Based upon the expression found for the rule this would not catch the event #55 we are seeing.

As a workaround to resolve this we created a new rule which matched the condition we are looking for (event #55 from source of NTFS in the System log).

We configured the alerting level to medium priority, warning severity and suppressed duplicates based upon the logging computer. For highly critical systems we created an override to set it to high priority, critical severity.

Summary: Event #55 disk corruption checks do not appear to be caught in the current version of the Operating System management pack (6.0.6794.0). This functionality should be added either to the existing rule which matches event #41 or should have a new rule created to catch this condition as well.

It looks like kb2251419 is breaking the ability to edit company knowledge per the thread below:

http://social.technet.microsoft.com/Forums/en/operationsmanagerauthoring/thread/b2c679f3-d971-4fc9-b07a-983bf95e8c7b

Just posting this in case others are running into it!

Needless to say, on this server something is causing issues with reporting the WER information. To configure this setting for the server  open the server manager on the system and choose the “Configure Windows Error Reporting” as shown below.

My recommendation is to enable Windows Error Reporting in environments where it functions correctly so my preference was to leave this enabled, but as our setting currently was “Yes, automatically send reports” and we were having this issue we changed it to the “I don’t want to participate” option as shown below.

Summary: If you are seeing a lot of werfault*32 errors backing up in task manager you may want to disable Windows Error Reporting on the server as shown in this blog entry.

If you really want something fun to do try uncompressing some 13-17 gb VHD files! I started off by grabbing a cup of coffee, and ended up going out for dinner. It may be possible to re-compress a virtual after the VHD has been attached but I’m not willing to spend the time to find out today (and I’m pretty sure it would be unsupported).

Summary: While I’m sure that there was a good technical reason for it, don’t assume that you can use a compressed VHD file with Windows Server 2008 R2/Hyper-V. It’s a good idea to decompress all of your virtuals prior to trying to move them over.

I had previously created rules in the Operations Manager console and thought I could just edit them in the authoring console and add a schedule to make it work. It wasn’t until I read through Steve Rachui’s article (the link at the end of this blog article) that I had the lightbulb moment. While adding the schedule to the rule via the authoring console would have worked there was a step that I had missed! Here’s a summary of the steps that I took to add scheduling to an existing rule:

1) Created a management pack in the Operations Manager console

2) Created  a rule which fired when an event 1000 was found in the event log and stored it in my new management pack

3) Using the authoring console, I connected and did a tools, Import MP from Management Pack

4) I chose my custom management pack and after locating any management packs it was dependant upon (look in the %programfiles%\System Center Operations Manager 2007 folder, or it is really helpful to use the management pack download capabilities within the Operations Manager console to download all management packs from the catalog into a temporary directory like c:\temp) I was able to find and edit my rule (under Health Model, Rules).

5) Edit the rule, on the model tab and do a create for the Condition Detection section.

6) Searched on schedule, and typed in “System.ScheduledFilter” below:

7) Edited the condition detection to set my scheduling configuration for the rule.

8) Clicked on the configure button shown below.

9) There are multiple options available but for my configuration I wanted the option to “Process data except during the specified time”.

10) Next I specified my timeframe (every day of the week between 12:00 am – 7:00 am).

11) Here’s where the trick hit. If you skip this step the scheduling will not work. Click on the edit tab shown below:

12) Editing brings up the actual XML in notepad – but all we need to do here is a quick substitution and we’re out of XML territory. We originally see something like the following:

Replace:

TimeXPathQuery

With:

true

(results shown below)

13) Save the change and it will alter the screen as shown below: (note the UseCurrentTime true)

14) Export the management pack back to the management group.

15) Now if you edit the rule in the Operations Manager console it adds the Condition which can now be edited or renamed.

16) If you use the edit button this should look really familiar!

Summary: If you are looking for a simple way to change a rule to run only during specific hours (or to exclude specific hours) open the management pack in the authoring console, add a condition to the rule to use the System.SchedulerFilter and configure the scheduler as needed, edit the XML to replace “TimeXPathQuery” with “true” and export the updated management pack back into the management group! Once you have done this a couple of times this is literally a couple of minutes to take an existing rule and give it the ability to be run on a schedule.

