Today I will follow up on my colleague’s post Mr ITblog (Knut Huglen) about monitoring Orchestrator Runbook events. He has build a nice double up SNMP loopback feature that does self monitoring in Orchestrator resulting in entries written to a special Windows Eventlog. Now we need to raise alerts in SCOM when one of his runbooks fails or sends a platform event, who knows there could be trouble lurking in his paradise.
We are not going to do anything fancy, however these are the steps we will be focusing on today:
Import the Management Pack into SCOM and move on to the Authoring section in the SCOM console. Create a new rule:
Give the rule a name and remember to disable the rule (remove the check in “rule is enabled”):
Select ad/or browse your Orcestrator server and find the eventlog created in Knut’s post (see link above):
If you like you could create a filter using “Event level less than Information” to collect all events on level warning and error, however you may want to create two separate rules to control the alert level on the next screen:
Next you can create a new rule and filter on Event Level Warning to create alerts with severity level warning in SCOM.
Since we created the rule as “disabled”, we will have to create an override to enable the rule for the Orchestrator server(s). We will use the group “Orchestrator Runbook Servers Group” that comes with the Management Pack from Microsoft. Right click your rule and select “Overrides – Override the rule – For a group” and search for the group in question.
Create an test platform event of type Error and test your rule. You should have something like this:
That is it. Keep spreading love and understanding!
Cheers
We are not going to do anything fancy, however these are the steps we will be focusing on today:
- Create a Management Pack for our customizations
- Create rules that collects the events from the orchestrator server
Import the Management Pack into SCOM and move on to the Authoring section in the SCOM console. Create a new rule:
Give the rule a name and remember to disable the rule (remove the check in “rule is enabled”):
Select ad/or browse your Orcestrator server and find the eventlog created in Knut’s post (see link above):
If you like you could create a filter using “Event level less than Information” to collect all events on level warning and error, however you may want to create two separate rules to control the alert level on the next screen:
Next you can create a new rule and filter on Event Level Warning to create alerts with severity level warning in SCOM.
Since we created the rule as “disabled”, we will have to create an override to enable the rule for the Orchestrator server(s). We will use the group “Orchestrator Runbook Servers Group” that comes with the Management Pack from Microsoft. Right click your rule and select “Overrides – Override the rule – For a group” and search for the group in question.
Create an test platform event of type Error and test your rule. You should have something like this:
That is it. Keep spreading love and understanding!
Cheers
Comments
Post a Comment