by MOM
authors using the State Roll-up Policy tab of the Computer Group property sheet.
Authors have three possible roll-up polices that they can define for their computer groups. These
include:
• Most Severe of any Server
This policy indicates that the state of the computer group will be equal to the most severe
state of any one of the members of the computer group.
• Most Severe of the Healthiest X % of Servers
This policy indicates that the state of the computer group will be equal to the most severe
state of some % of the healthiest servers.
Example: A computer group with 10 members has a policy set to 50%. If 5 have Warning
states, and 5 have Service Unavailable states, then the state of the computer group would be
Warning.
Did you find this information useful? Please send your suggestions and comments about
the documentation to momdocs@microsoft.com.
Looking for more MOM information? Experience the power of customer communities!
MOM Community
48 Chapter 3 Monitor
Important
At times, the state view in the Operator console gets out of
synchronization with the database. Some of the reasons for
this are:
• Queues get full (because a block of data from an agent
will get inserted to server queue at same time, and likely
get processed at same time).
• The MOM server goes down, causing the agents to
failover. (One server might have the red alerts for an
agent; another might get the green alerts. Because the
server was rebooted, alerts get inserted out of order).
• The operational database is unavailable.
The best work-around is to resolve the alert.
Time Filtering
Time filtering is a mechanism for determining how many days worth of information you want to
see in the Results pane for the Alerts and Events views. The default setting is seven days, but you
may want to consider changing this because:
• In the case of alerts, the actual number of active alerts may appear to be higher than it
actually is.
• In the case of events, which generate more data than alerts, viewing response time is affected
by the number of days of data that has to be retrieved from the database and displayed in the
console.
To change the time filter
1. On the Menu and toolbar, click the Edit view time filter button to open the View Date and
Time Filter property page. (This button is labeled “F” in Figure 3.3).
2. By default, Alert and Event data is set to be displayed for within the last seven days.
• You can change the number of days by typing in a lower value. You can also use the list
box to select hours, minutes or seconds.
• Another option is to specify a time range. To do so, click the radio button beside Within
the time range, and set the After or Before date and time.
3. When you finish configuring the time filter, click OK.
Did you find this information useful? Please send your suggestions and comments about
the documentation to momdocs@microsoft.com.
Looking for more MOM information? Experience the power of customer communities!
MOM Community
Work with Alerts 49
Tip
Expand the Performance Views navigation tree to include
Agent Performance. You can use the Performance Data
views that are already constructed as a model for creating
your own views.
Diagram View
The diagram view provides an ideal visual representation, complete with state indicators, of a
MOM computer group. You can use the Group: list in the Menu and toolbar to diagram specific
computer groups that are provided for the console scope that you are using.
If more than one object is shown on the screen, you can arrange the layout by clicking an object
and dragging it to a new location. If you want to reset the diagram layout to the default layout,
click the Relayout diagram button in the Menu and toolbar area of the console.
Exporting the View
Did you find this information useful? Please send your suggestions and comments about
the documentation to momdocs@microsoft.com.
Looking for more MOM information? Experience the power of customer communities!
MOM Community
50 Chapter 3 Monitor
You can export the diagram view and save it as a Visio drawing (.vdx) file.
Export the current diagram
1. With Diagram as the active view, click the Export to Microsoft Visio button in the Menu
and toolbar area of the console. This opens the Save diagram as a Visio .VDX file property
page.
2. Navigate to the location where you want to save the file, provide a filename, and then click
Save.
Background Images
Background images are not provided for the diagram view. In order to add a background image,
you must be a member of MOM Administrators, and must provide the image. The recommended
image size is 640 x 480 pixels. Image quality and distortion will vary depending on how much
you zoom in or out.
Note
A management group can only have one image displayed for
it.
Monitoring MOM
The section provides guidance for:
• Monitoring the various MOM components and MOM processing activities.
Did you find this information useful? Please send your suggestions and comments about
the documentation to momdocs@microsoft.com.
Looking for more MOM information? Experience the power of customer communities!
MOM Community
Work with Alerts 51
Did you find this information useful? Please send your suggestions and comments about
the documentation to momdocs@microsoft.com.
Looking for more MOM information? Experience the power of customer communities!
MOM Community
52 Chapter 3 Monitor
Did you find this information useful? Please send your suggestions and comments about
the documentation to momdocs@microsoft.com.
Looking for more MOM information? Experience the power of customer communities!
