Tag Archives: PowerShell

What Windows Event Logs am I collecting in Azure Monitor Logs?

1 Reply

With Event Log collection in Azure Monitor Logs (Log Analytics), if the log name is too long you can’t see the full name in the UI and it can be tricky to check what the log is.

Especially if you don’t have data yet.

Here’s a quick script using Get-AzOperationalInsightsDataSource that will display the event logs you are collecting.

$RG = "Resource Group Name"
$WS = "Workspace Name"

$Log = Get-AzOperationalInsightsDataSource -Kind WindowsEvent -ResourceGroupName $RG -WorkspaceName $WS

$Log.Properties.EventLogName

Xpost: SCOM getting resource pool members with powershell

Leave a reply

A post I came across from Ian Blyth with a short powershell script to show which Resource Pools your management servers are part of. It’s quite useful to see all of the resource pool members in one place without having to open each one in the console, particularly in larger environments.

For a single managementserver

$Member = Get-SCOMManagementServer -Name “FQDN”
$Pools = Get-SCOMResourcePool -Member $Member
$Member.DisplayName
$Pools.DisplayName

For all management servers

$Members = Get-SCOMManagementServer
foreach ($member in $members)
{
write-host “”
$Pools = Get-SCOMResourcePool -Member $Member
write-host “Management Server – “$Member.DisplayName
$Pools.DisplayName
}

SCOM: Deleting a MP with a Microsoft.SystemCenter.SecureReferenceOverride dependency

2 Replies

This situation will occur when you try and remove a management pack that utilities a Run As account. You’ll get an error that the management pack is dependent on Microsoft.SystemCenter.SecureReferenceOverride and removing that can be a little bit painful.

Anyone one who has ever removed a management pack with a dependency knows the old method of exporting the management pack, removing the offending refference and importing it back again. The steps for Microsoft.SystemCenter.SecureReferenceOverride are slightly different but the principle is the same.

1. First you need to remove the Run AS account from the Run As Profile
2. Export the Microsoft.SystemCenter.SecureReferenceOverride management pack
3. Edit the management pack and remove the references as you would with any other dependency
4.  Increment the management pack version
5. Re import the management pack

Here is a nice method from Matthew Long which uses powershell and doesn’t require any XML editing.

The below is copied for my records, original posting here

  1. Open a powershell session with the Operations Manager module/snappin loaded.
  2. Type: $MP = Get-SCOMManagementpack -Name Microsoft.SystemCenter.SecureReferenceOverride
  3. Now we can view the referenced management packs by typing $MP.References
  4. From the list of items in the Key column, note down the alias of your MP you wish to delete.  If you are having trouble finding it, the Value column will list the full ID of the MP.
  5. Now that we know the MP alias, we can remove it from the Secure Reference MP by typing $MP.References.Remove(“yourMPAliasGoesHere“)
  6. Now we can verify the MP is valid by entering $MP.Verify()  to ensure there are no orphaned overrides, etc.
  7. Finally, we can save our changes by typing: $MP.AcceptChanges()

SCOM: Unable to view overrides in Authoring pane when no scope is selected.

Leave a reply

An odd issue I encountered today at one of my customers that has recently completed a migration to SCOM 2012 R2, when trying to open the overrides node with no scope selected I got the following error “An object of class ManagementPackClass with ID <GUID Removed> was not found” and then the view shows 0 overrides until the console is reopened with a /clearcache.

Turns out this error is caused by having an override that references a class that no longer exists, in order to track it down you first have to access the overrides which you can no longer see unless you do the following:

1. Export your overrides to text file using poweshell by running get-scomoverride | out-file c:\SCOMOverrides.txt
2. Search the output text file for the GUID which was in the original error “An object of class ManagementPackClass with ID <GUID Removed> was not found”
3. The GUID will appear on a line labeled Context, below that one look for a line labeled Identifier, In my case it looked as follows “Identifier: 1|Windows.Operating.System.Custom.Monitors”
4. Generally this is enough information to identify which management pack needs to be deleted if it is not then continue to step 5
5. In SQL run the following query, remebering to edit it for your Identifier, against your operationsmanager database select * from ManagementPack where ManagementPackSystemName like ‘Windows.Operating.System.Custom.Monitors’
6. Once you have identified which management pack is causing your issue it needs to be deleted, once the new configuration is processed you will be able to see your overrides again.

