Raphael Burri's blog

Mostly about Systemcenter Operations Manager 2012

PKI Certificate Verification Management Pack Update – 1.2.0.210

Posted by rburri on April, 16 2014

Many years have passed since I first published the certificate MP back in summer 2009. Almost 5 years(!) later this management pack still fills a gap by keeping an eye on PKI certificates installed locally in servers’ certificate stores. Certainly about time for an update.

Today I am able to release a major update – a complete re-write rather – of the PKI Certificate Verification MP. It is hosted over at SystemCenterCentral.com in the MP Catalog.

MP change history
  • SCOM 2012 / 2012 R2 support only (the legacy MP 1.0.1.20 is still available for use on SCOM 2007).
  • main monitoring script now uses PowerShell instead of VB Script, making it compatible with any system locale and easier to maintain.
  • new, advanced certificate verification flag overrides
  • dashboard view
Some extra words on the effort

The main aim with this update is to make the MP’s code easier to maintain. Hence I first recreated the entire MP as a Visual Studio project with the Authoring Extensions. This involves taking apart the MP’s elements, adding each one as a separate item to a VS project structure. Next I started writing a new discovery and monitoring script based on PowerShell. This script does most of the work by essentially enumerating certificates and certificate revocation lists in local certificate stores. Due to limitations in PowerShell regarding CRLs and alternate certificate stores, this script got rather complex. No chance of getting away with something easy and straight forward as ‘ls cert:\LocalMachine’. With the first CRLs getting discovered, tests, more tests, some extra testing plus updating the documentation were left.

While I did not clock the hours, the update kept me busy in much of my spare and commuting time during the last 4 months. And I must mention everybody helping with code samples, advise, by testing and reviewing.  Pete, Vadim, Marc, Joel, Bob, Dan, Marnix, Stan, Tao and Dirk – this wouldn’t be here today without your help!

Certificate MP in VSAE

MP Solution opened in Visual Studio

Posted in SCOm 2012 | Tagged: , , , , , | 7 Comments »

SQL Server Mirroring MP Update V 1.0.2.5

Posted by rburri on April, 28 2011

Today I was able to release an update to the SQL Server DB Mirroring Management Pack.

The update doesn’t bring any new features but fixes a potential issue on larger management groups which would lead to discoveries failing. In order to work around this I have altered the Powershell discovery scripts such that they do no longer make use of any SCOM console cmdlets. Instead direct SDK .NET calls are being used. I recommend to update existing installations specifically if you are using management group connectors, the Exchange 2010 correlation engine or other custom MPs which make use of SDK workflows.

Download of the management pack is available trough the SystemCenterCentral.com MP Catalog. You need to register but registration is free.

MP Change History

Version 1.0.2.5 – April, 28 2011 (no functional changes)

  • Corrected spelling in language pack.
  • Replaced all SCOM shell cmdlets with .NET calls to overcome a potential issue when several connectors and other MPs share a single SDK connection.
  • Improved discovery script timing behaviour when using desired configuration for a large number of mirrors.

Version 1.0.1.72 – September, 10 2010

  • Support for SQL Server 2005 has been added and compatibility with SQL Server 2008 R2 has been verified. Starting with version 1.0.1.72, Microsoft SQL Server 2005, 2008 and 2008 R2 are supported.
  • Default Display Names of discovered DB Mirror Groups have been shortened and may optionally be changed to a customized string. See the guide for details.

Version 1.0.1.35 – June, 04 2010

  • Original release – SQL Server 2008 support only

Posted in OpsMgr 2007 | Tagged: , , , , | Leave a Comment »

PKI Certificate Management Pack Update V1.0.1.15

Posted by rburri on March, 31 2011

After having had very helpful feedback by various users, I was able to incorporate some enhancement requests for the PKI Certificate Management Pack.

Version 1.0.1.15 will deal correctly specific certificates that have somewhat unusual ‘Issued to’ and ‘Issued By’ properties. Furthermore it will only monitor CA certificates if they haven’t been superseded. Download from SystemCenterCentral.com. You need to register but registration is free.

Changes in version 1.0.1.15
  • Improved discovery of Issued to and Issued by properties: Will use Subject Alternative Name if certificate doesn’t have a subject and will correctly extract the subject if CN= isn’t encountered on the first line of the subject string.
  • Additional certificate property: CA Version (based on extension szOID_CERTSRV_CA_VERSION). If this property holds a value, that certificate is a Windows CA one.
  • Does no longer discover superseded CA certificates. Evaluation is based on the CA Version property. Additional override to change that behavior if required.
  • Monitors will not mark superseded CA certificates as expired if their discovery is enabled.
  • Expose script timeout as an overridable parameter
  • Changed alert priority to ‘Low’.
  • Broke upgrade path to avoid potential agent stale issues when upgrading from V 1.0.0.280 or earlier.

Please study the included release notes and the MP guide carefully, especially when you’re planning to update from a previous version. I did deliberately break upgrade compatibility after some users had reported stale agent conditions during test cycles. You will need to remove any previous version of the MP from your Management Group before importing the latest one.

Geeky background information

The issues after upgrades were caused by moving the overridable timing parameters from the certificate object workflows to the parent certificate store’s properties. This left already discovered certificate objects’ workflows without any timing information until their parents were re-discovered and got their default timing properties added. During my own test all the agents recovered after that and re-enabled the certificate workflows.

Other users had less luck and ended up with a partly stale agent population that could only be corrected by removing the MP from the Management Group. To avoid issues I simply decided to break the upgrade path and force everyone upgrading to remove the previous MP. Breaking was easy by the way. It only took altering the caption of a property on a public class.

I do apologize for having to make go through the process of removing the MP (and it’s override MPs) before being able to upgrade. On the other hand I wouldn’t want anyone to experience stale agent conditions due to that.

Lesson learned: There are indeed rare conditions under which an MP author may write an upgradeable MP that would pass MPVerify and will import without complaints but still causing upgrade issues on the Management Group. Watch out for those! Test, test, test – then test once more.

Posted in OpsMgr 2007 | Tagged: , , , , | 10 Comments »

SQL Server DB Mirroring MP Update

Posted by rburri on September, 10 2010

When I published the original release of the SQL Server DB Mirroring Management Pack, I promised that I would provide support for SQL Server 2005 if demand justified the effort. I am almost certain that you have an idea of what follows now: The latest version of the MP does support mirrored databases on SQL Server 2005, SQL Server 2008 and SQL Server 2008 R2.

All improvements over the first release include:

  • SQL Server 2005 database mirror supported
  • tested compatibility with SQL MP 6.1.314.36 (SQL 2008 R2 support)
  • timing improvements in script workflows
  • allow mirror group display name to be configured via Desired Configuration XML file
  • fix alert parameter replacement failures seen occasionally after initial discovery
  • an override pack to make discovery faster in non production environments only
Download

Before importing this management pack I strongly encourage you to carefully read the guide contained in the download. Some features will only work when all prerequisites have been met!

Get the SQL Server DB Mirroring MP from SystemCenterCentral.com (Version 1.0.1.72)

Acknowledgements

This update wouldn’t have been possible without the assistance of Dirk Decher who has kindly provided an extended testing environment and taken the time to share his ideas around DB mirroring monitoring with me. And last but not least: I was thrilled to learn that this MP has won the gold medal at the System Center Influencers Program Management Pack Extension Contest 2010. Some of you guys know how much effort goes into writing an MP. A reward like that makes up for some of those many late and wee hours spent tracking down that XPath failure. Do check out the other participant’s entries as well. Some true gems are amongst them.

 

Posted in OpsMgr 2007 | 1 Comment »

SQL Server DB Mirroring Management Pack

Posted by rburri on June, 5 2010

My latest addition to the community MP catalog augments the SQL Server MP with database mirroring discovery and monitoring. The SQL Server DB Mirroring Management Pack helps you by:

  • discovering db mirror roles and objects on SQL 2008 DB engines
  • automatically creating service components per mirrored database (consider them mini DADs)
  • probe based monitoring of the mirrored DB state with alerting should the mirror no longer run synchronized or loose its witness
  • optionally checking the mirror mode and db roles against a Desired Configuration setting (alerts when the mirror roles are swapped etc.)
  • delivering mirror inventory and availability reports

 

DB Mirroring Relationships and Health Roll Up
Download

The Management Pack comes with a comprehensive guide which is a must read. The pack will only work as expected if some prerequisites are met. The guide also discusses how to enable Desired Configuration monitoring for your DB mirrors.

 Get the SQL Server DB Mirroring MP from SystemCenterCentral.com (Version 1.0.1.36)

The download also contains an override MP for the SQL Server Extension MP published on OpsMgr Jam. The extension MP already features useful event and performance collection rules that help monitoring an SQL DB mirror but as it does not contain any discoveries, they are targeting any SQL server. My override MP helps by adjusting their targeting so that those rules are only active on SQL Engines that host mirrored DBs.

2010 Management Pack Extension Contest

South Africa 2010 is about to take off and even on planet SCOM we currently have a great tournament:

The System Center Influencers program has sponsored the Management Pack Extension Contest. Entered Management Packs should extend one of the product’s pack with

  • reporting
  • diagram or service level
  • Visio or Dashboard
  • by tuning it

My own MP does certainly extend the SQL Server Management Pack and it does fit more or less into three of the contest categories. The deadline for entries is June 30, 2010. So why don’t you upload your own entries to compete with me?

Posted in OpsMgr 2007 | Tagged: , , , , | Leave a Comment »

Updates to Management Packs

Posted by rburri on June, 3 2010

It has been quiet on this blog for a long time. With the community efforts luckily having rapidly picked up grounds, there is much less newly discovered to write about. As I rather not repost knowledge found by other folks, I haven’t had much to place up here lately.

However; I do greatly appreciate feedback, especially on my published Management Packs. Knowing what needs and headaches other OpsMgr users have, gives me a chance to improve the packs. So there are updates for the following MPs:

Adobe Flash Media Server

Version 1.0.1.306 works with FMS 3.5 and OpsMgr 2007 R2. Download from this blog.

PKI Certificate Validation

Version 1.0.0.288 allows improved customization of monitoring frequencies and now contains an example MP that shows how additional certificate stores may be discovered. Download from SystemCenterCentral.com.

Untrusted Active Directory Domain Discovery

Version 1.0.3.0 of that extension Management Pack is compatible with the current product MP 6.0.7065.0. Download from this blog.

Posted in OpsMgr 2007 | 2 Comments »

PKI Certificate Verification Management Pack

Posted by rburri on September, 2 2009

PKI certificates are used to provide SSL encryption for web sites, to secure cross-server traffic (for example to join security gateways or agents in untrusted domains on OpsMgr), to guarantee the identity of the sender of a message and so on. What all certificates have in common is that their destiny often means to be forgotten after having been requested and installed. Until a certificate becomes invalid that was vital to a service. Mostly because it has expired.

To avoid service interruptions or embarrassment due to SSL warning messages displayed to users, the PKI Certificate Verification Management Pack was born. It discovers certificates and certificate revocation lists stored locally on computers and alerts you when:

  – a certificate’s lifetime is about to expire (by default 21 days in advance)
  – a certificate’s lifetime has ended
  – a certificate has become invalid because of a different reason
  – a CRL has not been updated in a timely manner

The MP also includes a series of inventory reports, which help keeping up with all those certificates in your environment. You will find more details in the comprehensive MP guide.

PKI_Certificate_Screenshot

Certificate Verification Screen Shot
Download

The MP and the guide are available for download at the SystemCenterCentral.com site:

Download from SystemCenterCentral.com MP Catalog

I wrote the MP in close collaboration with Pete Zerger and Jaime Correia of the SCC community. Without their help and the support of everyone testing the MP, it wouldn’t be here today.

MP Creation Zen

And there’s more! For everyone interested in learning how to author MPs: Have a look at the 6 part series MP Creation Zen. The articles will walk you through the process of writing an MP, carefully clarifying everything you need to know. Whenever possible, all authoring examples are explained using the new and much improved OpsMgr 2007 R2 Authoring Console, telling you how the PKI Certificate Verification MP was written. I recommend the documents to everyone planning to write a Management Pack by themselves without being application developers.

Posted in OpsMgr 2007 | Tagged: , , , , | 16 Comments »

Minor update to the Scheduled Task MP (Version 1.1.1.1)

Posted by rburri on July, 1 2009

I have just uploaded an update to the Scheduled Task Management Pack. Under certain circumstances the discovery of Windows 2003 tasks failed. The new version 1.1.1.1 fixes the bug in the discovery script.

I do recommend everyone who is currently using version 1.1.1.0 to upgrade to 1.1.1.1. Simply download the new version here and update the management pack by importing Custom.Windows.TaskScheduler.Windows2003.Monitoring.mp.

Many thanks to Aengus and Mark for making me aware of this bug.

Posted in OpsMgr 2007 | 4 Comments »

Windows Scheduled Task MP now supports localized OS

Posted by rburri on April, 22 2009

Having thought about enabling the Scheduled Task Management Pack for non English operating system versions for some time, I finally found the time to update it. The new release (Version 1.1.1.0) works with the following OS languages:

OS Languages Remarks
Windows Server 2008 any .
Windows Server 2003 English,
Dutch,
French,
German,
Italian,
Portuguese,
Spanish
discovery will not work on other languages

 

The update is available here: Scheduled Task Management Pack understands 7 languages.

The reason why only 7 languages are currently supported on Server 2003 is that in order to discover and manage the tasks, the output of the ‘schtasks.exe’ command needs to be parsed. That output unfortunately varies between different languages. I decided to include support for those languages I have at least a basic knowledge of (very basic for 3 of them). If you need other languages to be added let me know.

Like a little language quiz? Here’s what Scheduled Tasks are called on other OS languages. Can you tell which expression is in what language?

tareas programadas / geplande taken / operazione pianificata / tâche planifiée  / tarefas agendadas / geplante Tasks

On Windows Server 2008 parsing ‘schtasks.exe’ is not required as Microsoft has included COM object with the OS that allows managing the tasks using scripts and that is language independent.

Many thanks to Romain Girot who’s helped a lot by testing the localization support accurately and patiently.

Posted in OpsMgr 2007 | Tagged: , , , | 6 Comments »

Community written Multi-Host Ping Management Pack V3

Posted by rburri on March, 25 2009

Summary

Over the last few weeks the Multi-Host Ping Management Pack developed as a joint work by the System Center Community has seen a major update from version 2.0 to 3.0. The new Management Pack is class based and represents the health of each Ping Target (address being pinged)  as seen by one or more Ping Watchers (agent issuing the ping).

Great care has been taken to increase the scalability and keep the performance impact on the Ping Watchers low. Other than the discovery process, all datasources rely on native Operations Manager modules instead of VBScripts. Furthermore all monitors and rules of the management pack incorporate ‘cookdown’ resulting in just a single ICMP ping per cycle for all circuits.

Multi-Host Ping Scrren Shot

Neale Brown, Jaime Correia, Pete Zerger any myself have teamed up to write the management pack, documentation and test the solution. A great experience.

Download

The sealed Management Pack and the documentation can be downloaded from the System Center Forum: Download Multi-Host Ping 3.0 Management Pack
Be sure to study the documentation before you implement the Management Pack as there is some required configuration work to be performed.

Posted in OpsMgr 2007 | Tagged: , , , , | 2 Comments »

 
Follow

Get every new post delivered to your Inbox.