My first challenge for myself was to get a list of all the installed VMS on my computer using the VirtualBox COM Object. This was made simple with PowerShell thanks to the Get-Member (gm) command, which enumerates all the methods and properties of any object (in this case the VirtualBox.VirtualBox object).

To get a list of all the methods and properties available I ran this command.

New-Object -ComObject VirtualBox.VirtualBox | gm

Which gave me the following back.

   TypeName: System.__ComObject#{3f36e024-7fed-4f20-a02c-9158a82b44e6}
 
Name                        MemberType Definition
----                        ---------- ----------
CheckFirmwarePresent        Method     int CheckFirmwarePresent (FirmwareType,...
CreateAppliance             Method     IAppliance CreateAppliance ()
CreateDHCPServer            Method     IDHCPServer CreateDHCPServer (string)
CreateHardDisk              Method     IMedium CreateHardDisk (string, string)
CreateLegacyMachine         Method     IMachine CreateLegacyMachine (string, s...
CreateMachine               Method     IMachine CreateMachine (string, string,...
CreateSharedFolder          Method     void CreateSharedFolder (string, string...
FindDHCPServerByNetworkName Method     IDHCPServer FindDHCPServerByNetworkName...
FindDVDImage                Method     IMedium FindDVDImage (string)
FindFloppyImage             Method     IMedium FindFloppyImage (string)
FindHardDisk                Method     IMedium FindHardDisk (string)
FindMachine                 Method     IMachine FindMachine (string)
GetDVDImage                 Method     IMedium GetDVDImage (string)
GetExtraData                Method     string GetExtraData (string)
GetExtraDataKeys            Method     SAFEARRAY(string) GetExtraDataKeys ()
GetFloppyImage              Method     IMedium GetFloppyImage (string)
GetGuestOSType              Method     IGuestOSType GetGuestOSType (string)
GetHardDisk                 Method     IMedium GetHardDisk (string)
GetMachine                  Method     IMachine GetMachine (string)
OpenDVDImage                Method     IMedium OpenDVDImage (string, string)
OpenExistingSession         Method     void OpenExistingSession (ISession, str...
OpenFloppyImage             Method     IMedium OpenFloppyImage (string, string)
OpenHardDisk                Method     IMedium OpenHardDisk (string, AccessMod...
OpenMachine                 Method     IMachine OpenMachine (string)
OpenRemoteSession           Method     IProgress OpenRemoteSession (ISession, ...
OpenSession                 Method     void OpenSession (ISession, string)
RegisterCallback            Method     void RegisterCallback (IVirtualBoxCallb...
RegisterMachine             Method     void RegisterMachine (IMachine)
RemoveDHCPServer            Method     void RemoveDHCPServer (IDHCPServer)
RemoveSharedFolder          Method     void RemoveSharedFolder (string)
SetExtraData                Method     void SetExtraData (string, string)
UnregisterCallback          Method     void UnregisterCallback (IVirtualBoxCal...
UnregisterMachine           Method     IMachine UnregisterMachine (string)
WaitForPropertyChange       Method     void WaitForPropertyChange (string, uin...
DHCPServers                 Property   SAFEARRAY(IDHCPServer) DHCPServers () {...
DVDImages                   Property   SAFEARRAY(IMedium) DVDImages () {get}
FloppyImages                Property   SAFEARRAY(IMedium) FloppyImages () {get}
GuestOSTypes                Property   SAFEARRAY(IGuestOSType) GuestOSTypes ()...
HardDisks                   Property   SAFEARRAY(IMedium) HardDisks () {get}
HomeFolder                  Property   string HomeFolder () {get}
Host                        Property   IHost Host () {get}
Machines                    Property   SAFEARRAY(IMachine) Machines () {get}
PackageType                 Property   string PackageType () {get}
PerformanceCollector        Property   IPerformanceCollector PerformanceCollec...
ProgressOperations          Property   SAFEARRAY(IProgress) ProgressOperations...
Revision                    Property   uint Revision () {get}
SettingsFilePath            Property   string SettingsFilePath () {get}
SharedFolders               Property   SAFEARRAY(ISharedFolder) SharedFolders ...
SystemProperties            Property   ISystemProperties SystemProperties () {...
Version                     Property   string Version () {get}

From there I made use of the Machines property to get a collection of all the virtual machines on my computer, the finished script looks something like this.