MOM Community
Work with Alerts 53
• For MOM Reporting (DB02), the monitoring focus is on the remote agent, the reporting
server, the reporting database, SQL Server, SQL Reporting Services, and IIS.
• In some cases, denoted by an asterisk (*), it is recommended that additional Management
Packs are installed to enable more in depth monitoring of a server.
The MOM deployment in your organization may not be as distributed as the one in Figure 3.5,
but as indicated in the “Operational data processing cycle” section, every MOM deployment has
to collect data from a managed computer, send the data that is collected to a Management Server,
and store data in the operational database.
At a minimum, a MOM deployment will have:
• Agent-managed or agentless managed computers
• A Management Server
• An operational database
In the topics that follow, use the information and guidance that is applicable to your MOM
deployment.
The Agents
The process of managing computers may require the installation and, in some instances, the
removal of agents after the initial deployment. The frequency and extent of this activity depends
on the size, distribution, and dynamics of the IT infrastructure.
Agent deployment
Agents are installed when:
• An existing computer discovery rule is run and new computers are discovered.
• The administrator creates and runs a discovery rule or uses the Install/Uninstall Agents
Wizard.
Agents are uninstalled when:
• An agent-managed computer no longer matches a computer discovery rule.
Did you find this information useful? Please send your suggestions and comments about
the documentation to momdocs@microsoft.com.
Looking for more MOM information? Experience the power of customer communities!
MOM Community
54 Chapter 3 Monitor
Note
By default, the Management Server will wait 48 hours before
automatically uninstalling an agent.
Tip
Use bulk-select on managed computers to uninstall agents,
update agent settings, or run attribute discovery.
Tip
At times, agent configuration data gets corrupted or the agent
simply disappears from a computer. Use the Agent Helper tool
in the MOM 2005 Resource Kit to troubleshoot and correct this
situation.
Note
The items identified for verifying successful agent installations
should also be monitored daily, on an ongoing basis, to ensure
that your agents are healthy.
You can use the Administrator console to verify discovery and deployment. First, if you use the
wizard to install agents, use the following procedure.
Did you find this information useful? Please send your suggestions and comments about
the documentation to momdocs@microsoft.com.
Looking for more MOM information? Experience the power of customer communities!
MOM Community
Work with Alerts 55
Note
When agents are uninstalled from a computer, the computer’s
management state is automatically changed to Unmanaged.
You can also use the views in the Operator console to verify computer discovery and agent
deployment.
First, use the Alerts view to see if any Errors or Critical Errors were generated by discovery
and agent deployment. If there were no errors, and you want to get more information about agent
deployment, use the following procedure to obtain a task status view.
Use the Task Status view to verify discovery and installation
1. Click the Events navigation button.
2. In the navigation pane, expand All: Event Views and click Task Status. All task related
events are displayed in the Results pane and detailed information for each task is shown in
the Details pane.
When agents are not being installed or uninstalled you have to monitor agent configuration and
connectivity on an ongoing basis.
Did you find this information useful? Please send your suggestions and comments about
the documentation to momdocs@microsoft.com.
Looking for more MOM information? Experience the power of customer communities!
MOM Community
56 Chapter 3 Monitor
Note
There are disabled rules in the MOM Management Pack that
collect these events. These rules can be enabled for
troubleshooting purposes. See also: Enabling Agent
Communication Failure Troubleshooting.
Tip
The Microsoft Operations Manager 2005 Resource Kit contains
a Microsoft Excel spreadsheet named
“MOMEventMessages.xls” that lists all the MOM 2005 Event
Ids and their descriptions.
The alerts described in Table 3.11 may be generated when there is a configuration or connectivity
issue.
Table 3.11 Agent configuration and connectivity events
Alerts Description
Did you find this information useful? Please send your suggestions and comments about
the documentation to momdocs@microsoft.com.
Looking for more MOM information? Experience the power of customer communities!
MOM Community
Work with Alerts 57
Did you find this information useful? Please send your suggestions and comments about
the documentation to momdocs@microsoft.com.
Looking for more MOM information? Experience the power of customer communities!
MOM Community
58 Chapter 3 Monitor
Note
In a scenario where the Management Server cannot connect
to the operational database, alert delivery is guaranteed.
However, event and performance data may be lost if the DAS
cannot bulk-insert event and performance data until the
database connection is re-established.
• Other valuable events that you can monitor are listed in Table 3.12.
Table 3.12 Management server events
Rule/cause of failure Event Id
Failed to insert events into the 25101
database.
Unrecoverable database error; the 25102
system will continue processing
events and alerts.
