Tag: Microsoft Monitoring Agent

Monitoring Domain Controllers in SCOM 2016 – Event ID 1102

· 4 Comments ·

So  you deploy a SCOM 2016 agent to a Windows 2016 Domain Controller, only problem is, after the agent push, discovery doesn’t work. Well, the agent isn’t corrupted… Ports are open… SCOM agent is being deployed using the System Local account…  etc. etc. So, now what?

Taking a look at the Windows 2016 domain controller and its event log, the domain controller OpsMgr log is getting bombarded with Event IDs 1102….

After some investigation, seems to be this has been an issue in SCOM 2012 (and 2012R2) as well. Well, here’s the fix…

Taking a look at the HSLockdown, the Local System account is being denied access..  Browse to the following folder “%windir%\Program Files\Microsoft Monitoring Agent\Agent “and run the following command (elevated access…), “HSLockdown.exe /L“

Now that we can see the Local System account is being denied access, let’s give it access… Running the following command, “HSLockdown /A “NT AUTHORITY\SYSTEM“. Restart the SCOM Agent (net stop HealthService.exe & net start HealthService.exe) and you should be good to go now!

Cheers!

SCOM Agent Version Addendum Management Pack

· Leave a comment ·

Earlier this week, Microsoft’s Kevin Holman published an excellent article and SCOM Management Pack that addresses the issue with SCOM 2012 and agent updates. Please have a read, and consider installing this MP to help alleviate the issues SCOM 2012 has created when it comes to understanding which version your SCOM agent is on….

BLOG POST HERE.

Dual-Homing OMS/Microsoft Monitoring Agent (MMA) — Questions

· 8 Comments ·

Earlier this week, I posted on how the OMS/Microsoft Monitoring Agent (MMA) can be dual-homed for multiple OMS Workspaces.

A good question from the community came up (thank you @ Manoj Mathew), “Have you noticed any performance impacts on the Agents when they are multi homed to OMS?“

In the OMS Query below — making use of OMS’ Log Analytics, I checked the performance data in the last 48 hours. Unfortunately I cannot go any further, since the MMA was deployed earlier in that day, and the second OMS workspace was added later that afternoon.

There are a few spikes in the Memory and CPU, but this is also a result of a few factors:

  • Initially there is a high level of CPU/Memory usage as OMS did its stuff when the MMA/OMS made friends and synced up their data/solutions
  • There is a small spike when the second OMS workspace was added but this is minimal at best
  • This server was being patched with 90+ Windows Server OS patches around 8PM.

The query I used to collect the data is here,

perfover48hours

Computer="COMPUTERNAME.FQDN" Type=Perf (CounterName="Available MBytes" OR CounterName="% Processor Time") (ObjectName=Memory OR ObjectName=Processor)

A second question being asked here is, “how many OMS Workspace IDs can be added to “dual-home” the MMA agent?“

Unfortunately I only have 3 OMS Workspace’s to work with at the moment in this environment, but with that said, I can surely say a minimum of 3. If you have the ability to test more than 3, I would love to find out!

Dual-Homing OMS/Microsoft Monitoring Agent (MMA)

· 2 Comments ·

Today I learned that the MMA (Microsoft Monitoring Agent) has the ability to be “dual-homed“. Similar to what we have seen in the past with the System Center Operations Manager (SCOM) agent and dual-homing it to multiple SCOM environments/Management Groups, the same can be said for the Operations Management Suite (OMS)/MMA agent. By going into the MMA properties, you can add multiple OMS Workspace IDs.  This is great if you want the Computer reporting to multiple OMS Workspaces and/or Azure Subscriptions, as was the case for me today.

Simply launch the MMA agent, and within the Azure Log Analytics (OMS), add your OMS Workspace ID here.

Note, this works for the MMA version, 8.0.11030.0 — Windows. Has not been tested against the Linux Agent.

1

2