# Check if VBox is installed
if( (Test-Path -Path hklm:\SOFTWARE\Oracle\VirtualBox) -eq $false ){
    Write-Host "Virtual Box is not installed!"
    Exit
}
 
# Create the VBox COM Object
$comVB   = New-Object -ComObject VirtualBox.VirtualBox
$arrVMS  = $comVB.Machines
$counter = 1
 
# Count found VMs
if( $arrVMS.Length -eq 0 ){
    Write-Host "There are no VMs installed"
    Exit
}
 
# List the names of the VMs
foreach( $vm in $arrVMS ){
    $info = "VM" + $counter + ": " + $vm.Name + " (" + $vm.OSTypeId + ")"
    Write-Host $info
    $counter++
}

The following was written to my console.

VM1: Server 2008 Base (Windows2008)

Just checking to ensure this is valid...

I am starting to like PowerShell

Bookmark It

gci HKLM:\Software\Classes -ea 0 | ? {$_.PSChildName -match '^\w+\.\w+$' -and (gp "$($_.PSPath)\CLSID" -ea 0)} | ft PSChildName

This is all good, but I don't like all the shorthand (well not at the moment as I am trying to learn how to use PowerShell properly anyway).

I took a few seconds and making use of the Get-Alias cmdlet I rewrote the snippet to the following.

Get-ChildItem HKLM:\Software\Classes | ?{ $_.PSChildName -match '^\w+\.\w+$' -and (Get-ItemProperty "$($_.PSPath)\CLSID" -ea 0 ) } | Format-Table -Property PSChildName

This nifty script displays all the available COM Objects that I can make use of with PowerShell, can tell this is going to be a long night...

Bookmark It

After playing on Google I stumbled upon the following links to MSDN and it hit me, PowerShell is based on .net, and there are tons of scripts on the net for starting processes with .net. With the following 3 links I was able to get something working.

• http://msdn.microsoft.com/en-us/library/system.diagnostics.process.aspx
• http://msdn.microsoft.com/en-us/library/system.diagnostics.processstartinfo.aspx
• http://msdn.microsoft.com/en-us/library/system.diagnostics.processwindowstyle(VS.85).aspx

After a bit of playing I was able to come up with the following script.

$ProcessStartInfo = New-Object System.Diagnostics.ProcessStartInfo "notepad.exe"
$Process          = [System.Diagnostics.Process]::Start($ProcessStartInfo)
$Process.Id

Pretty nifty eh, but still not what I wanted. In my case I need to start the process hidden as I do not want users to interact with it, so now I need to figure out how to start the process hidden. From the 3^rd link I know that I can set the process window style to Hidden, but how do I do this?

I start by piping the $ProcessStartInfo to the Get-Member cmdlet, and behold I now know the value of the WindowStyle property.

Name                    MemberType Definition
----                    ---------- ----------
Equals                  Method     bool Equals(System.Object obj)
GetHashCode             Method     int GetHashCode()
GetType                 Method     type GetType()
ToString                Method     string ToString()
Arguments               Property   System.String Arguments {get;set;}
CreateNoWindow          Property   System.Boolean CreateNoWindow {get;set;}
Domain                  Property   System.String Domain {get;set;}
EnvironmentVariables    Property   System.Collections.Specialized.StringDict...
ErrorDialog             Property   System.Boolean ErrorDialog {get;set;}
ErrorDialogParentHandle Property   System.IntPtr ErrorDialogParentHandle {ge...
FileName                Property   System.String FileName {get;set;}
LoadUserProfile         Property   System.Boolean LoadUserProfile {get;set;}
Password                Property   System.Security.SecureString Password {ge...
RedirectStandardError   Property   System.Boolean RedirectStandardError {get...
RedirectStandardInput   Property   System.Boolean RedirectStandardInput {get...
RedirectStandardOutput  Property   System.Boolean RedirectStandardOutput {ge...
StandardErrorEncoding   Property   System.Text.Encoding StandardErrorEncodin...
StandardOutputEncoding  Property   System.Text.Encoding StandardOutputEncodi...
UserName                Property   System.String UserName {get;set;}
UseShellExecute         Property   System.Boolean UseShellExecute {get;set;}
Verb                    Property   System.String Verb {get;set;}
Verbs                   Property   System.String[] Verbs {get;}
WindowStyle             Property   System.Diagnostics.ProcessWindowStyle Win...
WorkingDirectory        Property   System.String WorkingDirectory {get;set;}

So let’s set it.

