VMWare ESX 3.0 Monitoring Options in MOM 2005

Recently I was tasked with conducting a trial to find a workable solution for VMWare ESX 3.0 monitoring in a MOM 2005 enterprise environment. When searching for viable solutions, there were three primary criteria we felt were most important. First, I was looking for a product that can collect a broad range of event, state and performance data and also Deliver the information with some built-in knowledge (threshold and state rules), And finally, deliver well-formatted events to MOM, so wouldn’t have to spend hours writing scripts to transform nasty variable binding from raw SNMP events. The three competing products I put through the paces were: eXc VMWare Management Pack Quest Management eXtensions for MOM nWorks VMWare Events MP for MOM Of the three products in the trial, I found only one really met both of my criteria. Below are some technical insights into the products I tested, some high level details on how data is extracted and presented in MOM, some of shortcomings identified in the trial. 1) ESX VMWare MP The first product I tested was eXc's VMWare management pack. Unfortunately, the most attractive quality of this solution was the licensing. You will pay somewhere in the ballpark of $399(US) per DNS name which means you can run as many of their MP’s as you want against that machine. The first real test I put the test through was on UP/DOWN notifications. The product uses SNMP traps sent from the ESX Host machine and compares those traps against an Access DB and alert based on what the SNMP trap contained. Unfortunately the trap contained a string that included the physical path to the VMX file. This can render the alerts unusable if the ESX administrator does not follow appropriately descriptive naming conventions. The performance collection wasn't much better. It would basically initiate a telnet or SSH session (depending on your configuration) and gather performance data gleaned from output of the ESXTOP utility. This is okay but the MP only collected data on the ESX server as a whole which really doesn't help you that much when trying to figure out which VM is hogging the resources. It also failed the built-in knowledge criterion, because of the poorly formatted alerts, coupled with the fact that all UP/DOWN alerts come across as critical errors. I was also disappointed to learn that eXc doesn’t support their product on a MOM MS running on a virtual server front-end….the very scenario we run in our production environment. 2) Quest Management eXtensions for MOM The next product I tested was Quest Management eXtensions for MOM. This test didn't last very long because the version I was testing at the time didn't even support a VMWare ESX 3.0 host. Unfortunately it took a support call to Quest and three days of waiting for an answer to find this out. Not great response time for a company trying to sell me something 3) nWorks VMWare Events MP for MOM The final product tested was nWorks VMWare Events MP for MOM. nWorks offers two versions of their VMWare Management Pack. One version covers only VMWare events (called VMWare Events Only MP for MOM) at a cost of approx $500 (US) for a 2 CPU license, and a second version covers both events and performance logging called (VMWare Only MP for MOM), at a cost of approx $1300(US) for a 2 CPU license. Upon installation, I was impressed with the amount of data it collected from the ESX Host. It not only collected information about the ESX Host as a whole, but also data on each VM on that host as well. I think the big advantage is that the MP used the VMWare API to pull some of this data, avoiding the decidedly unfriendly SNMP varbind dump to MOM, saving me some scripting time. Granted this application needs to run some VMWare console based utilities using a SSH connection, but the amount of data it returns is very nice. The UP/DOWNS were a refreshing change from previous products because it actually pulled the name of the VM guest from the API and the alert was readable. The nWorks met all my criteria for selecting a ESX Monitoring solution. It provided a broad range of data about the ESX host and provided built-in knowledge through its alerts. nWorks Homepage http://www.nworks.com/index.php eXc Software http://www.excsoftware.com/version3/version3/Default.aspx

Updates @ MOMResources

Been really busy working through the OM 2007 RC2 scenarios (and beyond), but I did take a minute to upload a couple new scripts to the site. Among them is a neat little script from Bryce Kinnamon for a MOM 2005 task to flush the DNS cache on a target server.   Get it here: http://www.momresources.org/momscripts/ClearDNSCache.txt

Overcoming Errors when Compiling MIBs in MOM 2005 (via smi2smir.exe)

