Configure SNOW Subscriptions

ServiceNowLogo - Create SCOM subscriptions — ServiceNowLogo – Create SCOM subscriptions

Depending on requirements, creating multiple subscriptions within SCOM to leverage subscriber/channels required. Selecting rules/monitors, and resolution state conditions to help Application teams get incidents for key issues requiring intervention. NOTE Depending on what was command channels were created for various AssignmentGroup(s) and Team(s) within the organization.

Configure ‘TEST Holman’s Command Channel’ subscription

Configure channel to execute logAlert.ps1 command channel to verify SCOM outputs

SCOM Navigation steps:

Click on Administration Tab > Notifications > Channels

Click New

Name

TEST Holman’s Command Channel

Description

C:\MonAdmin\Scripts\LogAlert.ps1 Utilize LogAlert.ps1 example from Holman’s blog. Specific Subscription details: +CRITERIA = ALL Alerts +RESOLUTIONSTATE = NEW (0) +SUBSCRIBER = CHANNEL SCOM Command Channel Subscriber via POWERSHELL +CHANNEL Test LogAlert.ps1 SCOM Command Channel

Setup and use Holman’s script execution channel blog to test what account SCOM uses for notifications

https://kevinholman.com/2021/08/25/what-account-will-command-channel-notifications-run-as-in-scom/

Click on Settings

Example screenshot from Holman’s blog

Full path of Command file:

C:\windows\system32\WindowsPowerShell\v1.0\powershell.exe

Command line parameters

-executionPolicy bypass -noprofile -file “C:\MonAdmin\scripts\logalert.ps1” -AlertID “$Data[Default=’NotPresent’]/Context/DataItem/AlertId$” -AlertName “$Data[Default=’NotPresent’]/Context/DataItem/AlertName$” -AlertDescription “$Data[Default=’NotPresent’]/Context/DataItem/AlertDescription$” -Severity “$Data[Default=’NotPresent’]/Context/DataItem/Severity$” -ResolutionState “$Data[Default=’NotPresent’]/Context/DataItem/ResolutionState$” -ManagedEntityPath “$Data[Default=’NotPresent’]/Context/DataItem/ManagedEntityPath$” -ManagedEntityDisplayName “$Data[Default=’NotPresent’]/Context/DataItem/ManagedEntityDisplayName$” -ManagedEntityFullName “$Data[Default=’NotPresent’]/Context/DataItem/ManagedEntityFullName$” -ManagedEntity “$Data[Default=’NotPresent’]/Context/DataItem/ManagedEntity$” -CreatedByMonitor “$Data[Default=’NotPresent’]/Context/DataItem/CreatedByMonitor$” -WorkflowId “$Data[Default=’NotPresent’]/Context/DataItem/WorkflowId$” -DataItemCreateTimeLocal “$Data[Default=’NotPresent’]/Context/DataItem/DataItemCreateTimeLocal$” -WebConsoleUrl “$Target/Property[Type=”Notification!Microsoft.SystemCenter.AlertNotificationSubscriptionServer”]/WebConsoleUrl$?DisplayMode=Pivot&AlertID=$UrlEncodeData/Context/DataItem/AlertId$”

Startup folder for the command line:

C:\MonAdmin\SCRIPTS

Click Finish

Configure New-SNOWEvent command channel in SCOM

Grab file from GitHub repository https://github.com/theKevinJustin/New-SNowEvent

As needed, save TXT file as .ps1 on SCOM MS’s

Design recommendation

Create multiple command channels depending on assignment group and team(s) to pass these variables to the script.

NOTE path to setup channel execution, AssignmentGroup, and Team variables

Configure ‘TEST SNOW Event Creation’ SCOM Notification command channel

NOTE Use these steps to create multiple command channels, as the AssignmentGroup and Team may differ depending on Application Owners

SCOM Navigation steps:

Click on Administration Tab > Notifications > Channels

Click New

Name

TEST SNOW Event Creation

Description

C:\MonAdmin\Scripts\New-SNowEvent.ps1 Outputs 711 Events into Operations Manager event log.

