XPath passed incorrectly
Home  » Forums  » XPath passed incorrectly

XPath passed incorrectly
Posted: Tue, Nov 17, 2009 8:44 AM :: Rank: 0
Author
Points: 994
Level: System Center Hero

Hi there, I think I've found a bug in MP when passing xpath from performance monitor. These are snippets from my mp:

 

 

<UnitMonitor ID="Monitorowanie.Windows.OS.CzasPrzerwan" Accessibility="Internal" Enabled="true" Target="Server!Microsoft.Windows.Server.Processor" ParentMonitorID="Health!System.Health.PerformanceState" Remotable="true" Priority="Normal" TypeID="Performance!System.Performance.ConsecutiveSamplesThreshold" ConfirmDelivery="false">
        <Category>PerformanceHealth</Category>
        <AlertSettings AlertMessage="BRE.Monitorowanie.Windows.OS.CzasPrzerwan_AlertMessageResourceID">
          <AlertOnState>Error</AlertOnState>
          <AutoResolve>true</AutoResolve>
          <AlertPriority>Normal</AlertPriority>
          <AlertSeverity>Error</AlertSeverity>
          <AlertParameters>
            <AlertParameter1>$Data/Context/InstanceName$</AlertParameter1>
            <AlertParameter2>$Data/Context/Value$</AlertParameter2>
            <AlertParameter3>$Target/Host/Property[Type="MicrosoftWindowsLibrary6062780!Microsoft.Windows.Computer"]/NetworkName$</AlertParameter3>
          </AlertParameters>
        </AlertSettings>
        <OperationalStates>
          <OperationalState ID="ConditionFalse" MonitorTypeStateID="ConditionFalse" HealthState="Success" />
          <OperationalState ID="ConditionTrue" MonitorTypeStateID="ConditionTrue" HealthState="Error" />
        </OperationalStates>
        <Configuration>
          <ComputerName>$Target/Host/Property[Type="MicrosoftWindowsLibrary6062780!Microsoft.Windows.Computer"]/NetworkName$</ComputerName>
          <CounterName>% Interrupt Time</CounterName>
          <ObjectName>Processor</ObjectName>
          <InstanceName>$Target/Property[Type="Server!Microsoft.Windows.Server.Processor"]/PerfmonInstance$</InstanceName>
          <AllInstances>false</AllInstances>
          <Frequency>60</Frequency>
          <Threshold>10</Threshold>
          <Direction>greater</Direction>
          <NumSamples>5</NumSamples>
        </Configuration>
      </UnitMonitor>

 

 

        <DisplayString ElementID="Monitorowanie.Windows.OS.CzasPrzerwan_AlertMessageResourceID">
          <Name>Processor Interrupt Time Performance</Name>
          <Description>Ilosc przerwan procesora {0} przekroczyla dopuszczalna norme i wynosi  {1}. Mozliwa awaria sprzetu na serwerze {2}, ktora zglasza przerwania do procesora.</Description>
        </DisplayString>

 


Alert Description
  
Ilosc przerwan procesora 2 przekroczyla dopuszczalna norme i wynosi 5. Mozliwa awaria sprzetu na serwerze war01elearning.ebre.pl, ktora zglasza przerwania do procesora.
 

 

 

 

 

So as you see I'm passing $Data/Context/Value$ but instead it's passing value 5 from <NumSamples>5</NumSamples>. What's going on? :/

Reply  
Report Abuse
RE: XPath passed incorrectly
Posted: Tue, Nov 17, 2009 8:53 PM :: Rank: 0
Author
Points: 25175
Level: System Center Expert

Correct. This is actually  a known issue discovered in the original OpsMgr 2007 RTM release in 2007 and logged as a bug on the Connect. The consecutive threshold monitor does return the number of samples instead of the counter value when you submit the correct XPath.

This problem will be resolved in OpsMgr v.Next.