Solution provided by Mcirosoft on Technet forum

SCOM 2012: Translating Notification subscription ID to Subscription Name

Leave a reply

If you ever need to get from a Notification subscription ID to the subscription name it is luckily quite easy to do.

First locate the following in the notification email Notification subscription ID generating this message:  02F7588F-3BEA-BE7A-A004-D4863FA1119D

Then use the following power shell command:

Get-SCOMNotificationSubscription -id <Notification ID > | ft DisplayName

and replace <Notification ID > with the Notification subscription ID, in this example 02F7588F-3BEA-BE7A-A004-D4863FA1119D

Get-SCOMNotificationSubscription -id 02F7588F-3BEA-BE7A-A004-D4863FA1119D | ft DisplayName

SCOM 2012: Enable agent proxy on all agents

1 Reply

Kevin Holman has posted a couple of powershell scripts to simplify enabling proxy for SCOM 2012 agents, proxy always on is a particularly handy find:

Turn on agent proxy for all agents where it is disabled:
get-SCOMagent | where {$_.ProxyingEnabled -match “False”} | Enable-SCOMAgentProxy

Turn on agent proxy as a default setting for all new agents to be deployed, never to have to mess with this again:
add-pssnapin “Microsoft.EnterpriseManagement.OperationsManager.Client”; new-managementGroupConnection -ConnectionString:scomserver.domain.com; set-location “OperationsManagerMonitoring::”; Set-DefaultSetting -Name HealthService\ProxyingEnabled -Value True

SCOM 2012: Powershell overview

Leave a reply

Just a quick refference for the SCOM 2012 powershell cmdlets. The same information is available within the SCOM shell.

Technet detailed help is a site with detailed help for each cmdlet, including examples.

————————————————————————

OPERATIONS MANAGER 2012 MODULE NAME

————————————————————————

Operations Manager 2007 snap-in

Microsoft.EnterpriseManagement.OperationsManager.Client

Operations Manager 2012 module

OM10

————————————————————————

NEW OPERATIONS MANAGER 2012 CMDLETS

————————————————————————

Enable-SCOMAgentProxy

Disable-SCOMAgentProxy

Enable-SCOMDiscovery

Disable-SCOMDiscovery

Set-SCOMManagementGroupConnection

Enable-SCOMMonitor

Disable-SCOMMonitor

Enable-SCOMMonitoringRule

Disable-SCOMMonitoringRule

Get-SCOMRunAsProfile

Update-SCOMRunAsProfile

————————————————————————

RENAMED CMDLETS

————————————————————————

Operations Manager 2007                      Name Operations Manager 2012 Name

—————————-                         —————————-

Get-Agent                                                       Get-SCOMAgent

Install-Agent                                                  Install-SCOMAgent

Uninstall-Agent                                             Uninstall-SCOMAgent

Approve-AgentPendingAction                    Approve-SCOMPendingManagement

Get-AgentPendingAction                             Get-SCOMPendingManagement

Reject-AgentPendingAction                        Deny-SCOMPendingManagement

Get-Alert                                                          Get-SCOMAlert

Resolve-Alert                                                   Set-SCOMAlert

Set-AlertDestination                                       Set-SCOMAlert

Get-AlertHistory                                              Get-SCOMAlertHistory

Get-Connector                                                  Get-SCOMConnector

Get-Diagnostic                                                  Get-SCOMDiagnostic

Remove-DisabledMonitoringObject             Remove-SCOMDisabledClassInstance

Get-Discovery                                                    Get-SCOMDiscovery

Get-Event                                                           Get-SCOMEvent

Get-FailoverManagementServer                   Get-SCOMAgentManagementServerSetting

Get-GatewayManagementServer                  Get-SCOMGatewayManagementServer

Get-MaintenanceWindow                               Get-SCOMMaintenanceMode

New-MaintenanceWindow                             Start-SCOMMaintenanceMode

Set-MaintenanceWindow                               Update-SCOMMaintenanceMode

Get-ManagementGroupConnection             Get-SCOMManagementGroupConnection

New-ManagementGroupConnection           New-SCOMManagementGroupConnection

Remove-ManagementGroupConnection    Remove-SCOMManagementGroupConnection

Export-ManagementPack                              Export-SCOMManagementPack

Get-ManagementPack                                    Get-SCOMManagementPack

Install-ManagementPack                               Import-SCOMManagementPack

Uninstall-ManagementPack                          Remove-SCOMManagementPack

Get-ManagementServer                                 Get-SCOMManagementServer

Set-ManagementServer                                  Set-SCOMAgentManagementServerSetting