Specific Subscription details: +CRITERIA = ALL Alerts +SUBSCRIBER = CHANNEL New-SNowEvent.ps1 via POWERSHELL +CHANNEL ServiceNow SNOW Event Creation Channel

New-SNOWEvent.ps1 command channel creates ServiceNow SNOW events for alerts and incidents.

This channel will also update the SCOM alert TicketID, Owner, ResolutionState to modify SCOM alert with SNOW information, or information passed in SNOW event.

See blog for more details https://kevinjustin.com/blog/2024/03/27/servicenow-event-integration/

Click on Settings

Full path of Command file:

C:\windows\system32\WindowsPowerShell\v1.0\powershell.exe

Command line parameters

-executionPolicy bypass -noprofile -file “C:\MonAdmin\scripts\New-SNowEvent.ps1” -AlertID “$Data[Default=’NotPresent’]/Context/DataItem/AlertId$” -AlertName “$Data[Default=’NotPresent’]/Context/DataItem/AlertName$” -AssignmentGroup “JustinTime System Admin” -Team SYM

Startup folder for the command line:

C:\MonAdmin\SCRIPTS

Click Finish

Create new channel for New-SNowIncident.ps1

Grab file from GitHub repository https://github.com/theKevinJustin/New-SNOWIncidents

As needed, save New-SNowIncident file as .ps1 on SCOM MS’s

Design recommendation

Create multiple command channels depending on assignment group and team(s) to pass these variables to the script.

NOTE path to setup channel execution, AssignmentGroup, and Team variables

Configure ‘TEST SNOW Event Creation’ SCOM Notification command channel

NOTE Use these steps to create multiple command channels, as the AssignmentGroup and Team may differ depending on Application Owners

SCOM Navigation steps:

Click on Administration Tab > Notifications > Channels

Click New

Name

TEST SNOW Event Creation

Description

C:\MonAdmin\Scripts\New-SNowEvent.ps1 Outputs 711 Events into Operations Manager event log.

Specific Subscription details: +CRITERIA = ALL Alerts +SUBSCRIBER = CHANNEL New-SNowEvent.ps1 via POWERSHELL +CHANNEL ServiceNow SNOW Event Creation Channel

New-SNOWEvent.ps1 command channel creates ServiceNow SNOW events for alerts and incidents.

This channel will also update the SCOM alert TicketID, Owner, ResolutionState to modify SCOM alert with SNOW information, or information passed in SNOW event.

See blog for more details https://kevinjustin.com/blog/2024/03/27/servicenow-event-integration/

Click on Settings

Full path of Command file:

C:\windows\system32\WindowsPowerShell\v1.0\powershell.exe

Command line parameters

Startup folder for the command line:

C:\MonAdmin\SCRIPTS

Click Finish

Configure SCOM Subscribers

Read the ‘Configure SCOM Subscribers’ blog to build out the SNOW subscribers for multiple PowerShell command channels. Create subscribers according to design requirements.

CHANNEL New-SNowEvent.ps1 via POWERSHELL

Follow the screenshots and fill in the wizard per the steps below.

Subscriber Name:

CHANNEL New-SNowEvent.ps1 via POWERSHELL

Click Next

SCOM subscriber wizard to Configure SCOM Subscribers - New-SNowEvent subscriber wizard — SCOM subscriber wizard to Configure SCOM Subscribers – New-SNowEvent subscriber wizard

Verify ‘always’ radio button is selected

NOTE If notifications required during specific times, configure as needed

Click Next

SCOM subscriber wizard - New-SNowEvent for Schedule radio button — SCOM subscriber wizard – New-SNowEvent for Schedule radio button

Type SnowEvent in Address name: text box

Click Next

SCOM Subscriber New-SNowEvent Address field in wizard

Change ‘Channel Type’ dropdown to Command

Select ‘ServiceNow SNOW Event Creation Channel’ Command Channel from dropdown

Click Next

SCOM Subscriber wizard - New-SNowEvent Channel drop down details — SCOM Subscriber wizard – New-SNowEvent Channel drop down details

