SQL Engineering Blog

hmmmm

Ever wonder when a SQL MP is published?

Wonder no longer, look for the SQL Engineering Blog!

 

New https://techcommunity.microsoft.com/t5/SQL-Server/bg-p/SQLServer/label-name/SQLReleases

Old – redirect in effect https://blogs.msdn.microsoft.com/sqlreleaseservices/

 

 

Basic Admin ‘How-to’ Series

443053-royalty-free-rf-clip-art-illustration-of-a-cartoon-businessman-carrying-a-heavy-manual

This is a series of blog posts to help with SCOM best practices, and things that make SCOM easier to administer.

 

Associate MPX files in Notepad++ blog

Backup management packs via PowerShell blog

Get to know your monitor blog

Load Test MP with Report blog

Load Test MP Fragments blog

Maintenance Mode PowerShell blog

Manage DB storage with DWdataRP blog

Managing Subscriptions blog

PowerShell Rule/Monitor/PerfCounter MP and Fragments blog

Registry Key discovery MP Fragment clarification blog

Run As PowerShell monitor fragment blog

Sealing Management packs with 2012R2 and 2016 blog

Subscriptions blog

Subscription Set up Guide blog

Uncommon MP Fragments blog

Verifying Overrides blog

 

Best Practices

Agent Management pack KH Blog

Enable proxy as a default KH blog

How to be heard blog

Manage alerts/events/performance KH Blog

Office Analytics (find where all the time goes) blog

Optimize SQL blog

Recommended Registry tweaks KH blog

SCOM Agent Version Addendum KH blog

Set SCOM Agent to remotely managed KH Blog

SQL Engineering Blog

SYSTEM CENTER 2016 Operations Manager – Anti-Virus Exclusions blog

Update VMM MP’s for SCOM when SCVMM patched blog

 

Tools

MP Viewer blog

Download Notepad++ here

Kevin Holman blog on extracting scripts from MP’s using Transform tool from codeplex

Test fire events using EventLog Explorer here

Alternate tool to fire any events here

How to size your SCOM environment

update

Additional items to consider sizing a SCOM environment

# of Unix Servers

Network monitoring

Application Performance Monitoring (APM)

URL monitoring (transactional and availability)

DB Data retention requirements

 

Resources

The SCOM Sizing calculator XLS on TechNet to determine capacity and storage needs (2012 and 2016) http://download.microsoft.com/download/C/A/6/CA60425C-950B-456E-986C-C5F2FCD5668D/System%20Center%202012%20Operations%20Manager%20Sizing%20Helper%20Tool%20v1.xls

 

2016 Quick Start guide https://blogs.technet.microsoft.com/kevinholman/2016/10/22/opsmgr-2016-quickstart-deployment-guide/

How To upgrade to UR1 https://blogs.technet.microsoft.com/kevinholman/2016/10/22/ur1-for-scom-2016-step-by-step/

 

Here is the 2016 System Center SQL matrix (SCOM)

https://technet.microsoft.com/en-us/system-center-docs/system-requirements/sql-server-version-compatibility

System Center 2012 R2 Matrix (SCOM)

https://technet.microsoft.com/en-us/library/dn281933.aspx

 

Not quite related, but incase SCCM is to be upgraded (SCCM does show support for all SQL versions)

https://technet.microsoft.com/en-us/library/gg682077.aspx#Configurations for the SQL Server Site Database

Why not to use Local System for your core SCOM accounts

say-what-logo1

Stay with me here, this is for the SCOM management group installation

 

So first, let’s research and figure out what the experts are doing, and what the install guides exist.

Researching expert published documentation helps us understand the options, and we can dive into some of the reasons why.

 

SCOM Security

scom-kh-securityblogcapture

(KH blog )

 

 

SQLRights and roles

scom-sql_accountrightsmapping

(KH blog here to download the XLS (applies for 2012,2016 as well)

 

Experts separate out the various functions into dedicated ID’s

 

The reason for multiple ID’s is to lower the risk (less vulnerability if one ID is locked out, expired, disabled)

— If you use one ID for all SCOM functions, and something happens to the ID, your SCOM environment stops working.

— There’s always some associated risk with either scenario for LocalSystem or ID’s (decrypt RunAs ID’s UK blog )

If that is a concern, here is some great advice from Kevin Holman

  1. Control who has access to SCOM
  2. Control who has access to the servers using RunAs accounts, that are monitored by SCOM.

If you have lost control of local admin on a server, you are compromised, and I am not sure how gaining access to a RunAs account is no worse in some sense.

By the way – this is the entire reason “more secure” was introduced in SCOM 2007R2, to limit distribution of credentials only to servers that required it, to limit the potential for a local attack.

 

Another option (not recommended) is using Local System

— Cannot login to system to verify access concerns (quite honestly is why someone might sanction this approach)

— Scripts run as local system can be terminated, allowing a command window with Local System access

— Depending on which services LocalSystem is used, this could grant elevated privileges (like a Domain Controller DC)

localsystemaccount

— If ‘Local System’ was used for the core SCOM environment, a change made to the Local Security Policy, or group policy can break the environment.

