Getting Help Overview

Welcome to the Microsoft Operations Manager 2000 (MOM) Help system. These Help topics contain essential information you need know to successfully deploy, configure, and maintain MOM.

The MOM Help system is task-oriented, primarily designed to help you perform MOM administration tasks, rather than describe the product on a feature by feature basis. When product features are described, they are described in the context of the work that they help you perform.

The MOM Help topics are displayed in the Help Viewer. The Help Viewer provides a table of contents, an index, and a search function. Toolbar buttons provide ways to navigate through Help, and to perform operations such as printing.

Related Topics


About Help

The Microsoft Operations Manager 2000 (MOM) Help system provides a number of different topic types. Information in the topics ranges from high-level conceptual information to low-level dialog box Help. The topic types are described in the following table:

Topic Type | Includes
Overview | Overview topics provide high-level introductory information. Typically, they include a short summary of related operations or features, and provide information about how thsoe operations and features work together.
Conceptual | Conceptual topics provide more in-depth information than overviews. They include information about how MOM carries out tasks, why a task should be performed, in what situations the task should or should not be performed, definitions of relevant terms, analogies, and examples.
Process | A process topic reflects the goal of a MOM administrator, rather than an element of the UI or product architecture.
Procedure | Procedure topics list the steps needed to accomplish a task. Procedure topics provide navigational graphics that you can use to quickly identify where you need to be within the MOM Administrator console to perform that particular task.

Related Topics


Accessing Help

You can access the Microsoft Operations Manager 2000 (MOM) Help system from several points in the MOM Administrator console.

To access Help for the selected item:

  • Right-click any item in the MOM Administrator console, and then click Help; or
  • Press F1 on any item in the MOM Administrator console; or
  • Click the Help icon on the toolbar; or
  • On the View menu, click Help.

To access the Help system without going to a specific Help topic:

  • On the Help menu, click Help Topics.

Related Topics


Using the Help Viewer Overview

Using Help Viewer Overview

When you open Microsoft Operations Manager 2000 Help, the Help Viewer appears in the upper-right corner of your screen. You can resize the two panes within the Help Viewer by selecting the divider between the panes and dragging it left or right.

The left pane of the Help Viewer is the navigation pane; the right pane is the topic pane. When you select a topic in the navigation pane, it is displayed in the topic pane. You can change the view of the navigation pane by clicking the Index, Search, or Contents tabs.

To navigate forward and backward through previously viewed Help topics, use the Forward and Back toolbar buttons. To display or hide the navigation pane, use the Show and Hide buttons. You can also print Help topics, refresh the current topic, and stop the download of a topic from an external Web site or Help system using the Options button.

Related Topics


Help Viewer: Search Tab

In the Help Viewer, use the Search tab to search for words or phrases in the Help system. You can create basic searches by typing simple words or phrases, or you can create more complex searches using wildcards and nested search expressions.

Type in the words to search
Allows you to enter the text to search for. You can search for any combination of letters (a-z) and numbers (0-9) except for single letters. Search text is not case sensitive. Punctuation marks such as the period, colon, semicolon, comma, and hyphen are ignored during a search. Use double quotes or parentheses to set apart each element of a search.

  • AND, OR, NEAR, and NOT are search operators that you can use to filter a search query by providing a connection between the expressions in the query.
  • List Topics displays the topics that contain the text in the selected topic list.
  • Display displays the Help topic in the topic pane.

Select topic
Displays the list of topics that were found to contain the word or phrase you entered, or that met the search query criteria.

  • Title displays the Help topic title.
  • Location displays the name of the Help system in which the topics were found.
  • Rank displays a number assigned, in ascending order, to each topic in the search.

Search previous results
Limits the search by scanning only the topics that were found in the previous search.

Match similar words
Includes minor grammatical variations of the word or phrase in the search. For example, a search for the word "add" will find "add," "adds," and "added."

Search titles only
Limits a search by searching only the titles of the Help topics for the chosen word and not the entire contents of the Help topics.

Other tabs in the Help Viewer: Contents, Index

Related Topics


Help Viewer: Index Tab

In the Help Viewer, use the Index tab to search the Help topics for defined keywords.

Type in the keyword to find
Specify the word for which you want to search, or select it from the keyword list.