The following are great readings to go through on this topic which have really helped me out:
 

http://nocentdocent.wordpress.com/2009/05/01/opsmgr-r2-authoring-console-business-hours-monitor/ – Written by Daniele Grandini

http://blogs.msdn.com/b/steverac/archive/2009/11/17/creating-rules-and-monitors-with-a-schedule-understanding-xml-internals.aspx - By Steve Rachui

ReSearchThis! is still available on the System Center Central Management pack catalog available at: http://www.systemcentercentral.com/tabid/63/tag/Pack_Catalog+MP_Catalog/Default.aspx 

I owe a huge thanks to Akos Technology Services, SystemCenterCentral and Pete Zerger for all that they have done to help to make this community management pack into a reality and for their support to add this management pack into the catalog.

The key reason for this most often is a requirement to determine what agents are not heartbeating correctly. There isn’t a view (or a way to customize) a view within Operations Manager that I have been able to find so this is a solid question. Good reading on this is available at http://blogs.msdn.com/b/mariussutara/archive/2008/07/24/last-contacted.aspx.

Solution: My recommendation is to use the free new reports from System Center Central as part of the SCC Health Check Reports. They have a report called “Agents – Down Agents (OM)” which works well to provide this type of information as shown below.

This report shows all agents which are not currently sending heartbeats and when they had last sent a heartbeat.

Summary: Want to see what agents aren’t heartbeating correctly in your environment? Check out the Down Agents report!

[TANGENT STARTS HERE: When we started with Operations Manager there were no methods available to estimate data warehouse sizing so seeing this report really makes my day. This process has gone light-years past the types of calculations we were building in Excel based upon estimated impacts of rows of different types of data into the Data Warehouse and then from a formula trying to determine what database sizes would look like a year after deployment, but I digress… TANGENT ENDS HERE]

Note that the report shows the estimated maximum sizing for the database at just over 100 gb in the report before we made the change. We changed the data retention for the performance (hourly and daily) using the steps detailed within Kevin Holman’s blog entry available at http://blogs.technet.com/b/kevinholman/archive/2010/01/05/understanding-and-modifying-data-warehouse-retention-and-grooming.aspx. After making the change, the estimated Data Warehouse database size increased to just over 150 gb.

Summary: Check out the new Data Warehouse Properties report and if you want to determine projected database sizes after making data retentions changes you should really check out this report (before and after making the changes)!

And then the performance over history with a report:

These confirmed that this value continues to increase until the service is restarted (or the machine is rebooted). Historically this would mean it would be logical to either disable this monitor until the performance counter is corrected or to lower the priority to a warning until the performance counter can be changed to not continually increase. However, digging online I found that this monitor actually works off a delta in values not the actual value! (http://msmvps.com/blogs/ehlo/archive/2008/06/23/1636921.aspx). This makes the monitor useable. However since we were receiving a large number of alerts on these and they were not causing issues in the environment myself and the Exchange engineer decided that the next step would be to determine effective thresholds for my environment. With any non-delta counters we can normally right-click on the alert, and open the performance view and see what the range of values is for the condition. However, in the case of a monitor based upon the delta we needed to use the state change events for the monitor within Health Explorer. This allows us to identify what the delta value are so that we could establish a baseline for this environment (in the screenshot below the delta value shows a 44).

For our environment, we decided upon a first threshold (warning level) of 50 and a second threshold (critical level) of 75. This has worked well to reduce the amount of alerts generated by this monitor while still maintaining it’s functionality.

Summary: For the “Failure DNSs total” if you are receiving large numbers of alerts use the State Change Events for the monitor to determine what threshold levels are optimal for your Exchange environment.

The resulting list shows all agent managed computers which will remove the root management server and management servers from the view. Next highlight all servers except those currently in maintenance mode, right-click and put them into maintenance mode.

