MP and scripts to test that SCOM internal monitoring is working.
Zip file contains:
—Management Pack
—VBS Event Script
—Scheduled Task
—VBS Event Script
—Scheduled Task
DOWNLOAD Link: SCOM.Test.MP
Ref: ScomGod
<Rule ID="Custom.Example.ResponseOnMS.Rule1" Enabled="true" Target="Windows!Microsoft.Windows.Server.OperatingSystem" ConfirmDelivery="false" Remotable="true" Priority="Normal" DiscardLevel="100"> <Category>Maintenance</Category> <DataSources> <DataSource ID="DS" TypeID="Windows!Microsoft.Windows.EventProvider"> <ComputerName>$Target/Host/Property[Type="Windows!Microsoft.Windows.Computer"]/NetworkName$</ComputerName> <LogName>Application</LogName> <Expression> <And> <Expression> <SimpleExpression> <ValueExpression> <XPathQuery Type="UnsignedInteger">EventDisplayNumber</XPathQuery> </ValueExpression> <Operator>Equal</Operator> <ValueExpression> <Value Type="UnsignedInteger">100</Value> </ValueExpression> </SimpleExpression> </Expression> <Expression> <SimpleExpression> <ValueExpression>
<XPathQuery Type="String">PublisherName</XPathQuery> </ValueExpression> <Operator>Equal</Operator> <ValueExpression> <Value Type="String">MM</Value> </ValueExpression> </SimpleExpression> </Expression> </And> </Expression> </DataSource> </DataSources> <WriteActions> <WriteAction ID="PSWA" TypeID="Windows!Microsoft.Windows.PowerShellWriteAction" Target="SC!Microsoft.SystemCenter.ManagementServer"> <ScriptName>ScriptOnMS.ps1</ScriptName> <ScriptBody> # Add the SCOM API and Log event $api = New-Object -comObject "MOM.ScriptAPI" $api.LogScriptEvent("ScriptOnMS.ps1",2222,0,"This event is created by a script running on the MS") </ScriptBody> <TimeoutSeconds>30</TimeoutSeconds> </WriteAction> </WriteActions> </Rule> </Rules>
Target="SC!Microsoft.SystemCenter.ManagementServer">
<Rule ID="Custom.Example.EventLogCheck.Event6009.Rule" Enabled="true" Target="Windows!Microsoft.Windows.Server.OperatingSystem" ConfirmDelivery="true" Remotable="true" Priority="Normal" DiscardLevel="100"> <Category>Custom</Category> <DataSources> <DataSource ID="DS" TypeID="Windows!Microsoft.Windows.EventProvider"> <ComputerName>$Target/Host/Property[Type="Windows!Microsoft.Windows.Computer"]/NetworkName$</ComputerName> <LogName>System</LogName> <Expression> <SimpleExpression> <ValueExpression> <XPathQuery Type="UnsignedInteger">EventDisplayNumber</XPathQuery> </ValueExpression> <Operator>Equal</Operator> <ValueExpression> <Value Type="UnsignedInteger">6009</Value> </ValueExpression> </SimpleExpression> </Expression> </DataSource> </DataSources> <WriteActions> <WriteAction ID="ScriptWriteAction" TypeID="Custom.Example.EventLogCheck.WA" /> </WriteActions> </Rule>
Call oAPI.LogScriptEvent("CheckEventLog.vbs",1001,1,": CRITICAL : Event " & EventId & " has been detected " & Count & " or more times in the past " & Minutes & " minutes")This will log a critical event with ID 1001 in the OpsMgr event log on the agent, with the event description resembling this:
'========================================================================== ' ' NAME: CheckEventLog.vbs ' ' COMMENT: This is a write action script to inspect the event log for previous events ' ' Change the values for EventId, Count, and Minutes for your write action example (minutes is expressed as a negative number offset) ' '========================================================================== Option Explicit SetLocale("en-us") Dim EventId, Count, Minutes EventId = 6009 Count = 3 Minutes = -20 Dim oAPI Set oAPI = CreateObject("MOM.ScriptAPI") Dim strComputer 'The script will always be run on the machine that generated the original event strComputer = "." Dim strTime strTime = Time 'Check to see if this event has been logged x occurrences in n minutes Dim dtmStartDate, iCount, colEvents, objWMIService, objEvent Const CONVERT_TO_LOCAL_TIME = True Set dtmStartDate = CreateObject("WbemScripting.SWbemDateTime") dtmStartDate.SetVarDate dateadd("n", Minutes, now)' CONVERT_TO_LOCAL_TIME iCount = 0 Set objWMIService = GetObject("winmgmts:" _ & "{impersonationLevel=impersonate,(Security)}!\\" _ & strComputer & "\root\cimv2") Set colEvents = objWMIService.ExecQuery _ ("Select * from Win32_NTLogEvent Where Logfile = 'SYSTEM' and " _ & "TimeWritten > '" & dtmStartDate & "' and EventCode = " & EventId & "") For Each objEvent In colEvents iCount = iCount+1 Next If iCount => Count Then Call oAPI.LogScriptEvent("CheckEventLog.vbs",1001,1,": CRITICAL : Event " & EventId & " has been detected " & Count & " or more times in the past " & Minutes & " minutes") WScript.Quit End If Call oAPI.LogScriptEvent("CheckEventLog.vbs",1002,0,": INFO : Event " & EventId & " was detected, but has not been detected " & Count & " or more times in the past " & Minutes & " minutes") Wscript.Quit