Display
Displays the topic associated with the indexed word. If the word you entered is not in the index, no topics are found. If more than one topic is associated with the word, you are prompted to make a selection.

Other tabs in the Help Viewer: Contents, Search

Related Topics


Help Viewer: Contents Tab

In the Help Viewer, use the Contents tab to navigate through the Help topic hierarchy.

Book icons
Book icons represent the hierarchy of Help topics. Click a book to display that book's Help topic in the topic pane. Double-click a book to display the hierarchy of books and topics below the selected book.

Page icons
Page icons represent individual Help topics. Click a page icon to display Help in the topic pane.

Right-click menu
Right-clicking anywhere in the table of contents displays the right-click menu. You can use this menu to open all books, close all books, print a Help topic, and to jump to another topic in the Help system.

Other tabs in the Help Viewer: Index, Search

Related Topics


Finding and Displaying Help Topics

You can locate and display Microsoft Operations Manager 2000 Help topics quickly and easily using the navigation pane in the Help Viewer.

  • Use the Contents tab to navigate through the Help topic hierarchy to locate information.
  • Use the Index tab to search for information by entering a word, or by scrolling through the list of defined keywords.
  • Use the Search tab to find any word in a Help topic, not just those defined as keywords in the index.

Related Topics


Copy a Help Topic

  1. In the topic pane of the Help Viewer, right-click the topic you want to copy, and then click Select All.
    • Alternately, you can click-and-drag the cursor over the text you want to copy.
  2. Right-click the highlighted text, and then click Copy. The topic is copied to the Clipboard.
  3. Open the document you want to copy the topic to, and then place the cursor where you want the topic to be copied.
  4. On the Edit menu, click Paste.
    • Alternately, you can right-click where you want the text to go, and then click Paste.

Related Topics


Print Help Topics

You can print a single topic or all topics in a specific book in the table of contents, as follows:

  1. In the navigation pane of the Help Viewer, click the Contents tab.
  2. In the table of contents, right-click the item that you want to print, and then click Print.
    • To print only the selected topic, click Print the selected topic; or
    • To print all topics in the same topic heading, click Print the selected heading and all subtopics.
  3. In the Print dialog box, click OK.
  4. A second Print dialog box opens, providing additional printing options. Select the options as appropriate, and then click OK.

You can perform any of the following printing tasks through the Help Viewer:

  • Print a single Help topic or all topics within a specific book.
  • Print all topics linked to a selected topic.
  • Print all topics in the Help system.

Related Topics


Print Linked Topics

A linked topic is a topic that is referenced from another topic. When printing a topic, you can choose to print the linked topics, or you can choose to print only a list of links.

  1. In the topic pane of the Help Viewer, right-click the topic you want, and then click Print.
    • To print every linked topic, select the Print all linked documents check box; or
    • To print only a table that lists the linked topics, select the Print table of links check box.
  2. Click OK to print your selected topics.

Related Topics


Basic Searching Overview

You can search Help topics using any word, not just those that have been defined as keywords in the index. To do so, use the Search tab in the Help Viewer.

To perform a basic search, you can use a single word or phrase. To create more complex searches, you can use search queries that might include wildcard characters and nested expressions.

When searching for Help topics, keep the following guidelines in mind:

  • Searches are not case-sensitive. You can type your search in uppercase or lowercase characters. For example, Software, software and SOFTWARE are interpreted in the same way by the search engine.
  • You can search for any combination of letters and numbers.
  • Punctuation marks such as periods, colons, semicolons, commas, and hyphens are ignored during a search.
  • Use double quotation marks or parentheses to set apart each element of a search.

Note

  • If you are searching for a file name with an extension, group the entire string in double quotation marks (for example, "filename.ext"). Otherwise, the period will break the file name into two separate words. The default operator between terms is AND, so you will create the logical equivalent of "filename AND ext".

Related Topics


Search for a Word or Phrase

  1. In the navigation pane of the Help Viewer, click the Search tab, and then type the word or phrase you want to find.
  2. To add search operators to your search, click the arrow.
  3. To further limit a search, you can select Search previous results, Match similar words, or Search for words in titles.
  4. In the list, double-click the topic title of the Help topic you want to display.

Related Topics


Search for Words in Titles

You can limit a search by searching only for words in topic titles.