Accepted Answer
Reply  
Report Abuse
Re: XPath passed incorrectly
Posted: Wed, Nov 18, 2009 11:59 AM :: Rank: 0
Author
Points: 994
Level: System Center Hero
So what's the proper xpath to put?
Reply  
Report Abuse
Re: XPath passed incorrectly
Posted: Wed, Nov 18, 2009 12:38 PM :: Rank: 0
Author
Points: 25175
Level: System Center Expert
Thats just it. Last I spoke with someone it was simply broken. There is no alternate XPath last I checked...and no fix planned until next release
Reply  
Report Abuse
Re: XPath passed incorrectly
Posted: Wed, Nov 18, 2009 2:10 PM :: Rank: 0
Author
Points: 10134
Level: System Center Expert
So this one is completely useless? Bummer...
Reply  
Report Abuse
Re: XPath passed incorrectly
Posted: Wed, Nov 18, 2009 4:03 PM :: Rank: 0
Author
Points: 25175
Level: System Center Expert
The recurring threshold Monitor is functional, you just can't pass current counter value in the alert description. After finding no workaround in my own testing, I did also poke around the MS MPs, and noticed authors using more generic alert descriptions when using this monitor.
Reply  
Report Abuse
Re: XPath passed incorrectly
Posted: Thu, Nov 19, 2009 4:25 AM :: Rank: 0
Author
Points: 10134
Level: System Center Expert
Ok, my fault, I misunderstood that.



I hope the threshold and number of samples is passed correctly. This way one could build an alert description containing these values to provide at least basic information about the configuration of the monitor...
Reply  
Report Abuse
RE: XPath passed incorrectly
Posted: Thu, Nov 19, 2009 10:27 AM :: Rank: 0
Author
Points: 25175
Level: System Center Expert

 Stefan / Oskar, that is exactly what is so confusing, but maybe here is a place we can look to for the answer and worth

The recurring threshold monitor correctly detects threshold breach over user-defined number of samples. It is the XPath to pass the threshold to alert description that is the issue. The XPath for threshold returns the number of samples. How the monitor works as desired while this does not is a bit of a mystery to me.

When I look at the Exchange 2007 for OpsMgr 2007 R2 only, there are some monitors that demonstrate how to provide this functionality. They do pass the values appopropriately and there are several examples in this MP.

If we look at the unit monitor "Mailbox Messages Queued for Submission Monitor", it is a recurring threshold monitor and is implemented with the "Performance Filtered Consecutive Samples Threshold Monitor Type".

  <AlertParameter2>$Data/Context/Value$</AlertParameter2> <AlertParameter3>$Data/Context/SampleValue$</AlertParameter3> 

Perhaps Oskar can give this a try?

 

 

Accepted Answer
Reply  
Report Abuse
RE: XPath passed incorrectly
Posted: Fri, Nov 20, 2009 8:55 PM :: Rank: 0
Author
Points: 1330
Level: System Center Specialist

Pete,

let's give it a try ;-)

Let's put on a swimsuit and dive into the world of pure scom which is pure xml and beyond....;-) 

I have reviewed the monitors in the first example . Did some testing and run them through the workflow analyzer.

First, if i understand correctly this is what the monitor is supposed to do:

Collect performance data and if performance data is above threshold increase counter by 1.

Do this for x samples and when counter is above another Threshold generate alert.

  

The monitor polls

Performance Data

for system.performance.data which results in :

Recieved DataItem
<DataItem type="System.Performance.Data" time="2009-11-20T09:59:27.6569446+01:00" sourceHealthServiceId="6C36955A-347C-8ADC-ED3B-E4F4DEC0D0A0">
<TimeSampled>2009-11-20T09:59:27.0000000+01:00</TimeSampled>
<ObjectName>Processor</ObjectName>
<CounterName>% Interrupt Time</CounterName>
<InstanceName>0</InstanceName>
<IsNull Type="Boolean">false</IsNull>
<Value>3.51950454711914</Value> <---------- The value
</DataItem>

Next is the System Performance.ConsecutiveSamplesData

This where the confusion starts (i think)

