SCOM 2012 SP1 client-side event 34215

This is a short tip to solve the error event 34215, this event appears when client-side is trying to write an extra configuration into a IIS shared configuration and you don´t have enough permissions.

First thing, is understand how client-side monitoring is deployed. By default, client-side monitoring, tries to create the CSMCollector virtual directory and the OperationsManagerCsmCollector v.4.0 application pool when you execute the client-side wizard in the SCOM console.
The solution is easy, just give the computer permissions (web server) over the shared directory of IIS config.

After that you will get an event 34243 that means "The new client-side monitoring configuration has been successfully applied. No conflicts were detected."

SCOM 2012 check root login into CentOS system

Continuing the previous post, here is a recipe to rise an alert when root or privileged account has login into CentOS box via SSHD.

Obviously, for this recipe you need the Unix/Linux Management Packs applied and properly configured, here is an old post concerning this topic. 

There are at least two ways, via ACS or via Unix/Linux Log file monitoring to rise this type of alerts. 

The quickest and easiest way is with Log file monitoring, but it is less accurate than ACS, for example ACS has a set of reports to get detailed login statistics, but in some scenarios, it could be noisy and complex to manage.

SCOM 2012 - Create alert / monitor based on Windows event ( Administrator login alert )

Today, our customer asks us how we can know when the Administrator has logon via terminal server on Windows Server on their Domain.
The answer is with SCOM, using the event alert feature.
When you do a login in Windows 2008 or higher and the audit is running an event with id 4624  is created in the security log of the machine.
So first step to create the alert / monitor is to enable the audit.
You have to add new group policy with the audit enabled in the OU of the computers that you want to monitor, in this image you can see highlighted what you need.

Scom APM 2012 SP1

Part1 - SCOM BASICS

Part2 - Useful SQL queries in SCOM database
Part3 - Basic reporting in SCOM
Part4 - SCOM scripting basics
Part5 - SCOM Linux Agents
Part6 - SCOM SNMP monitoring
Part7 - SCOM DMZ Agent

Definition of APM from MSDN:

In System Center 2012 – Operations Manager, you can monitor web applications and web services from server- and client-side perspectives to get details about application availability and performance that can help you pinpoint problems. (For System Center 2012 SP1 only: You can also monitor Windows Services.) When you specify settings, the types of events to collect, the performance goals to measure, and which servers to monitor, Operations Manager .NET Application Monitoring provides insights into how web-based applications are running. You can see how frequently a problem is occurring, how a server was performing when a problem occurred, and the chain of events related to the slow request or a method that is unreliable. You have to have this information to partner with software developers and database administrators to help ensure that applications are available and perform at optimal levels.

SCOM DMZ agent

Part1 - SCOM BASICS

Part2 - Useful SQL queries in SCOM database
Part3 - Basic reporting in SCOM
Part4 - SCOM scripting basics
Part5 - SCOM Linux Agents
Part6 - SCOM SNMP monitoring

Nowadays, there are a lot of great articles about this topic and we think that is not necessary to write a step-by-step article explaining how to run a Windows agent on the DMZ or out of the domain of SCOM server.

Here are some great examples of these articles explaining how to deploy a DMZ agent:
http://pkjayan.wordpress.com/2010/05/17/agent-managed-untrusted-servers-step-by-step-guide/
http://blogs.technet.com/b/stefan_stranger/archive/2012/04/17/monitoring-non-domain-members-with-om-2012.aspx

There are even some homemade scripts to deploy the agents like this one: http://systemscentre.blogspot.com.es/2012/03/scom-dmzworkgroup-agent-deployment.html

SCOM SNMP monitorig

Part1 - SCOM BASICS

Part2 - Useful SQL queries in SCOM database
Part3 - Basic reporting in SCOM
Part4 - SCOM scripting basics
Part5 - SCOM Linux Agents

SNMP monitoring is easy to implement in SCOM 2012.
SNMP monitoring in SCOM is an example of agentless monitoring.
Since SCOM 2012 there are a lot of templates related with SNMP devices, before SCOM 2012 you had to install the xSNMP management pack, nowadays a lot of vendors are included in SCOM 2012 by default.

Here is a list of well supported devices: http://www.microsoft.com/en-us/download/confirmation.aspx?id=26831

SCOM Linux Agents

This is the part four of a set of articles related to SCOM

Part1 - SCOM BASICS

Part2 - Useful SQL queries in SCOM database
Part3 - Basic reporting in SCOM
Part4 - SCOM scripting basics

How to deploy

Before SCOM 2012 SP1, if you didn´t  have the supported Linux Versions like Red Hat or SUSE, it was hard to deploy a Linux agent, nowadays with the new management packs, it is much easier.
In this article, we are going to a make a sumary which covers the installation and basic troubleshooting in Linux systems, but it could also be useful with Unix agents.

Basic reporting in SCOM

This is the part three of a set of articles related to SCOM

Part1 - SCOM BASICS

Part2 - Useful SQL queries in SCOM database

Basic reports in SCOM

There are two main ways to edit or develop a report for SCOM: via Report Builder or via Visual Studio. 

In this article we are going to use Visual Studio 2010 with bussines inteligence tools installed.       

Useful SQL queries in SCOM database

This is the part two of a set of articles related to SCOM

Part1 - SCOM BASICS

Which are the differences between Operations and Datawarehouse databases.

Extracted from Microsoft web:

• The operational database is a SQL Server database that contains all configuration data for the management group and stores all monitoring data that is collected and processed for the management group. The operational database retains short-term data, by default 7 days.

• The data warehouse database is a SQL Server database that stores monitoring and alerting data for historical purposes. Data that is written to the Operations Manager database is also written to the data warehouse database, so reports always contain current data. The data warehouse database retains long-term data.

The data retentions in the operational database can be extended from the administration console in the menu Administration --> Settings --> Database Grooming. It is a good idea to extend them to two weeks if you do not have a lot of events in SCOM, because you can plot larger performance charts from the console or search alert events from the console without entering into reporting services. Remember, this is an operational database, so more than four weeks of retention usally can impact  the SCOM perfromance negatively.

SCOM basics

This is the part one of a set of articles related to SCOM

What is SCOM

The defintion from Wikipedia:

System Center Operations Manager (SCOM) is a cross-platform data center management system for operating systems and hypervisors. It uses a single interface that shows state, health and performance information of computer systems. It also provides alerts generated according to some availability, performance, configuration or security situation being identified. It works with Microsoft Windows Server and Unix-based hosts.