On the Schedule tab, click Finish

SCOM Subscriber wizard - New-SNowEvent Schedule tab > Always send radio button — SCOM Subscriber wizard – New-SNowEvent Schedule tab > Always send radio button

Click Finish again to complete subscriber

SCOM Subscriber wizard - Suscriber final Finish window — SCOM Subscriber wizard – Suscriber final Finish window

Repeat steps to ‘Configure additional ‘SCOM Subscribers’

CHANNEL Test LogAlert.ps1 SCOM Command Channel via POWERSHELL

Optional create subscriber, depending on design requirements

CHANNEL Test New-SNowIncident.ps1 SCOM Command Channel via POWERSHELL

Additional Documentation to Create SCOM subscribers

SCOM2019 https://learn.microsoft.com/en-us/system-center/scom/manage-notifications-create-subscriptions?view=sc-om-2022

SCOM2022 https://learn.microsoft.com/en-us/system-center/scom/manage-notifications-create-subscriptions?view=sc-om-2022

Create SCOM Command Channels

Time to update SCOM, specifically to ‘create SCOM Command Channels’, then subscribers, and subscriptions. Depending on requirements, create multiple channels within SCOM.

Save .ps1 file(s) to SCOM MS

LogAlert.ps1 to verify SCOM notification account

New-SNowEvent.ps1 to inject events into ServiceNow

New-SNowIncident.ps1 to inject incidents into ServiceNow

Save LogAlert.ps1

Create Command channel script and save to SCOM MS(s)

From Kevin Holman blog https://kevinholman.com/2021/08/25/what-account-will-command-channel-notifications-run-as-in-scom/

Open in (notepad/notepad++/VSCode, PowerShell ISE) editor, paste the following:

param($AlertID, $AlertName, $AlertDescription, $Severity, $ResolutionState, $ManagedEntityPath, $ManagedEntityDisplayName, $ManagedEntityFullName, $ManagedEntity, $CreatedByMonitor, $WorkflowId, $DataItemCreateTimeLocal, $WebConsoleUrl)

$ScriptName = “logalert.ps1”

$EventID = “710”

$whoami = whoami

$momapi = New-Object -comObject MOM.ScriptAPI

# Begin logging script starting into event log

write-host “Script is starting. `n Running as ($whoami).”

$momapi.LogScriptEvent($ScriptName,$EventID,0,”Script is starting. `n Running as ($whoami).”)

#Log script event that we are starting task

$momapi.LogScriptEvent($ScriptName,$EventID,0,”Script is starting. `nRunning as ($whoami). `nAlertID: ($AlertID) `nAlertName: ($AlertName) `nAlertDescription:($AlertDescription) `nSeverity:($Severity) `nResolutionState: ($ResolutionState) `nManagedEntityPath: ($ManagedEntityPath) `nManagedEntityDisplayName: ($ManagedEntityDisplayName) `nManagedEntityFullName: ($ManagedEntityFullName) `nManagedEntity: ($ManagedEntity) `nCreatedByMonitor: ($CreatedByMonitor) `nWorkFlowId: ($WorkflowId) `nDataItemCreateTimeLocal: ($DataItemCreateTimeLocal) `nWebConsoleURL: ($WebConsoleUrl)”)

write-host “LogAlert.ps1 script logging SCOM Notification channel account whoami = $($whoami)” >> C:\MonAdmin\scripts\TestOutputChannel.txt

Save content as LogAlert.ps1 on SCOM MS’s

NOTE path to setup channel execution

Save New-SNowEvent.ps1

Create Command channel script and save to SCOM MS(s)

Grab file from GitHub repository https://github.com/theKevinJustin/New-SNowEvent

As needed, save New-SNowEvent file as .ps1 on SCOM MS’s

Save New-SNowIncident.ps1

Depending on design requirements, grab file from GitHub repository https://github.com/theKevinJustin/New-SNOWIncidents

As needed, save New-SNowIncident file as .ps1 on SCOM MS’s

Configure ‘Test LogAlert.ps1 SCOM Command Channel’

This command channel helps admins determine variables possible to pass to PowerShell script(s).

