Rickey Whitworth's Blog » MOM 2005

System Management: Monitoring Security Events with MOM — TechNet Magazine, September 2006

admin — Mon, 11 Sep 2006 13:35:14 +0000

MOM, a key building block in the System Center family of management products, is designed
to simplify monitoring and management of large, heterogeneous IT infrastructures.
I’ll walk you through the process of creating a new MOM Management Pack that can be
used to monitor certain security events in your domain controller (DC) Security event
logs. In addition, I’ll show you how to generate alerts, send notifications, and view
the data needed for SOX- and HIPAA-related reporting.

Source: System
Management: Monitoring Security Events with MOM — TechNet Magazine, September 2006

System Management: Unlocking the Mystery of WMI Events in MOM — TechNet Magazine, September 2006

admin — Mon, 11 Sep 2006 13:30:35 +0000

Microsoft Operations Manager (MOM) is a great tool for keeping an eye on your environment,
but it can sometimes be tricky to monitor a particular activity. If the activity can
be watched through the Windows event log or a counter in Performance Monitor, then
it is relatively easy to create a corresponding rule in MOM. If the activity cannot
be monitored through one of these means, however, then a custom script is often needed.
Such a script will typically be written to sample a particular resource on a predefined
schedule and generate an alert upon detecting that the defined activity occurred.

Source: System
Management: Unlocking the Mystery of WMI Events in MOM — TechNet Magazine, September
2006

System Management: Essential Tools for MOM Administration — TechNet Magazine, September 2006

admin — Mon, 11 Sep 2006 13:25:18 +0000

At the time of its release, MOM 2005 included a resource kit, but it was refreshed
in February 2006 and contains some nifty new tools, divided into five categories as
shown in Figure
1. We’ll explore only the first three here. Look for a follow-up in the coming
months where we’ll discuss the connectors and accelerators.

Source: System
Management: Essential Tools for MOM Administration — TechNet Magazine, September
2006

System Operations Manager 2007 Beta Available for Download

admin — Mon, 05 Jun 2006 15:35:25 +0000

If you are part of the Sysem Center 2007 Beta Program, then you should
have already received the email from the beta site that the Beta is available for
download.

If your not part of the beta try to apply at http://connect.microsoft.com

System Center Virtual Machine Manager Beta Registration Available

admin — Fri, 02 Jun 2006 14:00:15 +0000

Microsoft
System Center Virtual Machine Manager is the latest addition to the System Center
family of management products and provides centralized management of Windows Virtual
Machine infrastructure. Virtual Machine Manager enables increased physical server
utilization, centralized management of virtual infrastructure and rapid provisioning
of new virtual machines by the administrator and end users.
•Product Overview
•Register for the Beta

System
Center Virtual Machine Manager.

Microsoft System Center Reporting Manager Released

admin — Wed, 03 May 2006 01:59:16 +0000

Microsoft System Center Reporting Manager 2006 delivers a rich platform for enterprise
analysis of management data so that IT administrators and managers can query, report,
and forecast IT operations for higher service quality at a lower price. The foundation
of System Center Reporting Manager 2006 is a new data warehouse that integrates multi-management
groups from MOM and multiple SMS operational databases into a single data warehouse
to enable better decision making more quickly via “better together” reports.

Microsoft
System Center Reporting Manager

SQL Management Pack may not monitor MSDN Installed SQL 2005

admin — Wed, 26 Apr 2006 02:34:22 +0000

Ran
across this on another site, read for more details.

Google
Groups: microsoft.public.mom.managementpack.sql.

MOM 2005 Management Pack for Blackberry Enterprise Server

admin — Fri, 23 Sep 2005 18:24:52 +0000

As a heavy Blackberry Server user, this could be useful. I am downloading a trial version to test.

ivision:
solutions

Scripting for MOM

admin — Tue, 05 Jul 2005 19:16:26 +0000

Scripting for MOM brings together resources for system administrators who are interested in writing scripts for use with Microsoft Operations Manager (MOM). We will be adding new content and scripts periodically %u2013 so check back with us every once in a while. We%u2019d like to be sure we%u2019re continuing to meet your needs, so let us know what you%u2019d like to see here.

Scripting
for MOM

Creating Custom Events and Event IDs for Monitoring with MOM 2005

admin — Wed, 01 Dec 2004 05:20:14 +0000

With our recent implementation of MOM 2005, we are trying to update some of our custom
internal IT applications so that they can be monitored more effectively using MOM.
So in essence, I have been trying to get a web service to log results to the application
event log on the web server.

The first thing I ran into was a permissions issue by trying to create an event source
using the following code:

If Not objEventLog.SourceExists(“EDM
Web Service”) Then

objEventLog.CreateEventSource(“EDM
Web Service”, “Application”)
End If

There are two issues. First, you cannot create the event source like this from a web
app. It is documented by Microsoft in this article:

PRB: “Requested
Registry Access Is Not Allowed” Error Message When ASP.NET Application Tries to Write
New EventSource in the EventLog

I worked around this by taking the first step and just manually creating the registry
key for the EDM Web Service since we will not be packaging this app for deployment.
After creating it you will then need to give the local ASPNET account write access
to the application log in the registry as detailed here.

ASP.NET and
the Event Log

Now my last problem was that rule groups in MOM are based on Event IDs. If you pass
an event ID to the write entry method like this:

objEventLog.Source = “EDM
Web Service”

objEventLog.WriteEntry(“”,
EventLogEntryType.Error,
1000)

you will get an error similar to the following when you open the event in the event
log

The description for Event ID ( 1001 ) in Source ( EDM Web Service ) cannot be found.
The local computer may not have the necessary registry information or message DLL
files to display messages from a remote computer. You may be able to use the /AUXSOURCE=
flag to retrieve this description; see Help and Support for details. The following
information is part of the event: .

Well, I want desciptive text in my Event Messages, so the solution is to use a message
dll. The instructions for doing this are included in the link below.

Getting the most out of Event
Viewer

Basically you create a text file that has event id’s corresponding to a message. This
is great for your code as well since it allows you to store descriptions for messages
separately from your code. Now we can set MOM up to generate an alert or change the
state of a server if a critical message pops up.