$ProcessStartInfo.WindowStyle = "Hidden"

I run this and no errors, this is promising.

A quick check of task manager confirms that I have successfully started the process, and have the correct procesID.

That’s all there is to it, albeit it took me a good hour to figure out L. Now I can continue with my script.

Here is the complete code listing to start a process and get its processID.

$ProcessStartInfo = New-Object System.Diagnostics.ProcessStartInfo "notepad.exe"
$ProcessStartInfo.WindowStyle = "Hidden"
$Process          = [System.Diagnostics.Process]::Start($ProcessStartInfo)
$Process.Id

Bookmark It

For this post I am going to be filtering alerts in SCOM by the Event Description, this is not best practice as this will add additional overhead to the SCOM agent, but in some cases this is the best solution to the problem.

The first thing that I am going to need to do is create an alert in SCOM that we can use to filter on. Lets do that.

• Open the authoring console and create a blank MP
  • I am calling mine Richard.Alert.Test
• Create a new Windows Event Alerting rule and give it a name
  • Mine will be called Richard.Alert.Test.FilterTestAlert
  • Target this rule at Windows.Server.Computer
  • For the category, select Alert (to keep things uniform).
  • Click Next
• For the Event Log Name page complete the following:
  • For the Log Name, select “Operations Manager”
  • Click Next
• For the Build Event Expression page complete the following:
  • EventID = 12345
  • Click Insert, Select “Use parameter name not specified above” and for the value enter in “EventDescription”, click OK to close the dialog
  • For the Operator select “Contains”
  • For the value, enter in “Hello World”
  • Click Next to continue
• On the Configur Alerts page complete the following:
  • Enter in an Alert Name
  • For the event description, leave this as is (for now – you can change this later)
  • If needs be, change the Priority, Severity and Suppression for the alert
  • Click Finish to complete the creation of the alert.

For testing purposes you should disable this rule explicitly and target it at your test server (I am not going to be doing this).

The next stage of this would be to import the MP into SCOM and test this guy out. The first thing I am going to do is create a test alert on my server that will not satisfy the alerting rule.

Using the following VBScript I generate the below alert on my serve, check SCOM to see that nothing comes through.

Set oAPI			= CreateObject("MOM.ScriptAPI")
eventDescription	= "This will not alert in SCOM"
scriptName			= "TestAlert.vbs"
eventID				= 12345
Call oAPI.LogScriptEvent(scriptName, eventID, 1, eventDescription)

Now that I see filtering is working, the next step is to add the text “Hello World” to the alert and see if anything comes into SCOM. To do this I modify my alert VBScript to look something like the below and run this on my server.

Set oAPI			= CreateObject("MOM.ScriptAPI")
eventDescription	= "Hello World, I should appear in SCOM"
scriptName			= "TestAlert.vbs"
eventID				= 12345
Call oAPI.LogScriptEvent(scriptName, eventID, 1, eventDescription)

The rule is working

You could take this a step further and allow the rule to filter on Regular expressions, not contains etc if you need to.

You can grab the completed Management Pack from here.

Bookmark It

What I wanted to do was create a onDomReady event and attach a timer to the page (to refresh it). I kept getting stuck however when trying to access the timer object outside the constructor method, i.e. through another function. I spent a bit of time playing around and it finally hit me that a JS file is handled like a class (well that’s how JavaScript works as a whole), and that by declaring a var outside of all my methods would make that variable accessible to any other function. See the snippet below to illustrate my point.

Incorrect:

function myTimer(){
var timer = new timer();
timer.start();
}
function externalAccess(){
	//Would never work, there is no scope to timer
	timer.stop();
}

Correct:

var timer;
 
function myTimer(){
timer = new timer();
timer.start();
}
function externalAccess(){
	//Scoped
	timer.stop();
}

This little hint might save you some time, I know I won’t forget this ever again!

Bookmark It

I make use of the @ modifier to allow me to use un-escaped strings for the key path (see regPath).

