SCOM 2012–’Unspecified error‘ During Class Discovery

Recently, I ran into a situation where my class discovery was not working and all I was getting back was a very generic 0x80004005 error:


I turned on a workflow trace, grabbed the ETL and received almost no help whatsoever:

[1]2616.1812::09/04/2014-08:52:02.023 [ModulesLibrary] [] [ModuleDebug] :CModuleHostDebug::NotifyError{ModuleDebug_cpp509}[DiscoveryDataSnapshotMapper] [IModuleHost->NotifyError]  Module reported ModuleErrorSeverityDataLoss    Message: <<Message cannot be displayed>>    Source:  Health Service Modules    Id:  -1073730742    Type: Warning    Category: 0

<<Message cannot be displayed>> is not what I was hoping for from the normally very useful ETL.  The only item I really take from the trace is that the problem is in the [DiscoveryDataSnapshotMapper].  The WMI query in this case actually looks like it returned exactly what I wanted.

Here’s the part of the discovery that would pertain to the mapper:


Just with a cursory skim, there does not appear to be anything wrong with the code.  The custom class I created for demo purposes is simply a computer role class that gets populated if the machine has D: drive that is a logical disk.  Upon closer review, the value that gets pushed into the DDriveSize attribute is the issue.  At some point, the code was probably copied/pasted from either an advanced editor like Word or possible off the Interwebs.  As such, at some point the single quotes have been converted to “smart quotes”.

Word or other advanced editor Notepad
image image

After spending a few minutes reading on smart vs. dumb quotes on various different sites out there, it made me very thankful that our advanced editors just do in fact take care of much of this for us.  Additionally, it makes me question whether or not I actually retained anything from 7th grade English class.

With that being said, the solution to the discovery is simple.  Replace:




Just one more thing to watch for from a management pack authoring perspective whenever copying and pasting code.

Management Packs, MP Authoring, SC Operations Manager , , , ,

SCOM 2012–What’s in my group?

How do you tell what is actually contained within a group?  Looking at a group in the console only reveals the objects that have been added to that group, however, it does not reveal all of the objects that are contained within each of those visible entities.  For example, when you create an override for a Logical Disk monitor and point it at a group that contains Windows Computers, how do you know your Logical Disk is in fact in that group?

$Groups = Get-SCOMgroup
$Group = Get-SCOMGroup -DisplayName “SQL Computers”

HealthState     InMaintenanceMode  DisplayName
———–     —————–  ———–
Success               False        TSTWAPDB.tailspintoys.lab
Error                 False        TSTOM02.tailspintoys.lab
Success               False        TSTCM01.tailspintoys.lab
Success               False        TSTSQL01.tailspintoys.lab
Success               False        tstsql02.tailspintoys.lab
Success               False        TSTSQL03.tailspintoys.lab

Let’s say we want to apply some overrides to this group.  How would we know exactly what is going to be impacted?


This generates the whole list of objects contained within the group along with their HealthState, InMaintenanceMode and DisplayName information (what PowerShell decides to display to the screen).  I want to see what type of object each of these really are and not just their DisplayNames and HealthState information.  Each of the contained objects has various pieces of information which includes the GUID for the class type.

$Objs = $Group.GetRelatedMonitoringObjects(‘recursive’)


I need to resolve the GUID to the actual class name.  Putting it all together yields:

$Groups = Get-SCOMGroup
$Group = Get-SCOMGroup -DisplayName “SQL Computers”
$Class = Get-SCOMClass
$Objs = $Group.GetRelatedMonitoringObjects(‘Recursive’)
Foreach($Obj in $Objs) {
$Obj.DisplayName + “,” +
$Obj.Path + “,” +
($Class | where{$_.Id.GUID -eq $Obj.LeastDerivedNonAbstractManagementPackClassId.GUID}).DisplayName

With that, we can manipulate the data anyway we want.  I typically dump the data out to a CSV file as it can be easier to search and manipulate with something like Excel depending on how much data you are working with.

Why is this useful?  Say you have overrides targeted at a group but you are still not getting the desired effect.  In that situation, it’s nice to ensure the object you are truly trying to target is in fact contained within the group.

Additionally, it is nice from an authoring perspective when you are trying to traverse relationships and are authoring complex groups using the <Contains> and <Contained> tags.  In complex scenarios sometimes <Contains> and <Contained> are embedded within each other.  In those situations, this kind of script comes in very handy.