SCOM Navigation steps:

Click on Administration Tab > Notifications > Channels

Click New

Name

Test LogAlert.ps1 SCOM Command Channel

Description

Test LogAlert.ps1 SCOM Command Channel using Holman’s blog https://kevinholman.com/2021/08/25/what-account-will-command-channel-notifications-run-as-in-scom/

Full path of the command file:

C:\windows\system32\WindowsPowerShell\v1.0\powershell.exe

Command line parameters:

-executionPolicy bypass -noprofile -file “C:\MonAdmin\scripts\LogAlert.ps1” -AlertID “$Data[Default=’NotPresent’]/Context/DataItem/AlertId$” -AlertName “$Data[Default=’NotPresent’]/Context/DataItem/AlertName$” -AlertDescription “$Data[Default=’NotPresent’]/Context/DataItem/AlertDescription$” -Severity “$Data[Default=’NotPresent’]/Context/DataItem/Severity$” -ResolutionState “$Data[Default=’NotPresent’]/Context/DataItem/ResolutionState$” -ManagedEntityPath “$Data[Default=’NotPresent’]/Context/DataItem/ManagedEntityPath$” -ManagedEntityDisplayName “$Data[Default=’NotPresent’]/Context/DataItem/ManagedEntityDisplayName$” -ManagedEntityFullName “$Data[Default=’NotPresent’]/Context/DataItem/ManagedEntityFullName$” -ManagedEntity “$Data[Default=’NotPresent’]/Context/DataItem/ManagedEntity$” -CreatedByMonitor “$Data[Default=’NotPresent’]/Context/DataItem/CreatedByMonitor$” -WorkflowId “$Data[Default=’NotPresent’]/Context/DataItem/WorkflowId$” -DataItemCreateTimeLocal “$Data[Default=’NotPresent’]/Context/DataItem/DataItemCreateTimeLocal$” -WebConsoleUrl “$Target/Property[Type=”Notification!Microsoft.SystemCenter.AlertNotificationSubscriptionServer”]/WebConsoleUrl$?DisplayMode=Pivot&AlertID=$UrlEncodeData/Context/DataItem/AlertId$”

Startup Folder for Command Line:

C:\MonAdmin\SCRIPTS

Click Finish

Configure ‘ServiceNow SNOW Event Creation Channel’

SNOW Event command channel injects ServiceNow SNOW events, with logic to check for alert, incident, then update the SCOM alert TicketID, Owner, ResolutionState based on runtime.

SCOM Navigation steps:

Click on Administration Tab > Notifications > Channels

Click New

Name

ServiceNow SNOW Event Creation Channel

Use New-SNowEvent.ps1 to create SCOM subscription that creates SNOW incidents, then updates SCOM alert with TicketID, Owner, Resolution State for SCOM alert.

Full path of the command file:

C:\windows\system32\WindowsPowerShell\v1.0\powershell.exe

Command line parameters:

Startup Folder for Command Line:

C:\MonAdmin\SCRIPTS

Click Finish

Configure ‘ServiceNow SNOW Incident creation channel’

This command channel helps admins determine variables possible to pass to PowerShell script(s).

SCOM Navigation steps:

Click on Administration Tab > Notifications > Channels

Click New

Name

ServiceNow SNOW Incident creation channel

Use New-SNowIncident.ps1 to create SCOM subscription that creates SNOW incidents, then updates SCOM alert with TicketID, Owner, Resolution State for SCOM alert.