The ToString() method is used to ensure that all values are converted to strings that are able to be written out to the console.

using System;
using System.Collections.Generic;
using System.Linq;
using System.Text;
using Microsoft.Win32;
 
namespace regEnum
{
    class Program
    {
        static void Main(string[] args)
        {
            string regPath = @"Control Panel\Desktop";
            RegistryKey HKLM = Registry.CurrentUser;
            RegistryKey RegKey = HKLM.OpenSubKey(regPath);
            string[] subVals = RegKey.GetValueNames();
 
            Console.WriteLine("------------------------------------------");
            Console.WriteLine("Enumerating: HKCU\\{0}", regPath);
            Console.WriteLine("------------------------------------------");
 
            foreach (string val in subVals)
            {
                string keyName = val;
                string keyType = RegKey.GetValueKind(val).ToString();
                string keyValue = RegKey.GetValue(val).ToString();
 
                Console.WriteLine("[{0}] {1} : {2}", keyType, keyName, keyValue);
            }
 
            Console.ReadKey();
        }
    }
}

Bookmark It

using System;
using System.Collections.Generic;
using System.Linq;
using System.Text;
using Microsoft.Win32;
 
namespace regEnum
{
    class Program
    {
        static void Main(string[] args)
        {
            RegistryKey HKLM = Registry.LocalMachine;
            RegistryKey RegKey = HKLM.OpenSubKey("SOFTWARE\\Microsoft");
 
            string[] subKeys = RegKey.GetSubKeyNames();
            int subKeyCount = subKeys.Length;
 
            Console.WriteLine("There are {0} Keys in \"{1}\"", subKeyCount, RegKey.ToString());
 
            foreach (string curKey in subKeys)
            {
                Console.WriteLine(curKey);
            }
 
            Console.ReadKey();
        }
    }
}

In order to make use of the registry functions built into .net you need to include the Microsoft.Win32 class. The following logic was used to enumerate the registry keys:

1. Create a var called HKLM of type RegistryKey
2. Open the current key you want to enumerate
3. Get all the sub keys by calling the GetSubKeyNames() method.
4. Loop through the keys using foreach, printing out all the values to the console

That’s about all there seems to be in enumerating sub keys in the registry.

Bookmark It

RegistryKey HKLM = Registry.LocalMachine;
RegistryKey RegKey = HKLM.OpenSubKey("SOFTWARE\\Oracle\\VirtualBox");
MessageBox.Show(RegKey.GetValue("InstallDir").ToString());

To make use of the RegistryKey class you will need to include the Microsoft.Win32 class.

Bookmark It

Sometimes I think that we are getting messed around a lot by them...

Bookmark It

On the M$ site there is no link to download the NewSID (they have removed it) so it can be found over here. http://www.softpedia.com/get/System/System-Miscellaneous/NewSID.shtml

I have tested this on a Server 2008 Full VM and it works perfectly.

Bookmark It

The solution would be to create a custom performance collection script. The concept is basically the same for a custom script and a performance collection rule, the only catch here is that you will need to be able to create the script to do the collection. I would recommend using google to get you started with the scripting if you are not 100% sure where to start.

For the example used in this management pack I will be collecting the CPU usage of the spooler service. I will be using VBScript as this is the simplest way of collecting the information (until PowerShell is supported with wizards in the authoring console). As per normal the script is attached (rename to .vbs) to this post if you would like to have a look through it, or you can view it directly in the management pack.

Adding our collection script to the Management Pack

The first thing we will need to do is open up the Authoring Console, open our management pack and navigate over to Health Model -> Rules. Right click in the Rules pane and select New -> Collection -> Performance Based -> Script Based Performance Collection, this will launch the required wizard.

Complete the first page as follows:

ElementID: Richard.CustomMP.Spooler.CPUUsage.Perf.13002
Display Name: Richard.CustomMP: Spooler - CPU Usage (Perf) (13002)
Description: Collects the CPU usage of the spooler service vai VBScript.
Target: Richard.CustomMP.Spooler
Category: PerformanceCollection

Click Next to continue to the schedule. For the schedule I am going to run this collection every 5 min.

Click next to continue over to the script screen. Complete the following information and click the Parameters button when complete:

File Name: Richard.CustomMP.Spooler.CPUUsage.Perf.13002.vbs
Timeout: 1 Min
Script: Paste your script here

On the parameters screen, from the fly-out select the Name of the service, click OK when done.