Voila! This doesn’t put entities such as agentless systems (clusters and such) and perspectives (synthetic transactions) into maintenance mode but it’s a quick way to get the majority of what’s needed under maintenance!

However, what if you have a report and it doesn’t have the filter option and you want to still pass over the correct entity? Looking at the report below it states that the data type is “Windows Operating System” and contains “Server 2008”.

To match this criteria, we can use the monitoring pane / Discovered Inventory. We set the target to the name shown in the report “Windows Operating System” and we can also filter based upon the search object which is specified (in this case “Server 2003" which is the same report as shown above but for the server 2003 systems).

I can now highlight the server (only one unfortunately on the Discovered Inventory screen) and run the “Operating System Performance” report which now passes the appropriate parameter to the report.

Ok, that’s pretty cool. Now I can easily run this report on whatever server I decide that I want and I can also save it out and work with it (sharing it, scheduling it for email delivery etc). However this view only allows me to select one server to run the report for. What about if I want to create the report for multiple servers? I can create a new view which shows these entities as shown below:

From this I can select multiple servers (as long as they are all the same OS – 2000, 2003 or 2003) and run the report passing it multiple servers (up to 10 in total but it looks like this can be overridden via  registry key – see http://blogs.technet.com/b/operationsmgr/archive/2008/11/11/opsmgr-2007-registry-keys-to-control-the-refresh-of-the-admin-console.aspx in the section labeled Registry Key to control the number of objects to fetch Tasks/Reports). To make sure these are the same OS, sort by the name field and select Operating Systems which are the same.

 The result is a performance report which has a separate page for each of the different servers that I selected!

How about an example of a report which does not have the filtering option available? Let’s take a look at the Active Directory Server Common Library / AD Machine Account Authentication Failures report.

The target shown here is “Active Directory Domain Controller Computer Role” which I can cut and paste out of the text in the report. (Hey, it’s even mentioned in the report that you can create a state view or event view with the right type – I guess I should read the text here more often…)

I can paste in the name into my target field (be sure to check View all targets), and see what objects are listed. And once I highlight one of the entities I can now run the report passing the correct parameters to it.

The same concept would work with selecting multiple servers if I create a state view which shows the Active Directory Domain Controller Computer Role (cut and paste works like a champ here as well both to name the state view and to set what data to show).

Summary: Looking for a quick way to create a performance report which shows a group of servers with one server graph per page? Try using the Operating System Performance report with a view defined to show the “Windows Server Operating System” target. Looking for a quick way to create reports which do not have a filtering option? Try this approach to create a state view for the appropriate entities and then run the report!

I started with a simple distributed application as shown below which monitors two websites, which are dependant upon one service and two databases. The website is monitored by a distributed application. The distributed application is shown below:

When this is shown in the Operations Manager console as a distributed application is is pretty straightforward and shows what we would expect as I can see my distributed application and each of the components within it as shown below.

I then translated this distributed application into a Live Map as shown below.

Notice that in this format I can do some things which I could not with a distributed application:

1) I can show each of the components of the DA without expanding them.

2) I can provide the custom look and feel that I want for the various pieces of the application.

3) I can now label these as I choose versus using the names provided in the distributed application (see DB1, DB2, WEB01, WEB02, etc).

Translating Distributed Applications into Live Maps:

So what’s a good way to quickly translate a DA into a Live Maps? In the Live Maps Authoring console, drag and drop the distributed application onto a blank map.

Next I can open the distributed application and add the various components via drag and drop them into the map that I am designing. Fifteen minutes later I had a rudimentary Live Map (shown in the third image in this article) configured when I can then add into my top level dashboards which represent the health of core applications and web services in my environment.

What about health rollup?

To test rollup of health, I made some changes to the Live Map and added a third website as shown below. I used Dennis’ article (link above) to configure rollup so that if more than 50% of the web servers went red it should rollup red.

Next I stopped two of the websites to cause a failure condition which rolled up correctly to the MyWebSite level and to the My Application level (which is linked to the Distributed Application).

