How to Audit and Alert Server Restarts with SCOM 2019 (2012/16)

Often IT admins suffer from small to big outages due to unscheduled patches, failures, power, or someone mistakenly restarting a server in the middle of the workday without notifying anyone. I've created this "How to Guide" to help you set up this in your SCOM environment.

1. On your SCOM Console, navigate to authoring and create a new Rule

2. Fill in the Rule Name and Description, select Rule Category (Alert), rule Target (Windows Computer) and make sure Rule is enabled is checked.

3. Event Log Type System

4. Build Event Expression insert Event ID and Source

5. Insert values where Event ID = 1074 and Event Source = User32.

6. Set Alert Priority and Severity to fit your needs then Finish and Close

7. Overview of your recently configured rule on the Squared Up HTML5 Console

That's it, you will now start tracking those restarts. 

Thanks for reading, please share and subscribe.

SCOM 2019 UR1 - Simplified Patching Finally Arrived! 

Microsoft has released Update Roll Up 1 for SCOM 2019 and it comes with some great fixes and additions that will ease the upgrade process in your current environment. 

One-Click Patching coming for SCOM 2019 Update Rollup 1 (UR1) 

How to connect Operations Manager 2019 (SCOM) to Azure Log Analytics (AKA OMS) in 4 simple steps

Monitoring is a Key element in your IT infrastructure.  System Center a d Azure Cloud offers some phenomenal advantages when properly integrated. Connecting you on-premises SCOM environment to your Azure Log Analytics enhances monitoring while utilizing advanced analytics and machine learning which help identify issues and automatically respond to alerts. Hybrids environments certainly help that next level of productivity and even more when two exceptional platforms are integrated. SCOM +Azure Log Analytics helps to improve your operational workflows on your infrastructure.

Architecture Overview


Requirements:
1. Have your SCOM environment to be allowed to connect to 443 port over the internet.
2. An Active Azure subscription (This could be a trial one)
3. Admin Credentials to your Azure environment. 
More details at Microsoft Docs

Step by Step

1. Register or Connect to Azure Log Analytics

2. Sign in to your Microsoft Azure Account

3. Select Azure Log Analytics Workspace

4. Review and Create and after a couple of minutes, your workspace will be configured.

How to configure SCOM HTML Notification Alerts from Orchestrator 2012/16 Step by Step

This post is another great option that could be quite effective when you are notifying your engineers/application owners. This type of email formatting will allow them to easily read and take appropriate actions to correct the reported issues instead of trying to translate a very complicated and non organized text.

Before you start

• Make sure you have the SCOM Orchestrator integration pack installed and configured.
• Make sure your credentials and Orchestrator have access to your SCOM environment.

Creating the Runbook

On Orchestrator Runbook Designer Console, create a new Runbook and add the following activities;

• Monitoring Alerts
• Email Activity

On the SCOM Alert Monitoring Activity, add Title, SCOM connection, the trigger for New alerts and your needed filters.
Note: If you are looking for a closed alert email then you will need to select the Updated alerts trigger and status closed.

On the Send Email Activity, set the Title and Message Format to HTML.

On the Details Page Subject section, set your Subject details and subscribe to your monitoring data so you can dynamically display the alert name/instance.

On the Details Page Recipients section, set the email accounts that will be receiving this notification.

On the Details Page Message section, copy and paste the HTML formatted code you’re your published data IDs.

While working with your message you can also expand to have a better view of the HTML code.

Review your code and test with Notepad++ or Visual Studio then proceed to configure your SMTP/email channel.

On the published data you can add the needed fields to the message section select them all, copy and paste them into a notepad to get the actual ID which its way easier to add into your HTML code.


On the Connect page, set your Email address and SMTP connection.

Close all the activities and Check in the Runbook.

Click here to Download the actual HTML code and image. 

Here’s the email design that you will be sending out, feel free to customize and comment with your updates

Hope this post was helpful and makes your IT life a bit easier

Installing the new SCOM 2016 SQL Server Dashboards and utilizing the new SCOM HTML based Web Console

If you are a SCOM administration this is another feature that you will really appreciate from the MS side. As you might know Dashboards and Business views are critical so upper management or you call center can have a graphical view of what's healthy or not in your environment. Now you and you're staff is not forced/required to use IE so they are now able to use Edge, Mozilla, Chrome or any other preferred browser.

Step by Step

• Import the SQL Server Dashboards Management Packs on your SCOM Management Server.

• After importing Open your Operations Manager Console.
• Go to Monitoring Workspace then right click Monitoring and select New then Dashboard View.

• Select SQL Server Dashboards, Datacenter Dashboard then Next.

• Enter the Dashboard Name and Description, confirm, Next and Create.

• After creating now you should be able to add your widgets, tiles and performance views.

• That's it now you can start adding any of monitored systems to this view.

• Accessing the dashboard view via Google Chrome and IE using the HTML based SCOM Console.