<WriteActionModuleType ID="Custom.Example.EventLogCheck.WA" Accessibility="Public" Batching="false"> <Configuration /> <ModuleImplementation Isolation="Any"> <Composite> <MemberModules> <WriteAction ID="ScriptWrite" TypeID="Windows!Microsoft.Windows.ScriptWriteAction"> <ScriptName>CheckEventLog.vbs</ScriptName> <Arguments /> <ScriptBody><![CDATA[ '========================================================================== ' ' NAME: CheckEventLog.vbs ' ' COMMENT: This is a write action script to inspect the event log for previous events ' ' Change the values for EventId, Count, and Minutes for your write action example (minutes is expressed as a negative number offset) ' '========================================================================== Option Explicit SetLocale("en-us") Dim EventId, Count, Minutes EventId = 6009 Count = 3 Minutes = -20 Dim oAPI Set oAPI = CreateObject("MOM.ScriptAPI") Dim strComputer 'The script will always be run on the machine that generated the original event strComputer = "." Dim strTime strTime = Time 'Check to see if this event has been logged x occurrences in n minutes Dim dtmStartDate, iCount, colEvents, objWMIService, objEvent Const CONVERT_TO_LOCAL_TIME = True Set dtmStartDate = CreateObject("WbemScripting.SWbemDateTime") dtmStartDate.SetVarDate dateadd("n", Minutes, now)' CONVERT_TO_LOCAL_TIME iCount = 0 Set objWMIService = GetObject("winmgmts:" _ & "{impersonationLevel=impersonate,(Security)}!\\" _ & strComputer & "\root\cimv2") Set colEvents = objWMIService.ExecQuery _ ("Select * from Win32_NTLogEvent Where Logfile = 'SYSTEM' and " _ & "TimeWritten > '" & dtmStartDate & "' and EventCode = " & EventId & "") For Each objEvent In colEvents iCount = iCount+1 Next If iCount => Count Then Call oAPI.LogScriptEvent("CheckEventLog.vbs",1001,1,": CRITICAL : Event " & EventId & " has been detected " & Count & " or more times in the past " & Minutes & " minutes") WScript.Quit End If Call oAPI.LogScriptEvent("CheckEventLog.vbs",1002,0,": INFO : Event " & EventId & " was detected, but has not been detected " & Count & " or more times in the past " & Minutes & " minutes") Wscript.Quit ]]></ScriptBody> <TimeoutSeconds>60</TimeoutSeconds> </WriteAction> </MemberModules> <Composition> <Node ID="ScriptWrite" /> </Composition> </Composite> </ModuleImplementation> <InputType>System!System.BaseData</InputType> </WriteActionModuleType>
<Rule ID="Custom.Example.EventLogCheck.MultipleReboots.Rule" Enabled="true" Target="Windows!Microsoft.Windows.Server.OperatingSystem" ConfirmDelivery="true" Remotable="true" Priority="Normal" DiscardLevel="100"> <Category>Alert</Category> <DataSources> <DataSource ID="DS" TypeID="Windows!Microsoft.Windows.EventProvider"> <ComputerName>$Target/Host/Property[Type="Windows!Microsoft.Windows.Computer"]/NetworkName$</ComputerName> <LogName>Operations Manager</LogName> <Expression> <And> <Expression> <SimpleExpression> <ValueExpression> <XPathQuery Type="UnsignedInteger">EventDisplayNumber</XPathQuery> </ValueExpression> <Operator>Equal</Operator> <ValueExpression> <Value Type="UnsignedInteger">1001</Value> </ValueExpression> </SimpleExpression> </Expression> <Expression> <SimpleExpression> <ValueExpression> <XPathQuery Type="String">PublisherName</XPathQuery> </ValueExpression> <Operator>Equal</Operator> <ValueExpression> <Value Type="String">Health Service Script</Value> </ValueExpression> </SimpleExpression> </Expression> <Expression> <RegExExpression> <ValueExpression> <XPathQuery Type="String">EventDescription</XPathQuery> </ValueExpression> <Operator>ContainsSubstring</Operator> <Pattern>CRITICAL</Pattern> </RegExExpression> </Expression> </And> </Expression> </DataSource> </DataSources> <WriteActions> <WriteAction ID="Alert" TypeID="Health!System.Health.GenerateAlert"> <Priority>1</Priority> <Severity>1</Severity> <AlertName /> <AlertDescription /> <AlertOwner /> <AlertMessageId>$MPElement[Name="Custom.Example.EventLogCheck.MultipleReboots.Rule.AlertMessage"]$</AlertMessageId> <AlertParameters> <AlertParameter1>$Data/EventDescription$</AlertParameter1> </AlertParameters> <Suppression /> <Custom1 /> <Custom2 /> <Custom3 /> <Custom4 /> <Custom5 /> <Custom6 /> <Custom7 /> <Custom8 /> <Custom9 /> <Custom10 /> </WriteAction> </WriteActions> </Rule>