This is also useful when looking directly at a specific instance rather than a group.  The GetRelatedMonitoringObjects along with recursive can be used to explore any object within a SCOM environment.  For example, here is how to look at all of the discovered objects on a specific machine:

$Machine = Get-SCOMClassInstance -Class (Get-SCOMClass -DisplayName “Windows Computer”)

This shows all of the objects associated with this specific machine including items such as the Logical Disks and other objects that are related to this Windows Computer.

Management Packs, PowerShell, SC Operations Manager

SCOM 2012 R2–Deploying SCOM with the PDT

The PDT (PowerShell Deployment Toolkit) is an amazing piece of technology put together by Rob Willis and is available on the TechNet gallery here:

Basically, this toolkit enables the end user to deploy the entire SC stack along with the Windows Azure Pack (WAP) with minimal work.  This is the perfect way to get started in any lab scenario.  Three weeks ago, I flattened my lab and then used the PDT to stand my lab back up in its entirety within 4 hours.  This included SCOM, SCSM, SCCM, SCORch, WAP and SCVMM.  Not only does it install these products, but it does many of the integrations automatically for you as well.  For example, the connectors for SCOM, SCCM and SCOrch were automatically configured in SCSM during the install.  Very impressive.

In order to use the PDT, all you need to do is configure the Variable.xml file contained within the kit.  You really shouldn’t change anything else.  All you do is configure the Variable.xml file to contain the roles, features and SQL configs you need/want for your lab, run the downloader script, run the vmcreator to provision all of your VMs and then run the installer to do the rest.  The downloader script is an incredible time saver.  It downloads almost all of the files and stages them for you including ALL of the pre-reqs.  The only pieces you have to drop in place are the bits for the SC and Windows Server installs.

The pure magic part of the PDT is the Workflow.xml file.  This is the file that contains all of the install logic, the allowed combinations of roles, the integrations, etc.  I recommend opening it up and checking it out…but don’t change anything.  You don’t need to, which is another part that makes this file pure magic.

For a video demonstration of the PDT, check out the following TechEd 2014 session presented by the creator:

The gotchya I ran into when trying to deploy just a tear down SCOM environment was the placement and combination of the various roles.  Here was what I was aiming for:

SQLOM01 – Contains two SQL instances – OMDB and OMDWDB
TSTOM01 – Management Server and Web Console
TSTOM02 – Management Server and Report Server

Pretty straight forward.  However, this combination does not work because the PDT tries to pass TSTOM01 as the Management Server parameter to the Report Server install so the Report Server install fails.  The only way to get this to work in a three server scenario was to do the following:

SQLOM01 – Contains two SQL instances – OMDB and OMDWDB
TSTOM01 – Management Server, Web Console, and Report Server
TSTOM02 – Management Server

All of the “extra” roles had to be stacked on the primary MS server.  This may change in a future release, but as of 2.64.2608 this was the case.  Attached below is the Variable.xml file I used for testing.  If you wish to use, you will have to modify the top section to pertain to your lab, point the differencing disk to your parent disk for Windows Server 2012 R2 and replace the <#password#> tags with the appropriate accounts for your lab.

Happy PDTing!

SCOM Variable.xml

SC Operations Manager

SCOM 2012 R2 – MP Authoring – Getting Modules and Their Configurations

For so long in SCOM 2007, we had the modules we used the most and knew their configuration.  If we didn’t know the configuration parameters or how to use the modules, the Authoring Console would do most of the work for us by either exposing a GUI that allowed us to use the module or at least by exposing each of the different mandatory parameters that needed to be populated.  Of course, it did not expose the optional parameters, but at least it provided a great place to start and most of the time that was all that was needed.

With the 2012 tools – no so much.  Taking advantage of all of the less frequently used modules in 2012 is much more difficult as the VSAE doesn’t give us that nice picker the AC gave us.  Creating new composite modules or even custom monitor types has gotten more difficult and even finding the right MP that contains the module you want to use can be a challenge.

Post discovering the added consolidation functionality with the ExpressionFilter module, I wrote a quick and dirty script that grabs all of the modules current contained within sealed MPs in my lab environment.  This script could very easily be altered to go after the MPs that are sitting in the 2012 reference folders as well (c:\Program Files (x86)\System Center 2012 Visual Studio Authoring Extensions\References\*).