Overcoming Errors when Compiling MIBs in MOM 2005 (via smi2smir.exe)   This post is for MOM administrators using MOM as an SNMP Trap-catcher, as defined in http://support.microsoft.com/kb/555455   In this post, I am going to offer some insight into addressing a common issue when compiling MIBs into WMI (MOF) format for MOM 2005 when using MOM as an SNMP trap-catcher, and offer a couple examples of an alternative that allows one to skip this process altogether.     Plan A – Identifying and Addressing Dependencies for MIB compilation to MOF Format   Windows has its own "SNMP" space in WMI, and by converting MIBs to MOF and loading into the WMI namespace (\.\root\snmp\smir ) puts them in a format MOM can understand. It's not uncommon when compiling MIBs to WMI format (MOF) with the smi2smir utility, you may run into an error, which is often assumed to be a syntax error. (Cisco seems to be a common source of problems). This is actually not always the case. It's sometimes a matter of identifying the MIBs upon which a given MIB is dependent. Consider the following example:   All vendors have the own SNMP OID (for example VMWARE is OID 1.3.6.1.4.1.687 or iso.org.dod.internet.private.enterprises.vmware). To successfully compile VMWARE MIB ( VMWARE-SYSTEM-MIB.mib) to MOF  - I need to add all MIBs on which this one is dependent (up to SNMP hierarchy - iso.org.dod.internet.private.enterprises ) in my smi2smir statement in order to compile successfully.   To identify the dependencies of a given MIB, you need to examine the IMPORTS section of the header file of the MIB you wish to import.     For example, see head of VMWARE-SYSTEM-MIB:   --------begin VMWARE-SYSTEM-MIB: file-------   VMWARE-SYSTEM-MIB DEFINITIONS ::= BEGIN IMPORTS     OBJECT-TYPE       FROM RFC1155-SMI    DisplayString       FROM RFC1213-MIB    vmwSystem  -- OBJECT IDENTIFIER ::= { vmware 1 }       FROM VMWARE-ROOT-MIB; --------end VMWARE-SYSTEM-MIB: file-------     In this example, the smi2smir utility reads ahead to retrieve objects FROM RFC1155-SMI, RFC1213-MIB, and VMWARE-ROOT-MIB. So if you do not first compile the MIBS on which this one is dependent, you'll receive an error message. You can compile these one at a time in order, or simply address all in a single command with smi2smir.exe, as shown in the example below. EXAMPLE smi2smir.exe /g VMWARE-SYSTEM-MIB.mib RFC1155-SMI.mib RFC1213-MIB.mib VMWARE-ROOT-MIB.mib IANAifType-MIB-V1SMI.my > VMWARE-SYSTEM-MIB.MOF   C:\WINDOWS\system32\wbem\snmp>smi2smir.exe /g OLD-CISCO-CPU-MIB.mib RFC-1212.mib CISCO-SMI-V1SMI.mib SNMPv2-SMI-V1SMI.mib > OLD-CISCO-CPU.MOF   Option B – Custom MOM Scripts If you do get your MIB loaded, the data displayed in the MOM alert window is simply a data dump of the varbind (*variable binding) list, which is a REALLY ugly and hard to work with. The other option is to not bother with importing the MIB at all. With MOM, you can simply write a script to parse the raw SNMP data to create a separate well-formatted event in MOM. I could spend an entire book chapter on this topic, so I'll simply point to a couple good examples of this you can read on your own:   Parsing UPS SNMP Events by John Hann http://msmvps.com/blogs/jfhann/pages/69388.aspx   And this 2nd one is a bit long, but I do step through the process of parsing an event parameter to transform   Parsing Nortel SNMP Events by Pete Zerger http://www.it-jedi.net/2006/12/day-6-telecom-monitoring-with-snmp-and_365.html     *DEFINITION: Variable Binding is a list of MIB objects that allows a requests recipient to see what the host issuing the SNMP GET wants to know     Thanks to Serhiy Lysan, sales specialist for Juniper Networks in the Ukraine for his input on this post.