  1. In the navigation pane of the Help Viewer, click the Search tab, and then type the word or phrase you want to find.
  2. Select the Search titles only check box.
  3. Click List Topics.
  4. Double-click the topic you want to display

Related Topics


Highlight Searched Words

When searching for words in Help topics, you can specify that each occurrence of the word or phrase is highlighted in the topics that are found. This setting is enabled by default.

  1. On the Help Viewer toolbar, click Options, and then click Search Highlight On.
  2. To disable highlighting, click Search Highlight Off.

Related Topics


Search Previous Results

When you have performed a search, you can specify that any subsequent searches be performed only on the topics that were found in the previous search results.

  1. In the navigation pane of the Help Viewer, click the Search tab.
  2. Click the Search previous results check box.
  3. Type a word or a phrase.
  4. Click List Topics to display a list of the topics that contain the word or phrase you specified.
  5. In the list, double-click the topic title to display the Help topic.

The search targets only the last group of topics that were searched.

Related Topics


Match Similar Words

You can broaden your search by specifying that the search look for similar words. This enables the search to include minor grammatical variations for a word or phrase. For example, if you type the word add in the keyword search box, Microsoft Operations Manager 2000 Help will search on the terms "add," "adds," and "added."

  1. In the navigation pane of the Help Viewer, click the Search tab.
  2. Type a word or a phrase.
  3. Select the Match similar words check box.
  4. Click List Topics to display a list of the topics that contain the words or phrase, or the like words or phrase you specified.
  5. In the list, double-click a topic title to display the Help topic.

Related Topics


Advanced Searching Overview

A basic search of Help topics consists of the word you want to search for. You can refine your search using the following methods:

  • Words, Phrases, and Wildcard Characters
  • Search Operators
  • Nested Search Expressions

Related Topics


Search Operators

You can precisely define your search by providing a connection between the search expressions in your query. To do so, use the AND, OR, NEAR, and NOT operators, as described in the following table. If no operator is specified, AND is used by default.

Search For | Example | Result
Both terms in the same topic | software AND metering | Topics containing both the words "software" and "metering."
Either term in the topic | software OR metering | Topics containing either the word "software" or "metering."
Both terms in the same topic close together | software NEAR metering | Topics that contain the word "software" within eight words of the word "metering."
The first term without the second term | software NOT metering | Topics containing the word "software" but not the word "metering."

Note

  • The |, &, and ! characters are not permitted. You must use OR, AND, and NOT.

Related Topics


Words, Phrases, and Wildcard Characters

You can search for words or phrases, and use wildcard characters in search queries. The following table provides examples of the query expressions you can use and the expected results.

Search For | Example | Result
A single word | select | Topics that contain the word "select," and its grammatical variations (such as "selector" and "selection").
A phrase | "new operator" -or- 'new operator' | Topics that contain the literal phrase "new operator" and all its grammatical variations. Without the quotation marks, the query is equivalent to specifying "new AND operator," which will find topics containing both of the individual words instead of the phrase.
Wildcard characters | 80?86 | Topics that contain the terms "80186," "80286," "80386," and so on. The question mark cannot be the only character in the term.
 | *86 | Topics that contain the terms "386," "486," "x86," "QEMM386," "8086," and so on.

Related Topics


Nested Search Expressions

Nesting enables you to create complex search queries by combining search expressions. To use nested search expressions when searching Help topics, keep in mind the following guidelines:

  • Use parentheses to nest expressions within a search query. The expressions in parentheses are evaluated before the rest of the query. For example, the query "software NOT (metering OR database)" finds topics containing the word "software" without either of the words "metering" or "database."
  • If a query does not contain a nested element, it is evaluated from left to right. In this case, the query "software NOT metering OR database" finds topics containing the word "software" without the word "metering," or topics containing the word "database."
  • The complex query "software AND ((metering OR database) NEAR role)" finds topics that contain the word "software" along with the words "metering" and "role" close together (within eight words), or that contain the word "software" along with the words "database" and "role" close together.

Note

  • You can nest expressions only five levels deep.

Related Topics


Legal Notice and Copyright Notice

Notice

Information in this document, including URL and other Internet Web site references, is subject to change without notice. Unless otherwise noted, the example companies, organizations, products, domain names, email addresses, logos, people, places and events depicted herein are fictitious, and no association with any real company, organization, product, domain name, e-mail address, logo, person, places or events is intended or should be inferred. Complying with all applicable copyright laws is the responsibility of the user. Without limiting the rights under copyright, no part of this document may be reproduced, stored in or introduced into a retrieval system, or transmitted in any form or by any means (electronic, mechanical, photocopying, recording, or otherwise), or for any purpose, without the express written permission of Microsoft Corporation.