Set-ManagementServer                                  Set-SCOMAgentManagementServerSetting

Get-Monitor                                                      Get-SCOMMonitor

Get-MonitorHierarchy                                    Get-SCOMMonitor

Get-MonitoringClass                                       Get-SCOMClass

Get-MonitoringObject                                     Get-SCOMClassInstance

Get-MonitoringObjectGroup                         Get-SCOMGroup

Get-NotificationAction                                    Get-SCOMNotificationAction

Get-NotificationEndpoint                               Get-SCOMNotificationEndpoint

Get-NotificationRecipient                               Get-SCOMNotificationRecipient

Disable-NotificationSubscription                  Disable-SCOMNotificationSubscription

Enable-NotificationSubscription                   Enable-SCOMNotificationSubscription

Get-NotificationSubscription                          Get-SCOMNotificationSubscription

Get-Override                                                       Get-SCOMOverride

Get-PrimaryManagementServer                    Get-SCOMAgentManagementServerSetting

Set-ProxyAgent                                                  Set-SCOMAgentlessManagedComputer

Get-Recovery                                                      Get-SCOMRecovery

Get-RelationshipClass                                      Get-SCOMRelationship

Get-RelationshipObject                                   Get-SCOMRelationshipInstance

Add-RemotelyManagedComputer                Add-SCOMAgentlessManagedComputer

Get-RemotelyManagedComputer                 Get-SCOMAgentlessManagedComputer

Remove-RemotelyManagedComputer         Remove-SCOMAgentlessManagedComputer

Get-ResultantCategoryOverride                    Get-SCOMOverride

Get-ResultantRuleOverride                            Get-SCOMOverride

Get-ResultantUnitMonitorOverride             Get-SCOMOverride

Get-Rule                                                             Get-SCOMMonitoringRule

Get-RunAsAccount                                          Get-SCOMRunAsAccount

Get-Task                                                             Get-SCOMTask

Start-Task                                                          Start-SCOMTask

Get-TaskResult                                                 Get-SCOMTaskResult

Get-UserRole                                                    Get-SCOMUserRole

Add-UserToUserRole                                      Update-SCOMUserRole

————————————————————————

DEPRECATED OPERATIONS MANAGER 2007 CMDLETS

————————————————————————

Install-AgentByName

Get-AlertDestination

Remove-ConnectorFromTier

Add-ConnectorToTier

New-CustomMonitoringObject

Get-DefaultSetting

Set-DefaultSetting

New-DeviceDiscoveryConfiguration

Get-Diagnostic

Start-Discovery

New-LdapQueryDiscoveryCriteria

Get-MonitoringClassProperty

Get-MonitoringObjectPath

Get-MonitoringObjectProperty

New-MonitoringPropertyValuePair

Get-NotificationAction

Get-NotificationEndpoint

Get-NotificationRecipient

Disable-NotificationSubscription

Enable-NotificationSubscription

Get-NotificationSubscription

Get-OperationsManagerCommand

Get-PerformanceCounter

Get-PerformanceCounterValue

Get-Recovery

Add-RemotelyManagedDevice

Get-RemotelyManagedDevice

Remove-RemotelyManagedDevice

Get-RootManagementServer

Disable-Rule

Enable-Rule

Get-State

Get-Tier

New-Tier

Remove-Tier

New-WindowsDiscoveryConfiguration

SCOM 2012: Approving agents that don’t appear under pending management.

2 Replies

Well the old “Manually installed agent that doesn’t appear under pending management” situation still exists in SCOM 2012. What is different is that the powershell cmdlet get-agentpendingaction no longer works.

Instead we have the following cmdlet Get-SCOMPendingManagement which provides you all agents
that are in pending management and with Approve-SCOMPendingManagement you can approve the agent you need to.

For a specific agent open the Operations Manager Shell and enter:
Get-SCOMPendingManagement | where {$_.AgentName -eq “ServernameFQDN“} | Approve-SCOMPendingManagement