KB: Workaround for McAfee VirusScan induced Event 21426 in MOM 2005

Finally, an official KB with the workaround for the McAfee issue that been around forever... From the KB... This problem occurs because McAfee VirusScan replaces the Windows Script Host component with the ScriptScan proxy component (ScriptProxy.dll). The ScriptScan proxy component scans JavaScript scripts and Visual Basic Scripting Edition (VBScript) scripts. When a script runs and passes through the scan as clean, the script is passed to the appropriate Windows Script Host. The ScriptScan proxy component parses scripts before they are run by the associated Windows Script Host. When the ScriptScan feature is turned on, the MOMHost.exe component slowly leaks memory. However, turning off the ScriptScan feature in the McAfee VirusScan properties does not correct the problem. Read more here... http://support.microsoft.com/kb/891605

Day 12 – Tracking Changes in MOM 2005

I hope everyone is having a peaceful holiday. For the 12th day of Christmas, a simple management pack to track changes in your MOM 2005 configuration. DESCRIPTION This was actually spawned from some individual scripts I put together a few months ago cleaned up and rolled into a management pack to eliminate user configuration for those less familiar with MOM. Scripts in this MP query the Onepoint database to track changes in MOM server and management pack configuration from the previous 60 minute period. WHERE clauses in the T-SQL in the scripts filter on time last modified (changes in last 60 min only) to minimize performance impact to the MOM Onepoint database. Rules run once every 60 minutes by default. FEATURES Requires no configuration prior to use. Rules / scripts run locally on server hosting the Onepoint database. Tracks changes to MOM rules, rule groups, global settings, scripts and tasks. Alert / Event Views in the Operator Console to display events alerts in the last 24 hours. Note that the Event rule that triggers alerts is disabled by default. It is only necessary to enable this rule if you want alert notifications via email on changes. If not, just use the Event Views in the Operator Console. WHERE TO GET IT Download at the link below: http://www.momresources.org/mommps/momchangeaudit.zip Send questions and feedback to my gmail.com address.

Book Review: Microsoft Operations Manager 2005 Field Guide

This book operates on a different paradigm from any other book yet published on MS Operations Manager 2005 in that is doesn't waste a single breathe on the basics. The authors assume you have the functional aspects of MOM securely in hand before you turn the first page. If you don't know a management server from agent-managed server, put this book down and move on. No space is wasted on this obvious in this guide. The value here obvious….best practices from experts with vast experience in the field. So if you're already grounded in the essentials, this book is an excellent desk reference for an enterprise administrator, as they address the topics I so frequently see in the newsgroups (and my inbox). I think the author's train of thought was spot on in their choice of subject matter, and this is the first book on MOM where I found myself wanting to add a comment here, a SQL statement there just to add my two cents J Attention is given to often overlooked planning tasks, such as the process for estimating expected volume of collected data, as well as a walkthrough of the System Center Capacity Planner, the preferred tool for modeling enterprise MOM deployments…The guys dig into all manner of topologies, supported configurations, capacity limits, etc…but it's really coverage of the configuration details that makes this book worth the price. I'll point out a few observations here. SNMP - For heterogeneous environments, the guide offers excellent coverage of the SNMP configuration process, allowing MOM to receive and process SNMP traps from non-Windows hosts (Something that is currently only addressed in a short community KB article). Events and Alerts – Good overage of event rule creation, with details on event parameters. Good chapter on rule tuning as well. Management Packs – While the book doesn't go into details of management pack configuration (this is after all documented at length in the MP guides), the guys do point out some common gotchas with AD, Exchange and IIS MPs. Here again, the value-add is in best practices for MP deployment and tuning via a sandbox environment. DTS - A short chapter is dedicated to the DTS Package, with succinct and relevant coverage of how the data flows, how the package is constructed, and how to dig your way out after extended failures…well done, gentlemen. MCF – The chapter on multi-tiered management group scenarios is possibly the best in the book. This chapter is exceptionally well structured, and walks through the configuration process for a multi-tiered environment in great detail, as well as some great troubleshooting bits. Few engineers on the planet have more experience in this area than Andy Dominey…I am guessing he wrote this chapter. If you're deploying a tiered management group topology, this chapter is a must-read. Troubleshooting – There are separate chapters on troubleshooting and troubleshooting scripts. The script troubleshooting is especially good. If you're not familiar with the ResponseTest utility or unfamiliar with remote debugging with Visual Studio, you'll find this chapter particularly informative. Scripting - No coverage of scripting per se, just troubleshooting. For scripting guidance, see the 4-part "Scripting MOM "series by Brian Wren, available on the Microsoft website. There are plenty of sample scripts on the MS site and mine ( www.momresources.org) to get anyone started. Security – There is also a chapter dedicated to security. The authors offer security recommendations for accounts on all services. Excellent guidance I don't think you'll find in the online MS documentation. Concepts of mutual authentication and proxying – both common points of confusion, are also given due attention. Reporting - Reporting coverage over 2 chapters is good. There's a nice example on how to use an existing report as a template, so to speak. This requires some Visual Studio experience, but a decent starter guide. Hit the Microsoft MSDN site for the SQL 2005 step-by-step report creation tutorials as well for some additional grounding in the basic concepts. No book is all things to all people, but all in all, if you're an experienced MOM administrator with more to do than care for MOM, this is a great book to have on the shelf a troubleshooting reference. Although if you're not already grounded in MOM 2005 concepts, I'd suggest you start with Essential MOM by Chris Fox. Get your copy of the Microsoft Operations Manager Field Guide HERE.