Microsoft may have patents, patent applications, trademarks, copyrights, or other intellectual property rights covering subject matter in this document. Except as expressly provided in any written license agreement from Microsoft, the furnishing of this document does not give you any license to these patents, trademarks, copyrights, or other intellectual property.

© 2001 Microsoft Corporation. All rights reserved.
Portions © 1995–2001 NetIQ Corporation.

Microsoft, MS-DOS, Windows, Windows NT, Active Directory, SQL Server, and Windows 2000 are either registered trademarks or trademarks of Microsoft Corporation in the United States and/or other countries.

The names of actual companies and products mentioned herein may be the trademarks of their respective owners.

Contacting Microsoft

Telephone:
See Contacting Microsoft for a complete list of support telephone numbers.

Online support:
Contact Microsoft technical support with specific questions, or visit www.microsoft.com/mom.

For information about earlier versions of Operations Manager, or products made by NetIQ that work with MOM, contact NetIQ.


Microsoft Operations Manager 2000 Licensing

For information about MOM licensing, consult your EULA or the MOM Web site.


What Is Microsoft Operations Manager?

Microsoft® Operations Manager 2000 (MOM) is a comprehensive network monitoring solution that radically improves the availability, performance, and security of Microsoft Windows® 2000 networks and applications. MOM provides central monitoring and automatic problem resolution for networks of tens to thousands of computers, continuously monitoring user actions, application software, servers, and desktop computers.

MOM can monitor, manage, and secure a wide range of resources including computers, applications, Web server farms, electronic commerce (e-commerce) sites, and corporate servers. MOM automates formerly labor-intensive tasks, such as security management and application monitoring in your organization.

MOM provides proactive real-time system monitoring for Windows 2000 servers and computers throughout the extended enterprise. You can put MOM to work by itself, or implement a solution that includes other Microsoft products, such as Directory and Resource Administrator or Exchange Administrator.

MOM provides the following benefits:

  • Event-driven operations monitoring
  • Self-deploying, scalable solutions
  • Instant and sustainable return on investment (ROI)
  • Advanced security policy enforcement and auditing capabilities
  • Improved system availability and performance tracking
  • Open, extensible, standards-based architecture
  • Numerous ways to view and report data
  • Reliability and value

MOM gives you out-of-the-box management solutions that proactively monitor the availability, performance, and security of Active Directory®, Microsoft Exchange, Web Server farms, and the entire Windows 2000 infrastructure.


Event-Driven Operations Monitoring

Microsoft Operations Manager 2000 (MOM) captures and reports events throughout your network. By defining rules, you can automate responses or assign problems to a specific staff member for resolution. MOM displays information about service level exceptions, open alerts, and computers in the configuration. You can quickly check specific alert and event details, performance data, and monitored computer status.

MOM also displays useful information about computers and their alerts. You can display a view of all computers to see computer properties, alerts, events, performance, computer group membership, and the processing rules applied to each computer in the configuration group.


Self-Deploying, Scalable Solutions

Microsoft Operations Manager 2000 (MOM) enables you to describe and automatically implement a coherent systems monitoring policy for your organization. MOM proactively scans for new computers to manage based on criteria you establish. After performing a scheduled system scan, MOM installs or removes agents and rules based on your current configuration. MOM provides policy-driven operations management for any size organization, automatically adjusting to your needs as your enterprise changes.

MOM provides alert forwarding, which enables alerts in one configuration group to be forwarded to another configuration group. Alert forwarding creates an efficient hierarchical alert management structure for large enterprise networks. Alert forwarding can provide MOM functionality to an organization's regional groups, while allowing a central administrative group to monitor alerts from the entire network.


Instant and Sustainable Return On Investment

Microsoft Operations Manager 2000 (MOM) provides your business with an instant and sustainable ROI by offering the following key features:

  • Automated response and recovery
  • Out-of-the-box expert knowledge
  • Point-and-click customization
  • Continuous knowledge acquisition

MOM automatically resolves problems for many applications as they happen. This automation reduces the burden on your administrative resources. MOM provides Management Pack modules, libraries of rules for managing Windows 2000 environments and applications. Management Pack modules contain preset filters, performance counters, response scripts, and alerts that support specific applications, such as Microsoft Exchange.