I restarted one of the web servers to validate that the rollup worked as expected which is shown below (since it was less than two web servers offline the health went to a green state).

These views are also easy to manipulate – the one above was designed to show all of the information on a similar level, the one below shows it broken into more layered components (front-end servers/services, databases, and back-end services).

There are lots of potentials for how to provide visibility into your distributed applications with Live Maps. Another one to consider (especially if you have a lot of web sites) is to create a sub-view for the web farm itself and to configure the rollup of the sub view. This approach makes it easy to understand the overview of the application and provides a business application view which represents the true health state of the application which can be nested on a higher level dashboard view. The view below shows a complicated distributed application which was built of six different sub-distributed application. To provide a high level overview of the health of the six components it could be shown with a single status (the grey bars labeled as SubApp1-6) but this approach was used to provide a summary view of the sub-dashboards which were created. SubApp1 shows a website test, the website and the database. These are the high level components of the “My Application” view showed two graphics backward. This approach shows an extremely complicated distributed application in a single dashboard which can in turn be linked into sub-dashboards to provide the detailed status of the components of the distributed application.

QuickTrick: In Live Maps how can I tell if a link is to a submap or an entity?

When using Live Maps, it is often confusing to know whether an item on a dashboard is linked to another Live Map or to an entity (such as a distributed application). When it’s an entity and you double-click on it the result is an opening of the Health Explorer. Personally I do not use Health Explorer when going through the dashboards, instead I right-click and open the Diagram view. However, since there’s no way to tell whether it’s an entity or another Live Map I often end up opening the Health Explorer by accident. Try this out though!

On each map that I create which has a submap linked to the area, I use a graphical indicator that there is a Live Map attached to it. In the graphic above we see each of the SubApp(s) has a little green arrow next to the health indicator. If I see this arrow I know that it’s attached to another Live Map so I can double-click to go to the next map! I downloaded this from the web (thank you iconarchive.com!, http://pixel-mixer.com) and used Microsoft Office Picture Manager to rotate it 90 degrees.

Summary: If you really want to increase the usefulness of your distributed applications into high gear, look into using the Savision Live Maps product to mirror your distributed applications. This is a great way to add value to Operations Manager especially if you are already using Live Maps in the environment. And when generating sub-maps, consider using a graphical indicator so that you know which ones to double-click on versus opening in diagram view!

Part 1 - Gathering Custom Performance Counters in OpsMgr

Part 2 - How to create a free disk space report

Part 3 - How to create a processor utilization report for a group of servers

Part 4 - How to create a custom performance counters report for a group of servers

Part 5 - How to make my custom report publicly available

Part 6 - How to schedule my custom report for delivery

Now that we have created our own custom reports it may be useful to schedule them for delivery either to a file share or via email delivery.

How to schedule my custom report for delivery

Scheduling to deliver to a file share:

How do we schedule reports for delivery in OpsMgr? As an example we will show for the built-in report “Most Common Alerts” how it can be scheduled to create a report on a file share and how to then we’ll discuss how to email the report. To schedule this to be created on a file share take the following steps:

1. Prior to running the report create a share (preferably on the reporting server) which allows the user to create files on it, and other users to read the contents of the directory. For our example this is \\reportserver\reports.

2. Run the Most Common Alerts report, go to File / Schedule.

3. For the description we will label it with the name of the report and parameter information which is important to the report. For this example: Most Common Alerts per Week.

4. Under delivery method there should be at least: Report Server File Share, Null Delivery Provider. Choose the Report Server File Share option.

5. On the new fields available on the delivery setting screen specify the name of the file (with an extension), the path to the share, the format to render it in and the user account (with domain) and password to write to the share.

6. Next we create a schedule for when the report runs. In this example we are running it once a week every Monday at 5:02 am.

7. When we created the schedule what actually makes it run? In the SQL Server Agent a new job is created that runs the scheduled report that you created. By default notifications are written to the application event log if the job fails.

8. Next we set the parameters for how the report runs as shown. When generating scheduled reports it is often useful to use the advanced option and specify how many days back the report returns data from (7 days in this case).