New Scripts at MOMResources.org

Posted a couple items to the site worth a look while you're having your coffee.   McAfee Antivirus A McAfee antivirus version check (via the registry) from the Oh so talented Marcus.   Automated Management Pack Backups with Archival A copy of the MP backup script I've been using for quite awhile, which retrieves top-level rule groups from Onepoint, creates a folder with date and time, performs backups and removes archived backups older than the number of days specified in the archive bit. Get it HERE.

New Scripts and Product Announcements at MOMResources.org

Posted some updates to momresources.org last night, including an MP backup script from Marcus, and a script to resolve alerts for a target computer programmatically. Get them both HERE.

Blogcast: How to implement a custom script in MOM 2005

After a couple of marathon e-mail threads trying to explain how to implement custom scripts to some folks new to MOM, I threw in the towel. So late last night to help a fellow I recorded an ad-hoc step-by-step on the process of implementing custom scripts in MOM 2005, as well as creating the rules to run them and generate alerts and email notification If you have a newbie that needs a hand, there's a copy available for online viewing HERE. (about 19 minutes long) The visual quality of this one is pretty good I think and best viewed in 800x600 resolution. As I find it necessary to repeat this process, I'll try to plan ahead a bit so they're as short and informative as possible.

Free MOM and SMS Documentation Scripts

Enhansoft has announced availability of free 1st generation MOM and SMS documentation documentation scripts. It requires MS Word be loaded on the machine where it runs, and can be run remotely from a workstation.  In addition to some WMI, the script makes calls to SQL via SDK views to pull back the computer and computer group lists.The output is not fancy, it's simply writes basic MOM Server version info, computers and computer groups.   But hey, it's free and you have to start somewhere. And it could be easily enhanced to include additional configuration detail. Get your copy HERE.

Process Monitoring without Custom Scripts

I uploaded a couple of HOW-TOs to the momresources.org site, including a walkthrough for those new to MOM on how to configure process monitoring in MOM 2005 using a WMI Events Data Provider.

Recent Updates at MOMResources

Recent site updates Posted several new scripts, including the start of a new PowerShell collection for MOM 2005. Marcus brought something I sorely miss from my NetIQ AppManager days in a Top CPU by Process script. (Get the full treatment HERE.) And Robert "Fibreman" Smit has been getting with Query Analyzer with a MOM SQL Script collection. As always, you can find new MOM scripts, articles, tutorials and news at www.momresources.org.