Full path of the command file:

C:\windows\system32\WindowsPowerShell\v1.0\powershell.exe

Command line parameters:

-executionPolicy bypass -noprofile -file “C:\MonAdmin\scripts\New-SNowIncident.ps1” -AlertName “$Data[Default=’Not Present’]/Context/DataItem/AlertName$” -AlertID “$Data[Default=’NotPresent’]/Context/DataItem/AlertId$” -Impact 4 -Urgency 4 -Priority 3 -AssignmentGroup “RCC-C – System Admin” -BusinessService SYSMAN -Category “SYSMAN Support” -SubCategory Repair -Channel Direct

Startup Folder for Command Line:

C:\MonAdmin\SCRIPTS

Click Finish

Test SNOW script

Time to ‘Test SNOW script’ for event or incident injection. As long as the prerequisites are verified, to include network connectivity, URL, ID, Password, etc., we’re ready to go!

Once the CredentialManager piece has been completed, by the same token you can begin testing the script. Testing can begin, whether to the SCOM Admin SA account, or to the SCOM Notifications account, or even hard coding the values into your PowerShell session.

Begin script testing

The testing leverages that you’ve downloaded various integration scripts first, then being saved on SCOM MS (management servers). The following blog posts, GitHub repo’s will set up multiple methods to test from PowerShell (command line) as SA or SVC accounts.

Create new SCOM Command Channels

LogAlert.ps1 from Kevin Holman’s blog https://kevinholman.com/2021/08/25/what-account-will-command-channel-notifications-run-as-in-scom/

New-SNowEvent GitHub repository https://github.com/theKevinJustin/New-SNowEvent

New-SNowIncident.ps1 GitHub repository https://github.com/theKevinJustin/New-SNOWIncidents

Once files are saved, copy to SCOM MS (noting path for later tests).

Preferred choice is non-system disk (i.e. D:)

Lab example is C:\MonAdmin\Scripts

RDP to server with SVC or SCOM Admin SA account

Open PowerShell as administrator

Change directory to script directory on SCOM MS

cd \ ; cd MonAdmin/scripts

Inventory saved files via dir (gci):

gci New-SNOW[ie]*.ps1

gci LogAlert.ps1

Grab Critical alert from $Alerts array

$Alerts = get-scomalert -ResolutionState 0 -severity 2

# Test warning events with Severity 1

# $Alerts = get-scomalert -ResolutionState 0 -severity 1

$AlertID = $Alerts[0].ID

$AlertName = $Alerts[0].Name

$AssignmentGroup = “JustinTime Infra”

PowerShell SCOM alert variables assumed for script to run from PowerShell

Test script supplying variables

.\New-SNowEvent.ps1 -AlertID $AlertID -AlertName $AlertName -AssignmentGroup $AssignmentGroup -Team SYM

.\New-SNowIncident.ps1 -AlertID $AlertID -AlertName $AlertName -AssignmentGroup $AssignmentGroup -Team SYM

New-SNOWEventPowerSHellOutput for REST Event injection.

Verify SCOM alert updated for ServiceNow REST injection

Check SCOM console/web console for SCOM alert updates to ResolutionState, TicketID, Owner fields, where TEAM = SYM, and Assignment Group = JustinTime Infra specified

SCOM Monitoring tab Active Alerts output view showing Owner, ResolutionState, and TicketId fields updated.

Be aware of issues

Indicator of Certificate/trust issue

Invoke-RestMethod error seen when organization cert not installed, making server sending REST injection NOT trusted.

Indicator when SNOW alert rule not configured or matching – excessive retry’s. Also note output shows summary of tests, ServiceNow SNOW detail, and SCOM alert updates.

New-SNOWEvent.ps1 failures when SNOW Alert rule not matching or created.

Logging to Operations Manager Event Log for addtional troubleshooting or debug. Unless otherwise updated, the script logs to the ‘Operations Manager’ event log, EventID = 710-712

Single Starting event indicates failed pre-requisite (pre-req NOT met)

SCOM OperationsManager events logging integration script status, as well as whoami and additional debug.

Additional information

ServiceNow Event integration

ServiceNow Incident Integration

Setup SCOM Notifications account

With domain joined machine, use a separate notification services svc account for notifications. SCOM is typically leverages MSAA, or even local system, depending on the accounts used when building out SCOM. Kevin Holman did an excellent job blogging this here

Verify SCOM notification account

Verify and ‘Setup SCOM Notifications account’ to separate notifications outside typical SCOM service SVC account functionality. Also, separating allows CredentialManager to secure, encrypt, and store credentials used by the notification account. Time to verify!

