Tuesday, March 13, 2012

Netman.dll issue on SCOM 2007 R2 OS Management Pack version 6.0.6958.0

There is a known issue that Microsoft has released a Fast Publish article for. This is pertaining to the SCOM 2007 OS management pack that was released on 18/20/2011.
The below is an extract of what you may encounter on a Windows 2003 server that is affected by this issue
The server service stops unexpectedly on the Windows 2003 server. You can find the following event in the application event log:
Event Type:        Error
Event Source:    Application Error
Event Category:                (100)
Event ID:              1000
Date:                     29/10/2011
Time:                     1:02:12 AM
User:                     N/A
Computer:          <computer name>
Faulting application svchost.exe, version 5.2.3790.3959, faulting module netman.dll, version 5.2.3790.3959, fault address 0x0000000000008d4f. 

The svchost that is hosting the Server service crashes causing any other services in that svchost instance to fail. The service cannot be restarted and generates an "Access Denied" event on the event logs (Event 7023). This is a known issue in Netman.dll that becomes exposed after rules and monitors are ran from the SCOM server with the OS Management Pack which version is 6.0.6958.0

More information can be found in the KB below

Wednesday, March 7, 2012

Troubleshooting Grayed Agents in SCOM

Grayed agents in SCOM Console can be due to several reasons and of course the simplest of them all is that the System Management Service on the server is not started.
Other reasons includes the
-           Database that is used by the health state is corrupted
-          Heartbeat failure
-          Invalid configuration
-          System workflows failure
-          OpsMgr Database or data warehouse performance issues
-          RMS or primary MS or gateway performance issues
-          Network or authentication issues
-          Health service issues (service is not running)

The link article below provides a very useful reference to assist any administrators that requires assistance to resolve issues involving agents that repeatedly goes into grayed state despite repeated  attempts to resolve it.
The articles itself provides a number of possible scenarios of this issue as well as the various resolutions.

Microsoft has released a hotfix for Windows 2003 agents that are encountering this issue which can be downloaded in the link below.
Primarily the ESENT.dll file will be updated for the servers and Yes, this update requires a restart.

Friday, March 2, 2012

Some Helpful SCOM Queries

The below is 2 SQL queries that I use to work around some limitations in SCOM 2007 R2.
To do these, changes are required on the SCOM OprsMgr Database hence sysadmin rights is required on the database.

Have you ever found that the agent is still displayed as grayed out in the computer’s view of the SCOM Console after the agent has been uninstalled and deleted from the list of agent managed servers?
To remove those, you may use the statement below

Remove state servers from computer view after removal of agents

UPDATE [OperationsManager].[dbo].[BaseManagedEntity] SET [IsDeleted] = 1   WHERE [DisplayName] LIKE 'Server FQDN Name’

Though manually SCOM agents to server is not a good practice, there are times that it has to be done this way for whatever operational reasons.
The manually installed agents comes with short comings such as
-       Not being able to be managed from the SCOM console
o    Able to change Management Server
o    Not automatically update to the latest CU whenever you perform an upgrade on the Management Servers.
The query below will enable the to be converted to be remotely manageable despite being installed manually.

Convert manually installed agent to remotely manageable

UPDATE MT_HealthService
SET IsManuallyInstalled=0
WHERE IsManuallyInstalled=1
AND BaseManagedEntityId IN
(select BaseManagedEntityID from BaseManagedEntity
where BaseManagedTypeId = 'AB4C891F-3359-3FB6-0704-075FBFE36710'
AND DisplayName =’Server FQDN Name’)