Recieved DataItem <DataItem type="System.Performance.ConsecutiveSamplesData" time="2009-11-20T09:59:27.6569446+01:00" sourceHealthServiceId="6C36955A-347C-8ADC-ED3B-E4F4DEC0D0A0">
<TimeSampled>2009-11-20T09:59:27.0000000+01:00</TimeSampled>
<ObjectName>Processor</ObjectName>
<CounterName>% Interrupt Time</CounterName>
<InstanceName>0</InstanceName>
<IsNull Type="Boolean">false</IsNull>
<Value>3</Value> <----------- This is the counter increasing everytime the threshold is exceeded
<SampleValue>3.51950454711914</SampleValue> <----------Notice now the Value has changed to SampleValue $Data/Context/SampleValue$
</DataItem>

Next the <Value>3</Value> is passed to 2 Expressions:

<ValueExpression>
<XPathQuery Type='Double'>Value</XPathQuery>
</ValeuExpression>
<Operator>LESS</Operator>
<ValueExpression>
<ValueType='Double'>5</Value><----------This is the value which you are presenting when using $Data/Context/Value$
</ValueExpression>
Resolves To:
3
LESS
5
using Compare Type Double
RESULT=MATCH
 
<ValueExpression>
<XPathQuery Type='Double'>Value</XPathQuery>
</ValeuExpression>
<Operator>GREATER_EQUAL</Operator>
<ValueExpression>
<ValueType='Double'>5</Value><----------This is the value which you are presenting when using $Data/Context/Value$
</ValueExpression>
Resolves To:
3
GREATER_EQUAL
5
using Compare Type Double
RESULT=MATCH
 

 

Okay now this monitor is a bit confusing because when you look at it's setting in the console it looks like you are only declaring how many counters should be evaluated, but according to the results of the workflow this is also the value of how many times the counters may arise above the first threshold of 1.

The monitor is working because the data being evaluated by the value expression doesn't make a difference they are both value's.

The thing which is confusing is when you are designing a MP based on this monitor and want to generate an alert is when you run into trouble and should use the alternate value like they did in the Exchange MP.

Simplest way for MS to resolve this issue is redesign System Performance.ConsecutiveSamplesData in the system.performance.library.mp and switch them ;-)

Another thing I just found out .....there is a spelling error in the Workflow analyzer recieved instead of received as well ;-)

 

regards,

 

Accepted Answer
Reply  
Report Abuse
Re: XPath passed incorrectly
Posted: Sat, Nov 21, 2009 7:26 AM :: Rank: 0
Author
Points: 10134
Level: System Center Expert
Hi Oskar,

first of all: great job on debugging this - and sharing your findings with us.

Secondly, are you saying that changing $Data/Context/Value$ to $Data/Context/SampleValue$ in the alert description will put the last sampled value in the alert description?



cheers,

Stefan
Reply  
Report Abuse
Re: XPath passed incorrectly
Posted: Sat, Nov 21, 2009 2:35 PM :: Rank: 0
Author
Points: 1330
Level: System Center Specialist
Thanks Stefan!



Yes if you put the $Data/Context/SampleValue$ in your alert description it should show you the last sampled vale.

Reply  
Report Abuse
Re: XPath passed incorrectly
Posted: Sat, Nov 21, 2009 7:46 PM :: Rank: 0
Author
Points: 19054
Level: System Center Expert
That's what they seem to be doing in the Exchange MP. Have we tried this with the off-the-shelf recurring threshold monitor to test for success? It it works, this would be blogworthy.
Reply  
Report Abuse
Re: XPath passed incorrectly
Posted: Mon, Nov 23, 2009 4:16 AM :: Rank: 0
Author
Points: 1330
Level: System Center Specialist
Tommy,



Yes I havetested this in the original Base OS MP and did create a custom rule which used the threshold monitor and in both cases the $Data/Context/SampleValue$ gives the correct result.