RDP to SCOM MS using notification account.

Open SCOM Console

Click on Administration tab

Expand Run As Configuration

Click on Accounts

Search for notification

Double click on Notifications account

Click on Credentials tab

Verify account being used, in light of CredentialManager piece storing SNOW ID and account.

NOTE Account should be part of SCOM Admins AD group

SCOM console view of Notifications SVC Account

SCOM Notifications Event Log troubleshooting

Knowing the notifications account will aid with SNOW integration scripts, as well as help log whoami, ‘run as’ logging to the ‘Operations Manager’ event log. The specific test and event or incident scripts leverage EventID’s 710-712. 710 for LogAlert.ps1, 711 for New-SNowEvent.ps1, and 712 for New-SNowIncident.ps1.

Single Starting event indicates failed pre-requisite (pre-req NOT met)

Additional SCOM Notifications documentation

Learn articles

SCOM2019 https://learn.microsoft.com/en-us/system-center/scom/manage-notifications-create-configure?view=sc-om-2019

SCOM2022 https://learn.microsoft.com/en-us/system-center/scom/manage-notifications-create-configure?view=sc-om-2022

Additional blog posts explaining ServiceNow connectivity

Options https://kevinjustin.com/blog/2024/05/24/lots-of-options-to-create-servicenow-incidents-through-powershell-scripts-connectors-and-3rd-party-vendors/

PreReqs https://kevinjustin.com/blog/2024/05/30/snow-rest-integration-prerequisites/
Network and Credential https://kevinjustin.com/blog/2024/05/30/snow-rest-connectivity/

Event Integration https://kevinjustin.com/blog/2024/03/27/servicenow-event-integration/

Incident Integration https://kevinjustin.com/blog/2024/03/27/servicenow-incident-integration/

ServiceNow Connector https://kevinjustin.com/blog/2024/04/30/servicenow-connector-for-scom/

Updated Skype for Business 2015 (premise) Addendum MP

Updated and completed for Company Knowledge!

Many thanks to Nick Wood for his help deciphering user impact for these alerts.

Reach out to Nick on LinkedIn

This has been an arduous effort to complete the Skype alerts and components.

Gallery Download

It’s taken a few steps along the way, to get all the content delivered.

To read the whole Skype Addendum journey, please read these additional blog posts
June blog
January blog

The initial Addendum pack with just service recoveries and Azure overrides

Old pack https://gallery.technet.microsoft.com/Skype-for-Business-2015-b005f49f
This download disabled Azure, set service recovery tasks

The new Gallery download contains the following:

Skype SCOM Alerts.xls
Microsoft.LS.2015.Monitoring.ComponentAndUser.Addendum.xml
Microsoft.SystemCenter.Notifications.Internal.xml
Skype.for.Business.Server.Management.Pack.Alert.Grooming.xml

NOTE The Skype.for.Business.Server.Management.Pack.Install.txt file contains the information as well

#############################################################
#
# Breakdown of files
#
#############################################################

#
# Skype SCOM Alerts.xls
# Skype SCOM Alerts XLS is is MP Export excerpt formatted for XLS workbook
#
# Feel free to search this file

# Column D is ‘Escalate to Who’
# This has values as SCOM Engineering, Messaging Ops, Telephony, Messaging Engineering
# Column E is impact
# This has values: P3-P5, *Email
# Column F is the Display String for the monitor
# Column H has the User Impact, Cause, and Troubleshooting steps

#
# Microsoft.LS.2015.Monitoring.ComponentAndUser.Addendum.xml
# Addendum management pack sets up company knowledge tab for each Skype monitor, with actionable troubleshooting steps.
#

#
# Microsoft.SystemCenter.Notifications.Internal.xml
#

# Backup the current MP first, and merge if you are adding this to your environment!
# Use this pack cautiously, as it will replace existing Channels, subscribers, subscriptions.