9. So how do we know that subscriptions that we have? In Operations Manager console / Reporting / Scheduled Reports. From this screen you can open, edit or cancel the various schedules. If there are issues which occurred when the subscription ran they also will appear on this page.

10. Once the job runs there should be a file in the directory which you specified (\\reportserver\reports in this example).

Scheduling to deliver via email:

So now that we have delivered a report to a file share, how do we deliver via email?

1. To deliver via email a configuration on the reporting server needs to be done.

2. For this example configure a daily email on the “Most Common Alerts” report. With the E-Mail option available now on the list (Report Server E-Mail) configure it with a description and a delivery method.

3. Next for the delivery method we specify who we are going to email it to and then when we want it to occur (once, hourly, daily, weekly or monthly).

4. Set the parameters to yesterday and finish. Set the scheduled report to run in a couple of minutes and validate that it works.

5. To check on the status of this report go back to the reporting section and choose the option to “View Scheduled Reports”.

6. To get it to deliver and be the most readable, the PDF format is recommended when sending the report via email.

7. In the final email, a link to the report is also included so the report can be directly accessed via the reporting server.

More advanced scheduling:

We have used the scheduled email delivery approach to take our own custom reports on processor utilization and have them send an email daily to the server owners so that they can track processor utilization on their systems daily.

We have also used the scheduled email delivery to run on a Sunday morning, for a period of “today –7” through “Yesterday” to cover a Sunday through Saturday server usage report (see below). These reports were generated in word files so that sections could be cut and pasted as inserts into a weekly product team status report.

Summary:

This series has brought us through the steps to gather our own performance counters, create reports for groups of servers, and deliver them both via a URL for ad-hoc and via scheduled deployments. I hope that this series has shown that the OpsMgr reporting functionality while not as intuitive as I would like it to be is extremely powerful and flexible .

Part 1 - Gathering Custom Performance Counters in OpsMgr

Part 2 - How to create a free disk space report

Part 3 - How to create a processor utilization report for a group of servers

Part 4 - How to create a custom performance counters report for a group of servers

Part 5 - How to make my custom report publicly available

Part 6 - How to schedule my custom report for delivery

Now that we have created our own custom reports it may be useful to provide them within the URL which is available for reporting. 

How to make my custom report publicly available via the reporting URL

1. Open Internet Explorer, and open the SQL Server Reporting Services (SSRS) homepage by entering the following URL: |localhost>/reports">http://|localhost>/reports

2. On the SQL Server Reporting Services Home page, click New Folder.

3. If the folder does not exist on the top level page, fill in a Name and a Description for the new folder and then click OK.

4. Back on the Home page, select the My Reports folder and on the My Reports page, click your published report to run the report (if you do not see your reports here, go back to the earlier steps and make sure that you published them in addition to putting them into your favorites).

5. In the report results page, select Properties.

6. On the General page, click Move and then select the custom folder that you previously created. Click OK. Click Home to go back to the Home page.

7. On the Home page, click the My Reports folder and press Ok to move the report.

8. Open the Operations Manager reporting website and verify the new report exists as it is expected to.

9. The report is displayed in the results pane, and is now available to all users with appropriate reporting access in Operations Manager.

For larger organizations it may be useful to create subfolders on a per-team basis so that all of the team’s reports are in the same folder. This approach provides as easy way for users of Operations Manager to open reports without having to access the console. Through providing the reports via a URL all the user needs is a web browser to access their own custom reports. Reports can also be added into management packs within the Operations Manager console to make them available both within the reporting URL and within the Operations Manager console / Reporting section. I prefer the above approach as I have seen issues with attempting to get some of my reports to add correctly via the add to management pack functionality.

In the next part of this series we will discuss how to schedule custom reports for delivery!

Part 1 - Gathering Custom Performance Counters in OpsMgr

Part 2 - How to create a free disk space report

Part 3 - How to create a processor utilization report for a group of servers

Part 4 - How to create a custom performance counters report for a group of servers

Part 5 - How to make my custom report publicly available

Part 6 - How to schedule my custom report for delivery

How to create a custom performance counters report for a group of servers

The easy approach is not to use a report for this, but rather to use the Operations Console directly to provide a graph. To do this we create a custom folder on in OpsMgr and store it in the management pack which we have used to generate our reports.