MOM SQL Job Scripts

After 3 requests in the last week, I posted SQL scripts for re-creating the MOM Onepoint SQL jobs in the event they are deleted. Get them HERE.

Nice URL Check Script

Just posted some additional scripts to the site. Thanks for all who submitted! Garth Williams submitted a particularly nice HTTP check script. (It's rolled up in an .akm so import just like any mgmt pack).   http://www.momresources.org/momscripts/Simple%20HTML%20Web%20Page%20Test.zip   Get news, articles, scripts and other MOM resources at www.momresources.org

MOM: Scripts

Couple of quick MOM scriptural items... Marcus Oh wrote a great script for validating DNS lookup on from a given node (see Monitoring DNS Synthetically), using the primary DNS server listed in the TCP/IP settings of the host where the script is run. Recently, I found I needed not to test the resolution process on primary server, but rather needed to verify an array of DNS servers were responding to a query for a given hostname successfully. So I did some quick-and-dirty (but very minor) tweaking of Marcus' Synthetic DNS Script to query multiple DNS servers for a record. Here's how it works... NSLookup requires 1 argument to lookup a host - the hostname, e.g. - "nslookup www.momresources.org" However you can pass an additional argument to NSLOOKUP to perform the lookup against a specific DNS server, For example, "nslookup www.momresources.org dns1.akosts.com" will perform the lookup of www.momresources.org on DNS server dns1.akosts.com rather than the server listed in IP settings on the resolver. ....the original script has two parameters you'll need to setup, which are present in this version : HostName - accepts a comma-delimited list of hosts to query (note HostNames became HostName) LogSuccessEvent - boolean value to log on success ....The updated version requires a 3rd parameter, the DNS Server(s) to query for the record NameServers - This is a comma-separated list of DNS servers to query for the Host record listed Get the alternate version of Marcus brainchild HERE. Multi-host Ping Script - Wrote something a bit simpler than what I've seen previously. Get it HERE.

MOM Reporting Data Warehouse (SCDW) Reindexing Script!

Many of us have long been whining about the lack of a good reindexing strategy for the SystemCenterReporting....And now we have one. A great reindexing script for the SystemCenterReporting database was shared with me yesterday. I wanted to test it quickly before sharing. While COMPLETELY UNSUPPORTED, UNWARRANTED, (ETC, ETC) by Microsoft, it was written by an internal MS resource close to the product, so it is quite sophisticated in it's makeup. The script actually works over a 7-day cycle to balance the load of re-indexing SCDW tables based on their fragmentation level. There is however, a single command that can be issued to force the script to run in a single cycle. I wont try to explain, as the Readme.txt from the author explains both script logic and usage in clear detail. Get a copy HERE. I expect MS will make it available for download directly after it's passed through the appropriate internal controls. NOTE: I have tested the script in both lab and now production on both SQL 2000 and SQL 2005 with no ill effects that I am aware of. My reports still run, but faster! :) (Approximate run time on my production SQL 2000 data warehouse 30gb in size was about 90 minutes. It's a dual xeon with 4gb RAM and a 4 drive RAID 1+0) Find MOM and systems management articles, scripts, utilities and community resources at http://www.momresources.com/

New Dell MP for MOM 2005 Released

Dell has released an updated version of their Openmanage MP, with several functionality enhancements to numerous to mention here including enhancements to State View, additional Tasks and added support for the latest of OMSA, Storage Management and Array Manager. Get all the details and download info, along with MOM scripts, how-to's and community resources at www.momresources.org

MS Updates

I see there's a new version of the Exchange BPA posted this morning....avail HERE.   We were also notified that the MOM Community page at MS was updated substantially. Check it out HERE.   Andrzej has some excellent info on using Perl scripts with MOM HERE.

Updates and Interesting Resource Sites

Posted new scripts to the MOMResources site, including a synthetic DNS transaction script from Marcus and a few others.   Also, I was looking at the Windows Auditing Team Blog, and they had a post on an open source log collection utility a la Audit Collection Services. Logforge by Loglogic. Have a look HERE...maybe an option for the basis of a compliance and security auditing solution....I think I'll wait for MOMv3 and ACS.