Click Next to continue to the Performance Mapper Screen.

Our script works by connecting to WMI and querying for the relevant information regarding our service (in this case the CPU Usage), and submitting that information back to SCOM in the form of a property bag. The performance mapper section of the wizard allows us to tell SCOM which bits of the information returned needs to be collected as performance data. As you may have noticed (if you tested the script first) is that the data returned is in the form of XML which is an easy format to query. SCOM stores all the information back from the script in the $data/…$ variable, and to get the values we need to map we make use of Xpath queries against the returned XML. So basically $Data/Property[@Name='bob']$ is referring to an element name in the returned XML called bob.

Armed with my quick description of how information is given back from SCOM, lets complete the Performance Mapper page, the following information will need to be entered in:

Object: Spooler CPU
Counter: % CPU
Instance: Total
Value: $Data/Property[@Name='PercentProcessorTime']$

After importing the updated management pack and waiting 15 min I finally see the following information coming into SCOM, the only problem is that the spooler service is nothing special to look at

Click here to grab the latest build of the management pack.

[Back to MP Index]

Bookmark It

1. Performance Monitor (Perfmon)
2. Windows Management Instrumentation (WMI)

For now I am going to collect this using Perfmon (tomorrow I will use WMI). So the first thing we will need to do is fire up perfmon and have a look around for the counter that meets our needs. I know that the Process counter will contain information about the CPU usage of a process and after looking through the available instances I found that the spooldv represents our Spooler instance on my computer (this is the exe name of the service executable minus the exe portion). This is not a general rule of thumb for looking up processes in the Process counter, but for the Spooler Service it holds true.

Now that we know the counter name and instance name we can open up our authoring console and edit our management pack. Navigate to Health Model -> Rules and right click anywhere, select New -> Collection -> Performance Based -> Windows Performance Collection.

Complete the General screen with the following information:

Rule ID: Richard.CustomMP.Spooler.CPUUsage.Perf.13001
Rule Name: Richard.CustomMP: Spooler CPU Usage (Perf) (13001)
Description: Collects the CPU usage of the spooler service
Target: Richard.CustomMP.Spooler
Category: Performance Collection

Click Next to continue. On the Performance Counter screen, click the  button and select the spooler service counter from the dialog box that appears.

For the interval, select 5 min.

Click Next and Finish to complete creating your collection rule. As you can see from this example the performance collection was a piece of cake and after 10 min you can start seeing the data brought back into SCOM. A final thing I would like to point out is the “fly outs” that are available when populating the object and instance. SCOM allows you to push properties from your class or the parent of your class (and so on) to these values allowing for a totally dynamic monitoring solution. These could be useful if you needed to watch multiple counters on the same computer.

Unfortunately SCOM does not show 0 100% correctly, but as you can clearly see our collection is working and is collecting against our Richard.CustomMP.Spooler class.

You can grab the latest build of the custom management pack here,

[Back to MP Index]

Bookmark It

The health state of an object in SCOM is set with a monitor. As you know there are a wide variety of monitors available in SCOM. I am going to be making use of a script based monitor targeted at our Richard.CustomMP.Spooler class. Depending on what our script returns we will set the health of the class to Healthy or Warning. The script I am going to be making use of is fairly simple (get it here) and checks the state of the service using WMI. It returns the state and StartMode of the service as a property bag (http://msdn.microsoft.com/en-us/library/bb437556.aspx) which is something that SCOM can work with.

You can test the script by calling up a cmd window and calling “cscript SCRIPT_NAME SERVICE_NAME”. If the service was found you will get a property bag with the state and StartMode of the service, otherwise a blank property bag will be returned.

To add the health monitor script onto your Management Pack, follow the steps taken by me below.

Open up the Authoring Console and navigate to Health Model -> Monitors. Right click in the monitor’s pane and select New -> Scripting -> Two State. We are going to use a 2 state monitor as we will be setting the state of the class to healthy (service is running) or warning (service is stopped).

