JAMA00

SCOM 2007 R2

State changes from disabled monitors

Posted by MarcKlaver on May 18, 2011

While we try to reduce the number of state changes, we stumbled into a bug in the agent software. We were investigating our top 50 of state change monitors, using Kevin Holman’s queries.

When we looked at the results, we did see some strange things. First, the number of state changes were equal for a lot of monitors.

An example of this:

image

Having exact the same number of state changes for two different monitors? When we looked into these monitors, they were disabled by default in the management pack were the monitor was defined. Digging further showed that there was no override present in the system, which would enable this monitor.

We now had a problem while from our top 50, 48 of them were monitors that were default disabled, without any override to enable the monitor.

This turns out to be a bug in the agent software. The moment the agent (re-) initializes either by starting or coming out of maintenance mode it will detect the monitor and initialize it. When realizing it should (default) disable the monitor, it will send a state change for the the disabled monitor.

This is also the case for monitors that are default enabled, but are disabled using a custom override. Unfortunately a fix for this issue is not as easy as it sounds (according to Microsoft support) and a fix will not be realized in the R2 version of SCOM.

So if you have tuned a lot (like us) and find these monitors, just skip them. You can’t fix this one 🙂

Below is a list of monitors we found that were default disabled during this investigation and that we now exclude from the query.

Microsoft.Windows.Server.2003.LogicalDisk.AvgDiskSecPerWrite
Microsoft.Windows.Server.2003.LogicalDisk.AvgDiskSecPerRead
Microsoft.Windows.Server.2003.NetworkAdapter.NetworkAdapterConnectionHealth
Microsoft.Windows.Server.2008.LogicalDisk.AvgDiskSecPerWrite
Microsoft.Windows.Server.2008.LogicalDisk.AvgDiskSecPerRead
Microsoft.SystemCenter.Ping
Microsoft.SystemCenter.AgentManagement.EndToEndEventMonitorError
Microsoft.SystemCenter.HealthService.ConfigurationStateWarningLevel
Microsoft.SystemCenter.HealthService.ConfigurationProcessing
Microsoft.SystemCenter.HealthService.Security.DataIntegrityCheck
Microsoft.SystemCenter.HealthService.ConfigurationStateCriticalLevel
Microsoft.SystemCenter.AgentManagement.EndToEndEventMonitorWarning
SMSv4_dependent_service_running__Background_Intelligent_Transfer_Service_16_Rule.AdvancedAlertCriteriaMonitor
SMS_2003_dependent_service_running__Background_Intelligent_Transfer_Service_13_Rule.AdvancedAlertCriteriaMonitor
Microsoft.SQLServer.2005.DBFile.DiskFreeSpace
Microsoft.SQLServer.2005.Database.Configuration.RecoveryModel
Microsoft.SQLServer.2005.Database.TransactionLogSizeMegabytesMonitor
Microsoft.SQLServer.2005.Database.Configuration.TrustWorthy
Microsoft.SQLServer.2005.Database.Configuration.AutoUpdateStatAsync
Microsoft.SQLServer.2005.Database.Configuration.TornPageDetection
Microsoft.SQLServer.2005.Database.DBSizePercentMonitor
Microsoft.SQLServer.2005.Database.Configuration.AutoCreateStat
Microsoft.SQLServer.2005.Database.Configuration.DBChaining
Microsoft.SQLServer.2005.Database.TransactionLogSizePercentMonitor
Microsoft.SQLServer.2005.Database.DBSizeMegabytesMonitor
Microsoft.SQLServer.2005.Database.Configuration.AutoUpdateSet
Microsoft.SQLServer.2005.Database.Configuration.AutoShrink
Microsoft.SQLServer.2005.Database.DBSizePercentageChangeMonitor
Microsoft.SQLServer.2005.Database.Configuration.AutoClose
Microsoft.Windows.Server.2003.TerminalServerRole.InactiveSessions
Microsoft.Windows.Server.2003.TerminalServerRole.ActiveSessions
Microsoft.Windows.Server.2003.TerminalServerRole.CPUPerSession
Microsoft.Windows.InternetInformationServices.2003.WebSite.WebServiceCurrentISAPIExtensionRequests.Monitor
Microsoft.Windows.InternetInformationServices.2003.WebSite.WebServiceCurrentConnections.Monitor
Microsoft.Windows.InternetInformationServices.2003.WebSite.WebServiceBytesTotalSec.Monitor
Microsoft.Windows.InternetInformationServices.2003.WebSite.WebServiceBytesSentSec.Monitor
Microsoft.Windows.InternetInformationServices.2003.WebSite.WebServiceBytesReceivedSec.Monitor
Microsoft.Windows.InternetInformationServices.2003.WebSite.WebServiceISAPIExtensionRequestsSec.Monitor
Microsoft.Windows.InternetInformationServices.2003.WebServer.WebServiceISAPIExtensionRequestsSec.Monitor
Microsoft.Windows.InternetInformationServices.2003.WebServer.ASP.NETRequestsQueued.Monitor
Microsoft.Windows.InternetInformationServices.2003.WebServer.ASP.NETRequestsCurrent.Monitor
Microsoft.Windows.InternetInformationServices.2003.WebServer.ASP.NETWorkerProcessRestarts.Monitor
Microsoft.Windows.InternetInformationServices.2003.WebServer.WebServiceBytesReceivedSec.Monitor

 

If you want to exclude any (default) disabled monitor that you found, exclude it in the query as shown below:

use OperationsManager
go

select distinct top 50 count(sce.StateId) as NumStateChanges, m.MonitorName, mt.typename AS TargetClass
from StateChangeEvent sce with (nolock)
join state s with (nolock) on sce.StateId = s.StateId
join monitor m with (nolock) on s.MonitorId = m.MonitorId
join managedtype mt with (nolock) on m.TargetManagedEntityType = mt.ManagedTypeId
where m.IsUnitMonitor = 1
and m.MonitorName not in (

‘Microsoft.Windows.Server.2003.LogicalDisk.AvgDiskSecPerWrite’,

‘Microsoft.Windows.Server.2003.LogicalDisk.AvgDiskSecPerRead’

)
group by m.MonitorName,mt.typename
order by NumStateChanges desc

Advertisements

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s

 
%d bloggers like this: