Let’s talk about monitors and rules in SCOM 2012 R2

ahoy sailor!

so today’s challenge is to set up a monitor for Citrix Print Manager Service. A customer of mine has this “bug” where this service terminates unexpectedly when one connects to a XenApp server.

So let’s first of all talk about monitors and rules in SCOM 2012R2. Aftewards I’ll show you how to configure a unit monitor with a basic recovery task.

As far as I understand everything right I can tell you this:

When you want to monitor specific occurences with SCOM you’ve got two options to go.

On the one hand you’ve got Rules:

Rules collect data from sources like Log Files, Windows Event Logs or if you want to collect performance data . This data gets stored in the Operations Manager database where it replicates with the Data Warehouse (if one exists) and can be used for reporting purposes. So a Rule is kind of a stateless Monitoring element and does not create Alerts about state changes. The result of a rule is always a write action and a rule does not come up in the health explorer.

On the other hand we have Monitors:

Monitors provide real-time information So if you want to monitor an object like application components, Windows services, scripts or events, a monitor should be your method of choice. In general we distinguish to kinds manifestations we do have “Two-state” and “Tree-State” Monitors. Thus a monitor can either be in one of thwo /tree states. So here is what the point is: a Monitor is programmed with the intelligence to determine wheter a componenent is healthy or not and (in the best case) has the appropiate command or script to solve the incident.

Alright now let’s have deeper look on the tree monitors.

Unit monitors

• “Unit monitors are often described as the “workhorses” of SCOM monitoring and are the most common kind of monitor out there.” A unit monitor is the fundamental monitoring component and is used to monitor events, scripts, services etc. “These unit monitors can be used at an extremely granular level and provide you with a multitude of ways to monitor even the most minor elements of system stability.”

Aggregate rollup monitors

• An aggregate rollup monitor is a collection of several monitors. Aggregate Monitors should be configured to watch similar items like a group of DNS Servers.  So here’s how an aggregate rollup monitor works: “Suppose you’re using a dependency rollup monitor to watch eight separate DNS servers. You could create a high level monitor that undergoes a state change only once five of the eight DNS servers become unavailable. In this way (i.e. Only raise alert if 5 of 8 DNS servers are down) you can be alerted on your terms. “

So use an aggregate rollup monitor to group multiple Monitors into one.

Dependency rollup monitor

• The dependency rollup monitor, allows the health of one object to directly affect the health of another completely unrelated object. Let’s make an example regarding a SQL Cluster. You would use a dependency rollup monitor to check for the databases. But if one database is offline this does not mean, that the whole SQL is critical so you could configure the monitor in the way to not notice you. If the master database is not available the SQL Environment is down for sure and the dependency rollup monitor would generate alerts. So this construct offers you a bit more flexibility.

Please notice:

In the above listed definitions I’ve tried to make the fielding as clear as possible. Unfortunately it’s not always that clear in business. Sometimes there are to possible ways to implement tasks (like checking whether a certain service is up & running) and can be solved with both rules and monitors. But the above definitions should give you a good starting point.

Thanks to Scott D.Lowe for this great article about Introduction to System Center Operations Manager 2012 (Part 6) – Monitors where I’ve copied some fantastic descriptions to my post.

If you need more informations on Monitors and Rules have a look at TechNet!

Cheers! And Arghhhhhh! Bring the Rum cask aft.

*Captain