The MOM Server was unable to 25103, 25106, 25107
retrieve data or prepare data for
insertion in the database.
The MOM Server failed to locate any 25105
DAS servers
Best Practices
In addition to monitoring for access issues, availability, and performance, it is important to
identify job failures and other error conditions. The following guidelines are recommended:
• Install the SQL Server Management Pack.
Did you find this information useful? Please send your suggestions and comments about
the documentation to momdocs@microsoft.com.
Looking for more MOM information? Experience the power of customer communities!
MOM Community
Work with Alerts 59
• Know your most common events and their pattern, because deviations from this pattern can
provide a key indicator of a potential issue. Use MOM Reporting to obtain this information
on a daily basis. If MOM Reporting is not available, your database support team can query
the database to obtain this information.
Important
As a best practice, do not run reporting queries directly
against the operational database if MOM Reporting is
available. This has a negative impact on MOM Database
performance; which in turn will affect performance on the
Administrator and Operator consoles.
• Know your top event-generating servers, because an anomaly on this list can help isolate
problem servers. If MOM Reporting is not available, your database support team can query
the database to obtain this information
• Ensure that job owners have sufficient rights to run their jobs.
• Set a low threshold for database free space for early notification so you can make
adjustments before you reach the 40 percent mark. This is required to ensure that re-index
jobs finish successfully. Groom your database aggressively.
• Use the SQL Server Maintenance Plan Wizard in SQL Server Enterprise Manager to
reorganize data and index of the OnePoint database, and to check for database integrity. For
more information about these tasks, see Chapter 4, “Maintain”, in this operations guide.
Did you find this information useful? Please send your suggestions and comments about
the documentation to momdocs@microsoft.com.
Looking for more MOM information? Experience the power of customer communities!
MOM Community
60 Chapter 3 Monitor
Note
The Reporting Server DTS job only transfers operational
database records that have been modified more then five
minutes before the DTS job starts.
This means that if an alert is constantly being modified (for
example, in a scenario where the agent keeps sending alerts
and the consolidation number is increasing). If the alert is
updated less than five minutes before the DTS job runs, this
information will not appear in MOM reports.
Did you find this information useful? Please send your suggestions and comments about
the documentation to momdocs@microsoft.com.
Looking for more MOM information? Experience the power of customer communities!
MOM Community
Work with Alerts 61
Note
If you are using a non-English version of reporting services, or
if you want to use a non-default location, you can specify a
different folder path. If you specify a different path, you must
perform step 2 in the next section, "Extracting Execution Log
Data".
3. Copy the following files from the extras folder on the product CD to the ExecutionLog
folder:
• cleanup.sql
• createtables.sql
• rsexecutionlog_update.dts
• rsexecutionlog_update.ini
4. In Enterprise Manager, create a new database that the DTS package can use as the
destination data source. Use the default name, RSExecutionLog.
5. In Query Analyzer, run createtables.sql to add tables to the database. Be sure to select the
database you created in step 2 before you run the script.
6. Use a text editor to edit rsexecutionlog_update.ini to specify the report server database
(target) and the execution log database (destination).
Populate the RSExecutionLog database
1. In Enterprise Manager, right-click Data Transformation Packages, click Open Package,
navigate to the folder that contains the files, and RSExecutionLog_Update, and then click
OK.
2. (Optional) If you specified a non-default folder in step 1 of the previous section, "Setting
Up", edit the DTS package global variable sConfigINI.
• On the Package menu, click Properties.
• Click Global Variables.
Did you find this information useful? Please send your suggestions and comments about
the documentation to momdocs@microsoft.com.
Looking for more MOM information? Experience the power of customer communities!
MOM Community
62 Chapter 3 Monitor
• In sConfigINI, type the full path and file name of the .ini file (for example,
"c:\logfolder\rsexecutionlog_update.ini"), and then click OK.
3. On the Package menu, click Execute to run the DTS package.
Did you find this information useful? Please send your suggestions and comments about
the documentation to momdocs@microsoft.com.
Looking for more MOM information? Experience the power of customer communities!
MOM Community
Work with Alerts 63
Note
Most of the Management Packs for MOM 2005 have rules that
alert on the availability of key application services.
By default, agents check service availability every 20 seconds, and send a report on service
availability every 120 seconds. You can configure how often the agent checks and reports
changes in the status of Windows services. MOM uses the availability data to produce Service
Availability reports. For more information about the impact of changing these settings, refer to
Chapter 7, “Administrator Console Reference”.