Reply  
Report Abuse
Re: XPath passed incorrectly
Posted: Mon, Nov 23, 2009 4:38 AM :: Rank: 0
Author
Points: 1330
Level: System Center Specialist
Will write a blog entry later on with my findings e.d.
Reply  
Report Abuse
Re: XPath passed incorrectly
Posted: Tue, Nov 24, 2009 4:19 AM :: Rank: 1
Author
Points: 994
Level: System Center Hero

<?xml version="1.0" encoding="utf-8"?><ManagementPack ContentReadable="true" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsl="http://www.w3.org/1999/XSL/Transform">
  <Manifest>
    <Identity>
      <ID>SCMPWithConsecutiveSamples</ID>
      <Version>1.0.0.0</Version>
    </Identity>
    <Name>SC-MPWithConsecutiveSamples</Name>
    <References>
      <Reference Alias="SystemCenter">
        <ID>Microsoft.SystemCenter.Library</ID>
        <Version>6.0.6278.0</Version>
        <PublicKeyToken>31bf3856ad364e35</PublicKeyToken>
      </Reference>
      <Reference Alias="MicrosoftWindowsLibrary6062780">
        <ID>Microsoft.Windows.Library</ID>
        <Version>6.0.6278.0</Version>
        <PublicKeyToken>31bf3856ad364e35</PublicKeyToken>
      </Reference>
      <Reference Alias="Health">
        <ID>System.Health.Library</ID>
        <Version>6.0.6278.0</Version>
        <PublicKeyToken>31bf3856ad364e35</PublicKeyToken>
      </Reference>
      <Reference Alias="Performance">
        <ID>System.Performance.Library</ID>
        <Version>6.0.6278.0</Version>
        <PublicKeyToken>31bf3856ad364e35</PublicKeyToken>
      </Reference>
    </References>
  </Manifest>
  <Monitoring>
    <Monitors>
      <UnitMonitor ID="MonitorForTesting" Accessibility="Public" Enabled="true" Target="SystemCenter!Microsoft.SystemCenter.ManagementServer" ParentMonitorID="Health!System.Health.PerformanceState" Remotable="true" Priority="Normal" TypeID="Performance!System.Performance.ConsecutiveSamplesThreshold" ConfirmDelivery="false">
        <Category>Custom</Category>
        <AlertSettings AlertMessage="MonitorForTesting_AlertMessageResourceID">
          <AlertOnState>Error</AlertOnState>
          <AutoResolve>true</AutoResolve>
          <AlertPriority>Normal</AlertPriority>
          <AlertSeverity>Error</AlertSeverity>
          <AlertParameters>
            <AlertParameter1>$Data/Context/SampleValue$</AlertParameter1>
            <AlertParameter2>$Data/Context/Value$</AlertParameter2>
          </AlertParameters>
        </AlertSettings>
        <OperationalStates>
          <OperationalState ID="TestMonitorFalse" MonitorTypeStateID="ConditionFalse" HealthState="Success" />
          <OperationalState ID="TestMonitorTrue" MonitorTypeStateID="ConditionTrue" HealthState="Error" />
        </OperationalStates>
        <Configuration>
          <ComputerName>$Target/Host/Property[Type="MicrosoftWindowsLibrary6062780!Microsoft.Windows.Computer"]/NetworkName$</ComputerName>
          <CounterName>Current Disk Queue Length</CounterName>
          <ObjectName>PhysicalDisk</ObjectName>
          <InstanceName>_Total</InstanceName>
          <AllInstances>false</AllInstances>
          <Frequency>30</Frequency>
          <Threshold>0</Threshold>
          <Direction>greaterequal</Direction>
          <NumSamples>3</NumSamples>
        </Configuration>
      </UnitMonitor>
    </Monitors>
  </Monitoring>
  <Presentation>
    <Folders>
      <Folder ID="FolderForTestMonitor" Accessibility="Public" ParentFolder="SystemCenter!Microsoft.SystemCenter.Monitoring.ViewFolder.Root" />
    </Folders>
    <StringResources>
      <StringResource ID="MonitorForTesting_AlertMessageResourceID" />
    </StringResources>
  </Presentation>
  <LanguagePacks>
    <LanguagePack ID="ENU" IsDefault="false">
      <DisplayStrings>
        <DisplayString ElementID="SCMPWithConsecutiveSamples">
          <Name>SC-MPWithConsecutiveSamples</Name>
        </DisplayString>
        <DisplayString ElementID="FolderForTestMonitor">
          <Name>SC-MPWithConsecutiveSamples</Name>
        </DisplayString>
        <DisplayString ElementID="MonitorForTesting">
          <Name>Disk Usage Monitor - Consecutive Samples</Name>
          <Description />
        </DisplayString>
        <DisplayString ElementID="MonitorForTesting" SubElementID="TestMonitorFalse">
          <Name>Condition False</Name>
        </DisplayString>
        <DisplayString ElementID="MonitorForTesting" SubElementID="TestMonitorTrue">
          <Name>Condition True</Name>
        </DisplayString>
        <DisplayString ElementID="MonitorForTesting_AlertMessageResourceID">
          <Name>Disk Usage Monitor - Consecutive Samples</Name>
          <Description>SampleValue: {0}, Value: {1}</Description>
        </DisplayString>
      </DisplayStrings>
    </LanguagePack>
  </LanguagePacks>
</ManagementPack>