As you encounter and solve new problems, you can capture the solution as a new rule to expand and distribute expertise within your company. Customizing and adding rules is simple with MOM. Easy-to-use wizards step you through the process so you can rapidly create and apply changes across your enterprise. If you can devise a solution and the rule, you can automate that solution with MOM.


Advanced Security Policy Enforcement and Auditing

Protecting the security of the enterprise is a top priority for most organizations. Microsoft Operations Manager 2000 (MOM) addresses this need in several ways:

  • Secures and centralizes a database of events from all sources you choose
  • Proactively and automatically enforces security policy

In Windows 2000 networks, security logs contain essential information to determine if a security breach has occurred. MOM agents monitor and protect these logs by sending the collected events to a secure, central computer for storage in the database.


Improved System Availability and Performance Tracking

Microsoft Operations Manager 2000 (MOM) monitors services, performance thresholds, and failure events and immediately alerts key personnel about situations that interrupt access to applications. Real-time system health monitoring lets you maintain a high level of system performance. MOM gives you this capability with low system overhead.

MOM database information improves your ability to investigate long-term error trends, establish corrective procedures, and determine the cause of a computer failure. You can view real-time performance tracking graphs in the MOM Administrator Console and in the Web Console.


Open, Extensible, Standards-Based Architecture

Microsoft Operations Manager 2000 (MOM) supports the following spectrum of open, extensible standards:

  • User-friendly interfaces for Windows 2000 and the Web
  • COM+ technology
  • Legacy and emerging technology
  • Familiar database tools
  • Microsoft ActiveScripting

MOM provides Microsoft Management Console (MMC) snap-ins that offer you all the customizable and extensible features of MMC. In addition, MOM provides a Web Console interface so that you can monitor network health from any computer with a Web connection and browser.

Built on COM+ technology, MOM is framework-friendly, integrating with traditional legacy systems management using SNMP. MOM reads, captures, and analyzes management data from all standard Windows 2000 sources, as well as UNIX system logs and SNMP traps.

MOM data providers


Ways to View and Report Data

Microsoft Operations Manager 2000 (MOM) offers you a number of ways to access the information collected from monitored computers. This data is stored in a central database. You can use the MOM Administrator Console, Web Console, and MOM Reporting to view, print, or publish the data.

Two key mechanisms allow you to access the monitored data: views and reports. Both offer default as well as custom means of viewing the data. With these quick and easy mechanisms, you have an unlimited number of ways to view this vital information.

You can use the default views in the MOM Administrator Console and the Web Console to view database information, or you can easily create your own views. You can create private views, accessible only by the user who created them. You can also create public views, accessible by anyone.

MOM Reporting offers predefined views of the monitored application or environment, displaying reports or graphs of the collected data. You can also quickly customize and generate your own reports specific to your enterprise. These reports offer you easy access to the data you need to manage and monitor your enterprise.

Management Pack modules provide default public views related to the specific monitored application or environment. These predefined views save you time and effort, and offer you an immediate glimpse of the monitored application or environment. Reports associated with Management Pack modules also offer quick access to specific information you need.


Reliability and Value

Microsoft Operations Manager 2000 provides tremendous reliability and business value in many ways:

  • Reduces the cost, effort, and skills required to manage your computing infrastructure
  • Improves operations productivity and response time through automation and knowledge collection
  • Proactively monitors and prevents security breaches
  • Provides an instant return on your investment by deploying a complete management solution in hours
  • Improves time to market, availability, and performance of e-commerce, e-mail, directory, and other business-critical applications
  • Monitor and manage large or small Internet and corporate computer infrastructures with high confidence and reliability


Microsoft Operations Manager 2000 Architecture

Microsoft Operations Manager 2000 (MOM) is a scalable and comprehensive set of event collection, performance monitoring, and reporting tools for the full range of Microsoft server operating systems and server-based applications. To perform complete and efficient monitoring and management, MOM is based on the Microsoft Distributed interNet Application (DNA) architecture: Presentation, Business Logic, and Data.

The Presentation layer consists of the MOM Administrator Console, the Web Console, and MOM Reporting.