# On Management server, open PowerShell window as Admin
#
# cd <path>
# Example

cd $HOME/desktop
Get-SCOMManagementPack -Name *Notification* | export-SCOMmanagementpack -path “C:\”

Copy-item .\Microsoft.SystemCenter.Notifications.Internal.xml .\Original-<CompanyName>-Microsoft.SystemCenter.Notifications.Internal.xml

# Save the bundled Notifications pack to the same path

# YES it’s that important, the file can eliminate any alerts leaving SCOM!
#
# Save file to local drive

# Follow MP Fragment authoring if you need to merge existing Notifications with Skype pack
# https://kevinholman.com/2016/06/04/authoring-management-packs-the-fast-and-easy-way-using-visual-studio/
#

#
# Skype.for.Business.Server.Management.Pack.Alert.Grooming.xml
#
# This file is to set alerts per the XLS, making warnings for P4,P5, email, and P3 for Critical

#
#############################################################

Ruling out SCOM as the cause of SCHANNEL events

Ruling out SCOM notifications as the cause of SCHANNEL events

Still getting SCHANNEL error events and want to rule out SCOM

Management pack SQL events https://kevinjustin.com/blog/2017/11/08/sql-native-client-for-tls1-2/

SCHANNEL ciphers debugged https://kevinjustin.com/blog/2017/11/08/schannel-event-logging/

What command Channels are setup for notifications?

Validate Subscriptions aren’t the cause for email/text

Exchange 2013 and above typically use S/MIME to digitally sign/encrypt messages

Email communication can cause System 36871 events https://support.microsoft.com/en-us/help/305088/schannel-error-message-36871-when-receiving-an-ehlo-smtp-command

Do the events correlate with emailed alerts?
Tracing Notifications http://blog.scomskills.com/enable-tracing-of-the-notification-component-om07/

SCOM ETL traces

Run traces on suspect MS

2012R2 MS (adjust drive letter according to drive SCOM install)
cd “D:\Program Files\Microsoft System Center 2012 R2\Operations Manager\Server\Tools”
2012R2 GW (adjust drive letter according to drive SCOM install)
cd “C:\Program Files\System Center Operations Manager\Gateway\Tools”
2016 MS
cd ‘C:\Program Files\Microsoft System Center 2016\Operations Manager\Server\Tools\’

# Stop Tracing
.\StopTracing.cmd
# Clean up old files
remove-item C:\windows\Logs\OpsMgrTrace\*

# Start Traces

StartTracing.cmd VER

TraceLogSM.exe -stop TracingGuidsNative

TraceLogSM.exe -stop TracingGuidsUI

# Wait until notification fires and validate if 36871 SCHANNEL event ID is logged

# Stop and format the trace
.\StopTracing.cmd
.\FormatTracing.cmd

# Review txt files from C:\windows\Logs\OpsMgrTrace

Have a lot of SCOM subscriptions?

You logged into SCOM because someone said they didn’t get a notification

Looked at subscriptions and it’s blank

Do you know if you backed up your subscriptions?

Hopefully, you read this and back up your management packs

Hope you read this blog, and it saved your life!

For those who love the Console UI

You can manually back up the MP

From the SCOM console

Click on the Administration Tab

Click on Management Packs (2012), or Installed Management Packs (2016)

Type ‘notification’ in the ‘Look for:’ bar

Hit Enter

Highlight the ‘Notifications Internal Library’ pack

Click on Export Management Pack

Name your path

Hit OK

For simple PowerShell

# Backup Management packs to C drive

# Set up your path, this example is monadmin\backup

$date = Get-Date -UFormat “%Y-%m-%d”

cd monadmin\backup

new-item -itemtype directory -path c:\monadmin\backup\$date

cd $date

Get-SCOMManagementPack -Name *Notification* | Export-SCOMManagementPack -Path “C:\monadmin\backup\$date”

Setting up OMS Capacity and Performance

Update 18 Dec 2023 – Solution retired in 2021 with OMS sunset.

https://github.com/uglide/azure-content/blob/master/articles/log-analytics/log-analytics-add-solutions.md Repository archived by the owner on Feb 1, 2021. It is now read-only.