Note
Authentication issues, typically caused by account and
password changes, are covered in Chapter 4 of this guide.
It is important to look for communications issues on an ongoing basis — throughout the day,
each day. Network communications can be the root cause for many other issues, such as agent
installation, and computer discovery.
Did you find this information useful? Please send your suggestions and comments about
the documentation to momdocs@microsoft.com.
Looking for more MOM information? Experience the power of customer communities!
MOM Community
64 Chapter 3 Monitor
Tip
There are several cases in which you might decide not to
collect warnings, performance data, and miscellaneous non-
critical events. These include:
• Deployments across satellite links.
• Large branch office deployments.
• Deployments with very slow WAN links.
• Deployments where alerts are forwarded to a global
network operations center.
• Warnings and informational messages are not needed.
You can create custom computer groups and rule overrides to
reduce operational data volumes.
You can filter events that you do not want to be notified about.
First, you must create a folder to hold the new filter rules, and
then you must add the filter rules.
In addition, you might decide to disable certain performance
data to decrease traffic. After making changes, you need to
commit changes to the system. Exercise extreme caution in
disabling performance counters. For example, several Active
Directory reports do not work if performance monitoring is
disabled.
You can verify access by monitoring the agent heartbeat at regular intervals. Because servers that
host the MOM Database, MOM Management Server have the MOM service installed, these
servers can also be monitored by checking for a regular heartbeat. However, there are additional
access issues that apply to communications between the MOM Database, SQL Server, and MOM
Reporting components.
Did you find this information useful? Please send your suggestions and comments about
the documentation to momdocs@microsoft.com.
Looking for more MOM information? Experience the power of customer communities!
MOM Community
Work with Alerts 65
Did you find this information useful? Please send your suggestions and comments about
the documentation to momdocs@microsoft.com.
Looking for more MOM information? Experience the power of customer communities!
MOM Community
66 Chapter 3 Monitor
Caution
Do not shorten the heartbeat interval as a method of
monitoring for access or availability issues, because the
increased traffic and data that is generated can adversely
affect the performance of your MOM system.
Note
Sometimes event latency for the Web server or the FTP server
can be as high as 10 minutes before an event or alert is seen
in the Operator console. This is caused by the way that the
Web and FTP servers cache their log entries. For performance
reasons, these servers do not immediately write out their log
entries, but retain them until a specified number of entries are
accumulated. The only work-around is to stop and restart
these services.
• The MOM database is too large to record events and alerts efficiently.
• The clock on an agent computer or a Management Server is set to a different time than the
clock on the operational database server.
There are thee ways that you can monitor for latency:
Did you find this information useful? Please send your suggestions and comments about
the documentation to momdocs@microsoft.com.
Looking for more MOM information? Experience the power of customer communities!
MOM Community
Work with Alerts 67
• Analyze individual events or alerts. Compare the time that the event or alert was raised on
the agent computer with the time that it was received in the Operator console.
• Use MOM reporting to generate the Alert Logging Latency report and the Event Logging
Latency report. These reports list average, maximum, and minimum time intervals for event
and alert latencies on an individual computer basis.
• In the Operator console, run the Test End-to-End Monitoring Task against selected agents.
This task generates the output shown in Figure 3.6. Referring to this figure, note that the
Details pane displays the Alert latency (-6 seconds) for this particular test.
Figure 3.6 Results from End-to-End Monitoring Task
Did you find this information useful? Please send your suggestions and comments about
the documentation to momdocs@microsoft.com.
Looking for more MOM information? Experience the power of customer communities!
MOM Community
68 Chapter 3 Monitor
Did you find this information useful? Please send your suggestions and comments about
the documentation to momdocs@microsoft.com.
Looking for more MOM information? Experience the power of customer communities!
MOM Community
Work with Alerts 69
Note
The risk of this scenario is mitigated by using two
Management Servers configured for failover, as illustrated in
Figure 3.5. It is recommended that you use this configuration,
if possible.
The second scenario is a situation where the Management Server cannot insert data in the
operation database.
In both scenarios, MOM provides storage buffers, but the buffers on the agents and Management
Server must be correctly configured to handle outages. For more information about configuring
storage buffer sizes, see Chapter 7, “Administrator Console Reference”.
Important
It is recommended that you do not increase the storage buffer
size for Management Servers or agents to above 100 MB.
Did you find this information useful? Please send your suggestions and comments about
the documentation to momdocs@microsoft.com.
Looking for more MOM information? Experience the power of customer communities!