Inside of this view we create a new Performance View.

For the performance view we limit it to our custom group, and only to show information collected by the specific rules which we created.

The result is an easy to use view which will provide access to the values for these performance counters over the last 7 days (the default data retention period for the Operations Manager database performance metrics).

The second option is to create a report to provide the custom performance counter information. This can be done through creating a simple custom report using the following steps:

1. In the Operations Console open Reports / Microsoft Generic Report Library / Performance

1. Double-click on the Performance report
2. Set the date to Yesterday as a starting Date
3. Click Change to configure the report
4. Click on the New Chart button

1. Add a name for the chart in the chart title (ASP.Net counters in this example).
2. Add a new Series.

1. Click the Add Object button
2. Type in C: for the field next to Object Group.
3. Add the first server off of the list and click Ok.

1. Click New Series
2. Click on the Add Object
3. Object contains the name of the next server.
4. Add the next server off of the list and ok.
5. Repeat steps 11-14 until all servers / counters required for the report are added.
6. Click on the first of the series shown in the chart and click on the Browse button under Rule.
7. Choose Search by Name (since we know the name of the management pack)
8. Enter the management pack name we used to store our custom rules.

1. And press Ok.
2. Perform the same action for the remaining counters. Click Ok when completed.

1. Click the Run button to run the report.

Now we have create a custom view and custom report for our custom gathered counters! The last three examples have shown how these reports can be created, but without making the reports available to others their benefit is limited. In the next two parts of this series we will discuss how to make a custom report available via the reporting URL and how to schedule custom reports for delivery.

Part 1 - Gathering Custom Performance Counters in OpsMgr

Part 2 - How to create a free disk space report

Part 3 - How to create a processor utilization report for a group of servers

Part 4 - How to create a custom performance counters report for a group of servers

Part 5 - How to make my custom report publicly available

Part 6 - How to schedule my custom report for delivery

How to create a report for processor utilization for a group of servers

The easy approach is not to use a report for this, but rather to use the Operations Console directly to provide a graph. This can be done through the Operations Console / Monitoring / Microsoft Windows Server / Processor Performance. This view also allows you to specify how long the graph should show data through clicking on the Select Time Range option. This option is the best option if the data required exists within the last 7 days (the default data retention period for the Operations Manager database performance metrics). A customized version of this view (restricted to the specific servers the group is interested in) can be added into a customized view which we discuss in this blog series.

OpsMgr Free Disk Space Report – Disk Capacity Reporting

This view also allows you to specify how long the graph should show data through clicking on the Select Time Range option.

The second option is to create a report to provide process utilization information. This can be done through creating a simple custom report using the following steps:

1. In the Operations Console open Reports / Microsoft Generic Report Library / Performance

2. Double-click on the Performance report

3. Set the date to Yesterday as a starting Date

4. Click Change to configure the report

5. Click on the New Chart button

6. Add a name for the chart in the chart title (Processor Utilization in this example).

7. Add a new Series.

8. Click the Add Group button (NOT object or there will be no data shown in the report later)

9. Type in the server name (Hydra in this case) for the field next to Object Name.

10. Add the first server off of the list and click Ok.

11. Click New Series

12. Click on the Add Group (NOT object or there will be no data shown in the report later)

13. Object contains the name of the server

14. Add the next server off of the list and ok.

15. Repeat steps 11-14 until all servers / drives required for the report are added.

16. Click on the first of the series shown in the chart and click on the Browse button under Rule.

17. Choose Search by Counter.

18. Choose the Performance object of Processor.

19. Add % Processor Time

20. And press Ok.

21. Perform the same action for the remaining counters. Click Ok when completed.

22. Click the Run button to run the report and verify that you are receiving data on each of the lines identified for the report.