Do you know what your HyperV hosts are doing?

Not a HyperV fan, there’s a VMWare solution also here

Documentation https://docs.microsoft.com/en-us/azure/log-analytics/log-analytics-capacity

https://github.com/uglide/azure-content/blob/master/articles/log-analytics/log-analytics-capacity.md

Capacity dashboard

Capacity and performance preview summary

Details

Setting up OMS Capacity and Performance

Already have the dashboard setup? Perhaps this will help troubleshoot

Do you have network connectivity, or is a proxy required?

Troubleshooting dashboard

Firewall https://docs.microsoft.com/en-us/azure/log-analytics/log-analytics-proxy-firewall
Windows Agents https://docs.microsoft.com/en-us/azure/log-analytics/log-analytics-windows-agents

Verify Operations Manager event log on local agent, then filter for error events and/or EventID 4506. Look for dates/times to see when events started.

Example Event ID 4506 details the Capacity and Performance Solution, citing ‘Microsoft.IntelligencePacks.CapacityPerformance.Collector’.

Operations Manager Event Log, Event ID 4506 examples

Additional options

Search LAW (Log Analytics workspace) logs

https://github.com/uglide/azure-content/blob/master/articles/log-analytics/log-analytics-log-searches.md

2. Verify no proxy is set up (unless your network requires this)

3. 4506’s result from too many workflows sending data from MS to DB’s (OpsMgr and DW). Additionally, 4506 events can be communication issues from MS to DB server(s). Lastly, use TLS1.2 configuration as a best practice to enforce encryption from MS to SQL communication. Beyond encryption, TLS may be a culprit if AlwaysOn or SQL clusters are involved, particularly as the SCOM console connections fail as SDK cannot talk with SQL side. See Kevin Holman’s blog for additional TLS1.2 information and setup.

TLS blog https://kevinholman.com/2018/05/06/implementing-tls-1-2-enforcement-with-scom/

Documentation

Learn article https://learn.microsoft.com/en-us/answers/questions/212007/scom-errors-no-data-in-summary-performance-dashboa
TechNet blog https://social.technet.microsoft.com/Forums/ie/en-US/10b38121-b0e1-43ec-bf3a-d22ae9ef0220/event-4506-data-was-dropped-due-to-too-much-outstanding-data-in-rule
MS RMSe https://www.system-center.me/opsmgr/event-4506-and-new-root-management-server-rms-management-server-ms/

Setting up OMS Service Map solution

hmmmm

Ever wonder what happened to BlueStripe?

Anyone else have experience using it with SCOM?

If you weren’t aware, Microsoft bought Blue Stripe back in 2015 link

Looks like BlueStripe FactFinder is now Service Map in Azure

Documentation here

Service Map is very easy to add and get value from right away with OMS

Download agent

You have two choices:

Choose from Docs.Microsoft.com documentation above, or from your OMS environment
From your OMS workspace, add the Service Map solution

Click on Home icon in top left hand corner

omshome

Click on Service Map pane

Click on Download Agent link as appropriate for Windows or Linux

Save file and install on your server(s)

oms-initialscreen

Windows Server Installation

Execute the MSI file downloaded from OMS (NOTE may prompt with UAC prompt)

Click ‘I Agree’

servicemapinstall

Watch the Install

servicemapinstalling

Click Finish

servicemapinstallcomplete

Now go back to OMS and look for updates (mine was that fast!)

servicemapsolution

Click on the Service Map pane to see more detail

servicemapdetail

To add additional machines is basically the same, just choose add machines

oms-addmachines

In case you caught that I have two (2) of the same named machines, it’s because I have that server set up for OMS separately. Yes, it’s my lab, so I’m not following the best practice.

servicemapsolutionwclients

Enjoy!