More good material...

Posted a couple of items that may be of interest: Exposing the MSFT_Alert Problemstate property in WMI - This is a pretty clever solution. The MSFT_Alert.Problemstate property is normally only available in the MOM .NET class library, so I was a bit surprised when, in a discussion with a colleague on momcommunity forum, he mentioned after a few hours that he has solved the problem and could now see Problemstate via WMI. This solution was devised by Bao Do, a very resourceful IT professional who currently resides in Australia. We've documented his work, which you can find HERE. Great job Bao! Agent Status and Inventory Report - I put together a report to allow easy identification of key agent properties and current agent status. This report returns a list of managed computers, agent version, primary management server and last heartbeat from a table in the Onepoint database. If last heartbeat value is older than the user selected parameter, the last heartbeat field will appear in bold red text. Results may be sorted by agent name or primary management server columns. Comes with instructions...get it HERE. Stefan also put together some stand-alone queries handy for getting a agent count per mgmt server, as well as the primary management server of a given agent, available on his blog or HERE.

MOM Utilities and Miscellaneous

A couple of new utilities and scripts that are useful in the right situation: Resolve Alerts by Name - Colin Hodges posted source code at gotdotnet for  a C# app that, given a rule name with list, or optionally resolve, alerts generated by that rule. He kindly gave us permission to compile his source and make it available to the community. I've added documentation and some batch code for easy use with multiple rules. Get it HERE.  Thanks Colin! Clive Eastwood posted a util for matching a friendly name to a rule GUID. Find the link HERE. Marcus Oh also recently submitted a script for the ResolveGUID registry key that would be handy as a MOM task. Get it HERE.   New Article - I posted an article a couple of days ago on streamlining the provisioning of MOM console access through global group and use of the Console Scope Utility. Get it HERE.   As always, submissions from the community are welcome. If you have scripts, reports or other grey matter you'd like to share, please forward to amdminstrator@momresources.org . You can submit scripts from the contact page HERE.   These are just some highlights. Find custom scripts, reports, management packs, technical articles, current MOM news and more @ www.momresources.org

Regular Expression Syntax in MOM 2005

An interesting bit of MOM trivia...let me know if you've experienced similar results.   As you may be aware, regular expressions offer many syntax options to accomplish the same net result. However, MOM doesn't seem to process expressions equally when interpreting whitespace (a single character whitespace in this case).  For example, the two expressions below translate in roughly the same way through Regular Expressions Workbench:   ^(The\sADM|The\sTSM|ServeR) NOTE: The \s translates as Any whitespace character   ^(The[ ]ADM|The[ ]TSM|ServeR) NOTE: The [ ] translates as Any character in " "   However, only the 2nd equation successfully filtered on the description field to exclude certain services from processing on an a Service Start/Stopped Event.   Also, we posted updated to momresources.org last night, including a couple of new scripts, how-to's, FAQs. We've taken to noting the "last update date" by the section links in Downloads to make it a bit easier to find updated content.   You can also find a download link for Regular Expressions Workbench at http://momresources.org/downloads/

MMS 2006 Updates at MOMResources.org

Just posted updates from Stefan at MMS 2006 in San Diego, including some nice scripts to facilitate alert escalation within MOM 2005, from a session with Brian Wren, author of the Scripting MOM series...Get them at MOMResources.org   Also, Brian has a nice doc on working with the MOM WMI namespace out on his Sharepoint site. Get it HERE.

MOMResources Updates

We’ve made several updates to the site Expanded Downloads Section - content now sortable by date, category (click on table headers) for quick location of most recent updates. Current News - Several product releases and newsworthy items in the last 48 hours! Additional Downloads - additional scripts, how-to’s and a recompiled version of the Alerts to RSS .NET App from the Reskit SP1 (that was broken out-of-the-box). Check it out: http://www.momresources.org As always, we’re committed to developing a great resource site together. We welcome your continued contributions and feedback.