Reply  
Report Abuse
Re: XPath passed incorrectly
Posted: Tue, Nov 24, 2009 4:21 AM :: Rank: 0
Author
Points: 994
Level: System Center Hero
The above doesn't work. Still SampleValue is passed blank.
Reply  
Report Abuse
Re: XPath passed incorrectly
Posted: Tue, Nov 24, 2009 5:16 AM :: Rank: 0
Author
Points: 1330
Level: System Center Specialist

Rem,



I noticed your message. This is caused by the version of System.Performance.Library

Sorry missed that....

In the version 6.1.7221.0 they seem to have fixed it (partly). I will have to test with your version...

to be continued.....



 

Reply  
Report Abuse
Re: XPath passed incorrectly
Posted: Fri, Nov 27, 2009 7:28 AM :: Rank: 1
Author
Points: 994
Level: System Center Hero
Any new ideas, Oskar?
Reply  
Report Abuse
RE: XPath passed incorrectly
Posted: Thu, Dec 03, 2009 4:51 PM :: Rank: 0
Author
Points: 1330
Level: System Center Specialist

Rem,

sorry for not getting back earlier but I have tested the solution and you are correct it fails on the SP1 version.
I did test it again with both versions and it fails specifically on SP1 agents.

Why it is failing only on SP1 agents only is a bit of a mistery to me because my first assumption was the base monitor was causing this error.
But further testing learned it is agent specific as I explained in my blog post.

To go short it is not possible, as far as I know when you are using SP1 to be able to put the sampled value in the description. You will need to upgrade to R2 in order for it to work.

Regards,

Accepted Answer
Reply  
Report Abuse
Re: XPath passed incorrectly
Posted: Sun, Dec 06, 2009 4:51 AM :: Rank: 1
Author
Points: 994
Level: System Center Hero
So I did Average Monitor instead. My SCOM admin is suited with it so I won't bother anymore :)



As for R2 movement - unless SCOM R2 won't have any probe for Netcool/OMNIBUS, we won't move to R2. If MS would do such one, that would be perfect but for now we have to wait for official IBM one.
Reply  
Report Abuse

Home  » Forums  » XPath passed incorrectly
Tag Cloud
Quick Links
Top Contributors
Pete Zerger
Points: 25175
Level: System Center Expert
Simon Skinner
Points: 20243
Level: System Center Expert
Tommy Gunn
Points: 19054
Level: System Center Expert
MadHatter
Points: 11573
Level: System Center Expert
Stefan Koell
Points: 10134
Level: System Center Expert