MOM Community
70 Chapter 3 Monitor
Did you find this information useful? Please send your suggestions and comments about
the documentation to momdocs@microsoft.com.
Looking for more MOM information? Experience the power of customer communities!
MOM Community
Work with Alerts 71
Monitoring Performance
This section provides an overview of performance monitoring. Chapter 6, “Optimize”, provides
detailed information and best practices for optimizing and troubleshooting performance issues in
a MOM environment.
Performance Rules
Performance rules are the foundation of monitoring in MOM. It is important to monitor the effect
that performance rules have on your environment. Tune the rules so that the data that is generated
is meaningful, and to ensure that MOM continues to run efficiently. Performance rules that
generate too much data can slow the performance of your network, the Management Server, and
the operational database.
Note
If the operational database grows too quickly, then the
grooming and indexing jobs might not be able to finish when
anticipated. This can result in an unusable database.
When you are monitoring processing rules, the following guidelines are recommended:
• Use MOM reports to review common events and alerts and to review the most common
alerts. Use the information that you capture from these reports to tune processing rules for
your environment.
• Customize the monitoring view of the MOM Operator console to include the Repeat Counts
column. Use this column to watch for alerts with a high repeat count that might be
suppressed by rules.
• Watch for alerts that might indicate a poorly formulated rule. For example, if a processing
rule is generating a disproportionate number of alerts, it probably needs to be tuned.
Monitoring the top alerts can help you identify rules that need to be tuned.
• Watch for indicators that too many events are being generated from one processing rule.
Did you find this information useful? Please send your suggestions and comments about
the documentation to momdocs@microsoft.com.
Looking for more MOM information? Experience the power of customer communities!
MOM Community
72 Chapter 3 Monitor
Agent Performance
MOM colllects the following performance counters for agents.
Table 3.15 Agent counters collected per management group
Counter Description
Comm Alert Proc Avg Time Specifies the average time (in milli-
seconds) that an alert spends in the
communicator connector on a MOM
agent.
Comm Alert Proc Inc Rate Specifies the number of alerts that
have arrived at the communicator
connector on a MOM agent between
time T1 and time T2.
Comm Alert Proc Simple Count Specifies the total number of alerts
in the communication connector on a
MOM agent at a particular time.
Comm Alert space percent used Specifies the percent of the alert
communication connector queue in
use. This setting is configurable by
the user. The alert communication
connector queue comprises 1/3 of
the overall agent queue file.
Comm Data Proc Avg Time Specifies the average time (in milli-
seconds) data spends in the
communicator connector on a MOM
agent. Data refers to performance,
events or discovery events.
Comm Data Proc Inc Rate Specifies the incoming rate of data
coming into the communicator
connector on a MOM agent between
Time T1 and Time T2.
Comm Data Proc Simple Count Specifies the total number of alerts
in the communication connector on a
MOM agent at a particular time.
Comm Data Proc percent used Specifies the percent of the data
Did you find this information useful? Please send your suggestions and comments about
the documentation to momdocs@microsoft.com.
Looking for more MOM information? Experience the power of customer communities!
MOM Community
Work with Alerts 73
Did you find this information useful? Please send your suggestions and comments about
the documentation to momdocs@microsoft.com.
Looking for more MOM information? Experience the power of customer communities!
MOM Community
74 Chapter 3 Monitor
Note
The performance counters in the MOM Management Pack are
designed to give users a quick snapshot of performance on
the various MOM components. For detailed performance
gathering and analysis, it is expected that you would install
additional Management Packs, such as the Windows Base
Operating System and SQL Server. In some instances, it may
be necessary to create and use custom counters for tuning
and optimization.
Did you find this information useful? Please send your suggestions and comments about
the documentation to momdocs@microsoft.com.
Looking for more MOM information? Experience the power of customer communities!
MOM Community
Work with Alerts 75
Did you find this information useful? Please send your suggestions and comments about
the documentation to momdocs@microsoft.com.
Looking for more MOM information? Experience the power of customer communities!
MOM Community
76 Chapter 3 Monitor
Did you find this information useful? Please send your suggestions and comments about
the documentation to momdocs@microsoft.com.
Looking for more MOM information? Experience the power of customer communities!
MOM Community
Work with Alerts 77
command-line responses.
Resp Exec Inc Rate Specifies the incoming rate of
responses on a MOM Management
Server between Time T1 and Time
T2. Responses are launched through
rules and include scripts and
command-line responses.