Script: Monitoring and Reporting MOM Console Connections for Multiple Mgmt Servers

If you want to skip the chat and get the script from the MOMResources.org script archive (in the MOM Administration section), click  here.   And for the rest of you, here's a quick runthrough of the scripts functionality. I've always thought it would be handy to have a way to track MOM console connections in a meaningful way. Specifically, I wanted a script that would Report Connections to Management Servers Individually Dynamically chart connections in a performance object per Management Server Raise a warning event if we get close to the max recommended of 15 on a given management server So, I started with a T-SQL String I found in a Tim Minter post:   master","SELECT program_name, count(*) FROM Master.DBO.sysprocesses WHERE ecid=0 and program_name='Microsoft Operations Manager - DAS Operations Console' GROUP BY program_name ORDER BY count(*) desc   And modified it slightly to expose connections for individual mgmt servers, like so.   SELECT hostname, program_name, count(*) as ConnCount FROM Master.DBO.sysprocesses WHERE ecid=0 and program_name='Microsoft Operations Manager - DAS Operations Console' GROUP BY hostname,program_name ORDER BY count(*) desc   Wrote a simple script and added sub routines for 1) Dynamically charting connections for any mgmt server added to your environment without any intervention on your part 2) A call to a sub routine to generate a warning in MOM if connections break a user-defined threshold.   In terms of shortcomings, there is the fact that the script doesn't account for 0 connections, but just leaves the datapoint blank in the performance charts and goes on. I suppose we could get creative and work around that, but I found I really didnt care, because I just wanted to watch the upper limit (and 0 connections doesn't happen in my environment much :) ). I am sure someone creative out there in the community will address that.     Cheers, Pete

MOMResources.org Official Site Launch

Justin Harter and I have been collaborating on a new community site defined to bring the best components of the MOM community into a single centralized resource......MOMResources.org. The intention is that this will be a community site developed over time by the members of the MOM community. It will include frequent content updates, including articles, tutorials, custom scripts and reports, news, periodic expert chats, etc.   To that end, while I will continue to post to my blog quite frequently, but pointers for scripts and other solutions will direct you to MOMResources.org. I am excited for the possibilities of what we can develop together.   So please have a look around, and let us know what you think by sending us a message from the contact page.   http://www.momresources.org Regards,   Pete Zerger Co-founder and Webmaster MOMResources.org

Exchange Hotfix for 9548 Errors (KB903158) Causes MOM Mailflow Scripts to Fail

The problem... We recently applied a long-awaited hotfix for the much-hated MSExchangeIS Event ID:9548 - 'Disabled account does not have a master account SID'. As soon as we did, we started seeing the following error in the Operator Console, and mailflow scripts started failing: The script aborted its execution due to the following error: 0x80040705(-2147219707) Unexpected error code received from 'EMPMS.MailFlowSender', description: The Microsoft Exchange Server computer is not available. Either there are network problems or the Microsoft Exchange Server computer is down for maintenance. [Microsoft Exchange Server Information Store - [MAPI_E_FAILONEPROVIDER(8004011D)]] This event was generated by the script: "Exchange 2003 - Mail flow sender" Some background... This error stems from the fact that disabled Windows user account permissions are calculated by using the msExchMasterAccountSID attribute, rather than the objectSID or sidHistory attributes used for enabled accounts. The msExchMasterAccountSID will be empty on all disabled user objects not created by the Active Directory Connector for the most part, resulting in potentially hundreds of errors if users are disabled in your directory while the mailbox association is retained. The logging of this event ID can be fixed by granting the SELF account the Associated External Account right on the mailbox, as documented in KB278966. But why should you care? Because the Exchange Info Store will waste cycles trying to resolve the SID of this object on every ACL on which it appears, which can lead to performance degradation if encountered in sufficient numbers. The fix... There were some permission changes made by the hotfix, which in this situation, also lead to Blackberry problems. 'Send As' permissions previously granted to BES service accounts and the MOM Mailbox Access Account were removed. To resolve this issue, you simply need to give the MOM Mailbox Access Account "Send As" permission on all of the tes