We have now gone through the process to create a custom report for two standard sets of counters: Free disk space, and processor utilization. In the next part of this series we will create a custom report based upon the custom performance counters which we created at the start of this blog series.

Part 1 - Gathering Custom Performance Counters in OpsMgr

Part 2 - How to create a free disk space report

Part 3 - How to create a processor utilization report for a group of servers

Part 4 - How to create a custom performance counters report for a group of servers

Part 5 - How to make my custom report publicly available

Part 6 - How to schedule my custom report for delivery

This blog post was originally created on OpsMgr 2007 and has been changed with new graphics to reflect R2.

How to create a simple free disk space report

The easy approach is not to use a report for this, but rather to use the Operations Console directly to provide a graph. This can be done through the Operations Console / Monitoring / Microsoft Windows Server / Performance Disk Capacity. This view also allows you to specify how long the graph should show data through clicking on the Select Time Range option. This option is the best option if the data required exists within the last 7 days (the default data retention period for the Operations Manager database performance metrics). A customized version of this view (restricted to the specific servers the group is interested in) can be added into a customized view which we discuss in this blog series.

OpsMgr Free Disk Space Report – Disk Capacity Reporting

This view also allows you to specify how long the graph should show data through clicking on the Select Time Range option.

The second option is to create a report to provide disk free space information. This can be done through creating a simple custom report using the following steps:

1. In the Operations Console open Reports / Microsoft Generic Report Library / Performance

1. Double-click on the Performance report
2. Set the date to Yesterday as a starting Date
3. Click Change to configure the report
4. Click on the New Chart button

1. Add a name for the chart in the chart title (Disk Space Report in this example).
2. Add a new Series.

1. Click the Add Object button
2. Type in C: for the field next to Object Name.
3. Add the first server off of the list and click Ok.

1. Click New Series
2. Click on the Add Object
3. Object contains C: (or D: or E: etc)
4. Add the next server off of the list and ok.
5. Repeat steps 11-14 until all servers / drives required for the report are added.
6. Click on the first of the three series shown in the chart and click on the Browse button under Rule.
7. Choose Search by Counter.
8. Choose the Performance object of LogicalDisk.
9. Choose the Counter % Free Space and Search.
10. Add % Logical Disk Free Space.

1. And press Ok.
2. Perform the same action for the remaining counters. Click Ok when completed.

1. Click the Run button to run the report.

In the next part of this blog series we will apply this same concept to another commonly asked request – how to create a simple processor utilization report for a group of servers.

Part 1 - Gathering Custom Performance Counters in OpsMgr

Part 2 - How to create a free disk space report

Part 3 - How to create a processor utilization report for a group of servers

Part 4 - How to create a custom performance counters report for a group of servers

Part 5 - How to make my custom report publicly available

Part 6 - How to schedule my custom report for delivery

Part 1 – Gathering your own performance counters for later use in Operations Manager reporting.

How to gather my own custom performance counters for use in reports

1. In the Operations Manager console / Authoring / Management Pack Objects / Rules section, create a rule of type Collection Rules / Performance Based / Windows Performance and store it in the appropriate management pack (not the default management pack).

2. Provide a rule name and description which will be easy to locate and include the company name such as “Odyssey Web Counter” (preferably include something about what type of a web counter such as “Odyssey Web Counter for Request Execution Time”. Set the rule category to “Performance Collection”. Set the rule target to “Windows Server Operating System” and disable the rule.

3. Browse to the remote computer and identify the appropriate performance counter, object and instance. Set the appropriate interval to sample the counter (15 minutes is the default).

4. Choose the appropriate optimization for your rule (for details on what optimization is see http://technet.microsoft.com/en-us/library/ff730695.aspx) and create the rule.

5. Create an override to enable the rule for the group which require I (to find the rule, type in the name of the rule or the name of the management pack that your stored the rule in within the “look for” field).

6. In the Operations Manager console / Monitoring / Windows Computers. Find a computer from the group right-click and open the performance view.