Agents, Consolidators, associated Agent Managers, and Data Access Servers (DAS) are part of the Business Logic layer. The DAS provides centralized database access and query logic, as well as the communications between the interfaces in the Presentation layer and the components in the Data layer.

The various Windows 2000 data sources and the database make up the Data layer. MOM supports Microsoft SQL Server.

The following figure illustrates MOM architecture.

The architecture includes product components and interfaces. Components provide product functionality. Interfaces provide access to the collected data, as well as configuration functionality.


Microsoft Operations Architecture

Microsoft Operations Manager 2000 Architecture

To perform complete and efficient operations management, Microsoft Operations Manager 2000 (MOM) is based on the Microsoft Distributed Network Architecture (DNA): Presentation, Business Logic, and Data.

Illustraton of Microsoft Operations Manager 2000 Architecture

The Presentation layer consists of the MOM Administrator Console, the Web Console, and MOM Reporting.

Agents, Consolidators, associated Agent Managers, and Data Access Servers (DAS) are part of the Business Logic layer. The DAS provides centralized database access and query logic, as well as the communications between the interfaces in the Presentation layer and the components in the Data layer.

The various Windows 2000 data sources and the MOM database make up the Data layer. MOM supports Microsoft SQL Server 2000 and later.

The MOM architecture includes product components and interfaces. Components provide product functionality and are grouped in configuration groups. Interfaces provide access to the collected data, and provide configuration functionality.

Components

MOM consists of the following components:

Agent | Service that runs on each computer you want to monitor. An agent captures information from a remote computer, applies processing rules to the collected information, and sends the information to a Consolidator.
Consolidator | Service that runs on a select number of computers in your enterprise. A Consolidator includes an Agent Manager component, which installs, uninstalls, and configures agents. A Consolidator also acts as an agent on the computer where it is installed. Consolidators send collected information to a Data Access Server (DAS).
Data Access Server (DAS) | Service that runs on a select number of computers in your enterprise. The DAS controls the flow of data between the database, Consolidators, and the MOM Administrator Console and Web Console.
Database | Storage facility for configuration information and collected data for a configuration group.
Web Console Server | Component installed on a Microsoft Information Services (IIS) computer that hosts the Web Console.

Interfaces

MOM offers the following interfaces:

MOM Administrator Console | Allows you to monitor data, create rules, and configure Microsoft Operations Manager 2000 components.
Web Console | Allows you to view the data in the database from any Windows platform that can run Microsoft Internet Explorer. The Web Console provides remote monitoring and easy access for roaming administrators.
MOM Reporting | Allows you to run auditing reports and performance management and capacity planning graphs from the information in the database.

Understanding Configuration Groups

A configuration group consists of the following components:

  • One database
  • One or more Data Access Servers
  • One or more Consolidators
  • Any number of agents

Configuration Group components

Each configuration group contains only one database and must have a unique name. The database provides a central storage location for all data collected from that configuration group, as well as alerts, rules, scripts, and configuration data. You can have more than one configuration group in your enterprise. Agents can reside in more than one configuration group, sending the same or different information to each configuration group. The following list provides a few examples of why you might want more than one configuration group in your enterprise:

  • Geographic locations
  • Organizational departments
  • Network bandwidth

Understanding Agents

The agent is part of the Business Logic layer in Microsoft Operations Manager 2000. An agent is a service that runs on every computer that you want to monitor. An agent can capture the following information from the computer on which it is running:

  • Events from Windows 2000 event logs
  • Events from third-party application event logs
  • Performance data such as thresholds and capacity planning data
  • Missing events
  • Timed events
  • WMI information, including changes to the system services list and SNMP traps
  • Events created by scripts

The agent applies processing rules to the collected information and performs actions as stipulated by the processing rules. By applying processing rules to collected information, the agent can perform any of the following actions and responses:

  • Filter events
  • Consolidate events into one event
  • Send data to a Consolidator
  • Send an alert when a performance threshold is crossed
  • Send an alert based on an event to a Consolidator
  • Generate an SNMP trap
  • Run a batch or command file
  • Execute a script

Illustration of Agent Function

The agent temporarily stores information in a buffer before sending it through a guaranteed delivery mechanism to a Consolidator. MOM can integrate with enterprise management frameworks by sending high-priority events as SNMP traps from each agent.