Import-Module OperationsManager
New-SCOMManagementGroupConnection <SDK Server Name Here>

$Path = “C:\Windows\Temp\ModuleConfig.txt”

Out-File $Path -encoding ASCII

ForEach ($MP in (Get-ScomManagementPack | ?{$_.Sealed -eq $True})) {
$MP.Name | Out-File $Path -encoding ASCII -append
ForEach($Module in ($MP.GetModuleTypes() | sort Name | Sort XMLTag)) {
“`t” + $ + ” – ” + $Module.XMLTag | Out-File $Path -encoding ASCII -append
if($Module.Configuration.Schema -ne $null) {
“`t`t” + ($Module.Configuration.schema.split(“<“) |
?{$_ -match “^xsd:element.*”} |
ForEach{$_.substring($_.indexof(“name”)).split(“=”)[1].split()[0]}) |
Out-File $Path -encoding ASCII -append
“`r” | Out-File $Path -encoding ASCII -append

Popping open the output and looking for the System.ExpressionFilter yields the following under the System.Library MP:

System.ExpressionFilter – ConditionDetectionModuleType
“Expression” “SuppressionSettings” “MatchCount” “SampleCount” “WithinSeconds”

Perfect!  There’s the name, the module type and the configuration parameters we expect now with the 2012 R2 module.

Management Packs, MP Authoring, SC Operations Manager

SCOM 2012 R2 – MP Authoring and Math Functions

Based on the discovery outlined in the last post regarding the changes to the ExpressionFilter, I decided to take a closer look at what has been added from a net new perspective with the intent of circling back and see what additional changes have been made to the existing/legacy modules.  Just to start, I decided to focus on the  Keep in mind, I am comparing the SCOM 2007 R2 management pack to the one that is in my 2012 R2 environment.  As such, it is entirely possible that this material applies to anything 2012 or newer.

$Path = “c:\tmp\”

Import-Module OperationsManager
New-SCOMManagementGroupConnection TSTSCOM1

$mp1 = get-scommanagementpack -managementpackfile “C:\Program Files (x86)\System Center 2012 Visual Studio Authoring Extensions\References\OM2007R2\”
$mp2 = get-scommanagementpack | ?{$ -eq ‘System.Library’}  #the environment is R2

$MP1Mods = $Mp1.GetModuleTypes()
$MP1Names = $MP1Mods | foreach{$_.Name}
$MP2Mods = $Mp2.GetModuleTypes()
$MP2Names = $MP2Mods | foreach{$_.Name}

Compare-Object $MP1Names $MP2Names | out-file ($Path + “Results1.txt”) -encoding ascii

Results in:

InputObject                                                 SideIndicator
———–                                                     ————-
System.Computation                                         =>
System.UniquenessScheduler                              =>
System.ExpressionFilter.IntervalSuppression       =>
System.ICMPProbe                                             =>
System.ExpressionFilter.EventSuppression          =>

The first one, System.Computation catches my eye.  Not just because it’s the first one, but because it seems like it could come in handy just based on the name.  The other ones seem like they may be useful as well, but we’ll look at those later.  I do a quick Bing search on System.Computation and it yields the generic MSDN page.  There is a little bit of data there, but nothing that really shows how to use the module.

At this point, I do a dump of all of the MPs in my SCOM 2012 R2 environment to ‘c:\mpexport’ and then do a quick search to see which of these exports have System.Computation.  The results are System.Library.xml (expected) and System.NetworkManagement.Monitoring.xml.  I pop both of them open to see how this module has been used and find that the NetworkManagement management pack has exactly what I am looking for:


According to this, the System.Computation condition detection module starts and ends with <NumericValue> tags.  Now, I try to find a monitor that uses this particular monitor type.  I find one that passes in the “PercentageExpression”:


Not bad, from this it would seem the values simply need to be wrapped in <NumericValue> tags, and they can be manipulated using <Product>, <Division>, and <Summation>.  I make the leap and assume <Subtraction> works as well (verified).  Pretty sweet!  Going into Visual Studio VSAE, I try Intellisense to see if I can get any additional results.  Nothing.  However, upon trying a derivation of Modulo, I did get the following error:


It would seem the full list of accepted values is documented there.  I do a few more Bing searches and I end up on the System.NetworkManagement.Computation page.  It has all of the values as well as how to use them documented since System.Computation is a sub module of the NetworkManagement computation module.


This is documented with the System.NetworkManagement.Computation Condition Detection article here.  The article also contains samples that pertain to how to use the base System.Computation module as well.

Great stuff.  From time to time, I have been forced to drop into a script to do some sort of simplistic mathematical manipulation of the data.  No longer!

*Note that this is provided “AS-IS” with no warranties at all. This is not a production ready solution, just an idea and an example.

Management Packs, MP Authoring, SC Operations Manager