Local Security Policy snapshot

localsystem-localsecuritypolicy

Security Options

localsystem-securityoptions-localsecuritypolicy

Group Policy

Locking down protocol blog here

gpo-snapshot-technetwebsite

 

 

 

Hope this helps you decide the ‘how to’ set up your environment

 

 

Related documentation

2019 Kevin Holman Deployment Guide

2016 Kevin Holman Deployment Guide

2012 R2 Kevin Holman Deployment Guide

Planning 2019 SCOM deployment Guide

Planning 2016 SCOM deployment Guide

2012 Technet Deployment Guide

2007R2 Technet Deployment Guide

 

 

 

SCOM Management Pack backup

nobackup

Ever wish you had a backup of your MP?

 

It’s quite easybutton

 

Tailor to your requirements, but you can run this as a scheduled task, Orchestrator job, etc.

I would recommend running the script on a server with the Operations Manager shell (or at least add the Operations Manager snapIn to a non SCOM server)

NOTE This will unseal sealed management packs

 

# Backup Management packs to C drive

# Set up your path, my example is monadmin\backup

$date = Get-Date -UFormat “%Y-%m-%d”

c:

cd monadmin\backup

new-item -itemtype directory -path c:\monadmin\backup\$date

cd $date

# Variants accepted

# Examples – begins with OR, or Company Name, or contains Lab

Get-SCOMManagementPack -Name OR* | Export-SCOMManagementPack -Path “C:\monadmin\backup\$date”

Get-SCOMManagementPack -Name <CompanyName>* | Export-SCOMManagementPack -Path “C:\monadmin\backup\$date”

Get-SCOMManagementPack -Name *Lab* | Export-SCOMManagementPack -Path “C:\monadmin\backup\$date”

 

# Backup Management packs to E drive

# Set up your path, this example is monadmin\backup

$date = Get-Date -UFormat “%Y-%m-%d”

E:

cd monadmin\backup

new-item -itemtype directory -path e:\monadmin\backup\$date

cd $date

Get-SCOMManagementPack -Name OR* | Export-SCOMManagementPack -Path “E:\monadmin\backup\$date”

Get-SCOMManagementPack -Name *Lab* | Export-SCOMManagementPack -Path “E:\monadmin\backup\$date”

 

 

Temp DB recommendations for SCOM 201x

When someone asks you about TempDB sizing, does your jaw hit the floor?

surprisesign

Time to pull out my handy detective skills

detectivehat

 

Context & Best Practices 
SQL Server uses the tempdb database to store temporary objects. This can include temporary tables, stored procedures, work tables, and row versions. In short, most changes to user databases are routed through the tempdb database. Increasing the number of tempdb data files enables SQL Server to perform more concurrent operations, by distributing activity over multiple physical files.

Tip Modify properties of tempdb data files to have identical initial size and growth increment.

 

Support article

sqlconcurrencytempdb

 

The Risk Assessment tool (RAS) states

Increase the number of tempdb files in line with best practice guidance. As a general guideline, in an environment where tempdb is used heavily, the number of tempdb data files should be between 0.25 to 1.0 times the number of physical processor cores. On servers with more than eight physical cores, start with eight data files, and then increase or decrease the number of data files as needed.

Example – 4 core SQL server needs at least 1 TempDB file

 

Supporting resources
2016 TempDB Database information https://msdn.microsoft.com/en-us/library/ms190768.aspx
TempDB sizing https://msdn.microsoft.com/en-us/library/ms345368.aspx
Optimizing TempDB Performance https://msdn.microsoft.com/en-us/library/ms175527.aspx

Supported SQL version for System Center

I’ve also been asked what versions of SQL work with System Center, so here’s references to see what the latest supported SQL version and patch.

Here is the System Center SQL matrix

2016 https://docs.microsoft.com/en-us/system-center/scom/plan-sqlserver-design?view=sc-om-2016#sql-server-requirements

2019 https://docs.microsoft.com/en-us/system-center/scom/plan-sqlserver-design?view=sc-om-2019#sql-server-requirements

2012R2 https://technet.microsoft.com/en-us/library/dn281933.aspx

Sizing SCOM 2012R2 and 2016

Many times, the question comes up for Microsoft sizing guidelines for Operations Manager/SCOM.  The Sizing Calculator XLS is a great resource to use to help answer some of the storage and SQL DB questions as it relates to the various features you enable in your environment.

The sizing calculator takes features beyond windows agents to help size SQL and storage needs, as well as management servers.

The SCOM Sizing Calculator XLS from TechNet helps determine capacity and storage needs for 2012 and 2016.  Here is the 2016 System Center SQL matrix

http://download.microsoft.com/download/C/A/6/CA60425C-950B-456E-986C-C5F2FCD5668D/System%20Center%202012%20Operations%20Manager%20Sizing%20Helper%20Tool%20v1.xls

Other SCOM features that change the Operations Manager environment

# of Unix Servers

Network monitoring

Application Performance Monitoring (APM)

URL monitoring (transactional and availability)

DB Data retention requirements