Resp Exec Simple Count Specifies the total number of
responses being processed on a
MOM Management Server at a
particular time. Responses are
launched through rules and include
scripts and command-line responses.
Task Exec Avg Time Specifies the average time (in milli-
seconds) a task requires on a MOM
server. Tasks are launched by users
using the Operator console.
Task Exec Inc Rate Specifies the incoming rate of tasks
on a MOM Management Server
between Time T1 and Time T2.
Tasks are launched by users in the
Operator console.
Task Exec Simple Count Specifies the total number of tasks
being processed on a MOM
Management Server at a particular
time. Tasks are launched by users in
the Operator console.
Workflow avg time Specifies the average time (in milli-
seconds) items (data and alerts)
spend in the workflow on a MOM
Management Server.
Workflow inc rate Specifies the incoming rate of items
(data and alerts) into the workflow
on a MOM Management Server
between Time T1 and Time T2.
Workflow simple counter Specifies the total number of items
(data and alerts) in the workflow on
a MOM Management Server at a
particular time.
Did you find this information useful? Please send your suggestions and comments about
the documentation to momdocs@microsoft.com.
Looking for more MOM information? Experience the power of customer communities!
MOM Community
78 Chapter 3 Monitor
It is important to monitor CPU and memory utilization on the Management Server to ensure
efficient MOM operations, and also to determine when the agent load needs to be redistributed
among other Management Servers. The MOM Management Pack provides numerous
performance counters for tracking Management Server performance, such as Raw Bytes
Received/Transmitted, and Total Connections. You should also use other performance counters
that the MOM Management Pack provides, such as Server Queue Spaced Used and Server Total
Connections, It is recommended that you leverage the performance counters provided by the
Windows Base Operating System Management Pack, which was summarized earlier in this
chapter.
It is recommended that you do not exceed the maximum supported levels for the number of
agents per Management Server or management group, as noted in the following table.
Table 3.17 Support limits for MOM components
Item Limit
Agent-managed 4000
computers/Management Group
Managed computers/Management 2000
Server
Management Servers/Management 10
Group
Agentless Managed 60
Computers/Management Group 1
Agentless Managed 10
Computers/Management Server
MOM Database 30 GB
MOM Reporting Database 1 Terabyte
1 In mixed-mode environments, where you have agent -managed and agentless
managed computers, support limits are variable.
MOM Database performance
The performance of the MOM database server is affected by:
• The size of the database.
• The efficiency of the grooming and indexing jobs.
• The amount of free disk space that is available.
• The volume and rate of the data that is being added to the database.
• The rate of communication between the database server and other MOM components.
Did you find this information useful? Please send your suggestions and comments about
the documentation to momdocs@microsoft.com.
Looking for more MOM information? Experience the power of customer communities!
MOM Community
Work with Alerts 79
Did you find this information useful? Please send your suggestions and comments about
the documentation to momdocs@microsoft.com.
Looking for more MOM information? Experience the power of customer communities!
MOM Community
80 Chapter 3 Monitor
Important
If you are running the Reporting DTS job, and you have
timeouts with this Event text:
"System.Data.SqlClient.SqlException: Timeout expired. The
timeout period elapsed prior to completion of the operation or
the server is not responding."
You need to get and install this hotfix:
http://support.microsoft.com/default.aspx?scid=kb;en-
us;821415
Did you find this information useful? Please send your suggestions and comments about
the documentation to momdocs@microsoft.com.
Looking for more MOM information? Experience the power of customer communities!
MOM Community
Work with Alerts 81
• 3 - Warning
• 6 - Info
• 9 - Debug
Caution
Trace levels 6 and 9 will impact performance. Make sure that
you disable these trace levels after you’ve generated the log
files.
Did you find this information useful? Please send your suggestions and comments about
the documentation to momdocs@microsoft.com.
Looking for more MOM information? Experience the power of customer communities!
MOM Community
82 Chapter 3 Monitor
Tip
It is recommended that you use the MOM Trace Log Viewer
provided in the MOM 2005 Resource Kit to view the contents
of trace log files.
Additional Resources
For the latest information about MOM, see the MOM Web site at
http://go.microsoft.com/fwlink/?linkid=6727.
To access the MOM core product documentation on the Web, see to the Technical Resources
section of the MOM Web site at http://go.microsoft.com/fwlink/?LinkId=8943.
Did you find this information useful? Please send your suggestions and comments about
the documentation to momdocs@microsoft.com.
Looking for more MOM information? Experience the power of customer communities!
MOM Community