Complete the first screen that appears with the following information:

1. Element ID: Richard.CustomMP.Spooler.HealthMonitor.13000
2. Display Name: Richard.CustomMP: Spooler - Health Monitor (13000)
3. Description: Checks the state of the print service.
4. Target: Richard.CustomMP.Spooler
5. Parent Monitor: System.Health.AvalabilityState
6. Category: Avalability Health

The screen should look like this:

Click Next to continue. If you had read the script you would know that the interval that we want to run this is every 5 min, so set the Schedule for your script to that.

Click Next to go to the Script screen. Complete this screen by giving the script a name (don’t forget the .vbs at the end of it). Drop your script into the script pane and hit the Parameters button. The only parameters that this script needs is the service name and computer name (the computer name is used for logging the script events). Use the fly outs to add in the service name and the computer name (as the image shows below):

When finished your parameter screen should look something like this:

Once you have set your parameter, click OK to close the parameters window, and Next on the Script screen. Now we need to configure the unhealthy expression for our monitor. I have decided that in order for the monitor to be unhealthy the service should not be in a running state. Click the Insert button to add a condition to the screen. For the Parameter Name enter in Property[@Name=’State’] (XPath - http://www.w3schools.com/xpath/xpath_syntax.asp) to access the state value inside the property bag, for the operator choose the does not equal qualifier, finally for the value enter in Running. When complete your expression screen should look something like this:

Note: ensure that you use the single quotation marks if you copy the XPath query from this post (replaces them with ‘). Click Next to continue for the Healthy Expression screen. For the service to be healthy I want it to be in a Running state. Complete the expression as follows and click Finish to complete the wizard.

You should now have a monitor under the Richard.CustomMP.Spooler class:

We now need to configure the states of the monitor. To do this right click on the monitor and select properties, on the screen that appears click the Health tab. Ensure that the health of the monitor is set to Healthy for the healthy state and Warning for the unhealthy state:

If you would like to you can configure the monitor alert when its state changes to warning (this is not covered here to save time). Click OK to close the properties dialog box and save the changes made to your management pack.

The final thing we will need to do is import this into our lab to ensure that our new monitor is working. Import the pack and wait until the script has run (every interval of 5 min from 12:00 am), if everything goes well the state of your Richard.CustomMP.Spooler should change to Healthy:

Try stopping the Print Spooler service on a random computer, wait 5 min and see how the state changes for the discovered instance of the Richard.CustomMP.Spooler class.

Note: I have changed the interval for the discovery (Richard.CustomMP.Spooler.Discovery.10001) to run every 1 hour as 5 min is a bit too much, but in a production environment 1 hour is still too much. That’s pretty much all there is to a script based monitor. There is a lot of content to take in with this post so maybe a second read through might make things a bit clearer. I have attached the complete management pack if you would like to see all the components in action.

Grab the current management pack here.

[Back to MP Index]

Bookmark It

Once imported start watching the Event Viewer and keep a keen eye on the Operations Manager log.

In the SCOM console navigate to the Monitoring pane and select Discovered Inventory, using the Change Target Type button on the left hand pane select your new class from the list presented:

We now need to wait for the discovery to run (hence why I am using a 5 min interval), I am watching the event log for either an error telling me why our discovery has not run or the following event to appear:

The above event was the “logDiscoveryRun“ function that I added to my script – very useful.

If you see that the discovery has run through successfully and no errors following it, you should now be able to refresh the Discovered Inventory and see your new class populated with items.

Here are some basic things to check if you are unable to run the discovery:

1. Look in the health store if the script has been received by SCOM
2. Manually run the script with the parameters provided in the comments
3. Have a look at the run-as accounts
4. Check that the file association with vbs is not incorrectly associated
5. Ensure that the discoveries script name ends with a .vbs
6. Look to see if the computer has been getting updates
7. Check if you can connect to the target computer
   1. Check event logs for errors
   2. Check telnet connectivity to MS on port 5723
   3. Check if there is a Health Store for the computer
   4. Restart the SCOM service and watch for errors
   5. Rebuild the Health Store
   6. Check certificates if the computer is not on a domain
   7. Re-Install the SCOM agent on the computer if all else fails

As you can see, the discovered items are in a not monitored state, but this is the topic for our next few posts:

1. Creating a Health Monitor Script
2. Creating a Health Monitor

I hope that you have found this informative, until the next time…

Click here to grab the latest version of Richard.CustomMP.

[Back to MP Index]

Bookmark It