7. Use the “Items by text search” option and search on the performance counter name (initially nothing should appear).

8. Wait until you can find the performance counter from the computer which it was created on (this may take a little while depending upon when the override was created to enable the rule and how frequently the rule was configured to sample the performance counter – in my environment I set it to sample every 5 minutes and it appeared as a counter in about 10 minutes).

9. Check the option to show the performance counter and soon after the next sample interval it should begin displaying data. Verify the performance is being retrieved over time (which is slightly more fun than watching paint dry – but that may vary depending upon how much ventilation you have in the area when painting).

This same process can be repeated multiple times to gather multiple performance counters which are used in later custom reports. In the next blog article we will revisit a topic I wrote on a while back: How to create a simple free disk space report – which I will post as a version revised for OpsMgr R2.

Behind the scenes these are still monitors and/or rules which are built by the template. So the approach to change this behavior which was used was to create an override for the monitor. There were multiple ways to create this override but the easiest which we found was to open the Operations Manager console / Monitoring / Windows Service and Process Monitoring / Windows Service State and find an example of a service which was currently being monitored (IE: If I create a service monitoring Telephony and target it to group1, if there is an instance of the Telephony service in group1 it will appear in this view). Once we find this service we right-click on it and open health explorer.

Within health explorer browse under Availability / Service Running State. Right-click and open Monitor Properties. Choose the Overrides tab.

Create an override “For all objects of class: (service name)” for all of the service or process monitors or choose “For the object: Print Spooler” to override the service or process on a specific system.

The overrides can be set as shown below (stored in the management pack that the service or process monitor was created within).

Now since these are created through generation of additional monitors and rules behind the scenes we can go to the rules and monitors and edit them directly if we prefer. For the example we discussed above we are monitoring the “Print Spooler” service. We could also just export the management pack and find what we had built in it through hacking XML but that doesn’t really sound like fun right now. So if we open the Operations Console / Authoring / Management Pack Objects / Monitors and we start by searching on the name of our windows service “Print Spooler” – nada (no results found). However, if we search on “Service Running State” (which we found during our override work above) – now we’re getting somewhere:

The first “Service Running State” is part of a sealed management pack so we can’t edit it. But the second is part of the management pack that we stored our service monitor in so we can edit settings on that including priority and severity as shown below.

If we change our monitor view and filter instead on the name of our management pack, we can see all of the monitors involved in that management pack:

So now we see that we have two additional monitors since when the service monitor was created I chose the option to notify on CPU and memory thresholds. These are also stored in my management pack so I can edit these if I want to also (such as changing the health state from critical to warning or changing the priority or severity for the CPU and memory monitors). Shown below is a change from the default configuration where the CPU Usage Monitor sets the state to warning instead of critical.

So what about rules? After searching on the name of the management pack (and manually verifying through the exported XML file for the management pack) it appears that the windows service template does not generate any. Just to clean things up, at this point I deleted the Print Spooler monitor so it will not clutter up our searches through the monitors and rules.

So we have found what rules (none) and monitors were created from a Windows Service Monitor Template, what about a Process Monitor Template? Next we create a process monitor to watch how many instances of notepad are running on a system and we enable alerting based upon CPU and memory like we did with the windows service template.

Searching the monitors for our management pack we find:

There are multiple monitors for the process which we are monitoring. The first is enabled because we are counting processes (instead of determining how long it is running or whether an unwanted process is running). We also have the same performance related counters for CPU and Memory that we have with our service monitor. These are also stored in our custom management pack so we can edit the settings within them. We can change the health state from critical to warning, change alerting including priority and severity, add diagnostics/recoveries and such.

Searching through the rules we find that the process monitoring template does create rules as shown below:

One collects the memory usage and one the CPU usage. These are also stored in our management pack so we can edit things such as the interval that performance counters are collected. These rules can also be altered through using overrides.

Summary: Since the Windows Service Template and the Process Monitoring template create rules and monitors in the unsealed management pack that we specify when we create the service or process, we can locate the underlying rules and monitors and edit them (as long as they are in the unsealed management pack) or we can alter their default behavior through creating overrides.