The agent uses a guaranteed delivery mechanism to ensure that each item of data is sent. Agents continue to collect data even through lengthy network outages by batching and sending data in a controlled fashion when network connectivity resumes.

At regular intervals, the agent initiates communications with a Consolidator. You can configure the amount of data sent at each interval. For quicker response to alerts, you can configure the agent to send alerts immediately when they occur.

Agents send a periodic heartbeat to a Consolidator that helps ensure the agent is operating properly.

Understanding Consolidators

The Consolidator is part of the Business Logic layer in Microsoft Operations Manager 2000. The Consolidator is a service that runs on a select number of computers in a configuration group. A Consolidator provides Consolidator functionality, acts as an agent on the Consolidator computer, and provides Agent Manager functionality.

Consolidator Functionality

Consolidators receive collected information from agents. Consolidators perform central actions specified by processing rules, such as running a script or a batch file or notifying an operator of a detected condition. Consolidators also forward information to the DAS.

If a change occurs to a processing rule that applies to an agent on a computer in the Managed Computers list, the Consolidator ensures that the latest processing rules reach the agent. The Consolidator sends these processing rules to agents when the agent is installed and whenever the rules change.

Agent on the Consolidator Computer

A Consolidator acts as an agent on the computer where it is installed. The Consolidator performs all the actions that agents perform on remote computers. Because the Consolidator provides the same services as an agent, MOM does not install separate agents on Consolidator computers.

Agent Manager Functionality

The Consolidator contains an Agent Manager. The Agent Manager is responsible for installing and configuring agents on all the computers defined in its Managed Computers list.

You define an initial Managed Computer rule when you install the Consolidator. You can use wildcards and regular expressions to define this rule. The Managed Computers list, which is the result of the Managed Computer rule, is a dynamic list of computers that can change as you add, remove, and change computers in your enterprise. You can expand the Managed Computer rule through the MOM Administrator Console.

Periodically, the Agent Manager scans for any change in the computers that match the Managed Computer rule. The Agent Manager then installs, uninstalls, and reconfigures agents on computers in the Managed Computers list as necessary. The Agent Manager can perform these functions automatically, or only after your approval. The Agent Manager will install an agent on a computer only if that computer belongs to a Managed Computers list.

Why Use Multiple Consolidators

Configuration groups can contain more than one Consolidator. Having more than one Consolidator in a configuration group might be necessary for the following reasons:

  • Scalability
  • Security partitions
  • Collecting data through a firewall

Understanding Data Access Servers

The DAS is part of the Business Logic layer in Microsoft Operations Manager 2000. Most requests for data from the database and all requests to insert data into the database go through the DAS. The DAS links Consolidators, the MOM Administrator Console, and the Web Console server to the database.

Note

  • MOM Reporting does not use the DAS to request data from the database. MOM Reporting uses an ODBC connection, authenticated by Windows 2000, to the database.

The DAS is based on COM+ and Component Services that provide load sharing and object pooling for smoother operation. The DAS provides centralized database access logic, centralized query logic, shared caching of agent and event information, and pooled connections to the database.

The DAS receives information sent by Consolidators and inserts the information into the database. The DAS also routes processing rules, based on current computer grouping rules, from the database to Consolidators. Consolidators send these processing rules to agents.

The DAS maintains data consistency and logging. For example, when someone changes the resolution state of an alert, the DAS logs all configuration changes, along with the name of the user making the change.

Configuration groups can contain more than one DAS. Having more than one DAS in a configuration group might be necessary for scalability.

When a component or interface attempts to send data to or retrieve data from the database, the component or interface requests a DAS from the database computer. The database computer determines the least-loaded DAS and supplies that DAS to the component or interface requesting a DAS.

Understanding the Database

The database is part of the Data layer of Microsoft Operations Manager 2000. The database is the central storage facility for events, alerts, performance data, rules, and scripts. MOM supports SQL Server databases.

The database consists of two files: primary database definitions, data tables, and indices in one file and the database log in the second file.

Understanding Interfaces

MOM interfaces allow you to view the health of monitored computers and configure product functionality. The MOM Administrator Console provides central monitoring and configuration of MOM through Microsoft Management Console (MMC) snap-ins. The Web Console provides views of database information accessible from platforms supporting Microsoft Internet Explorer. MOM Reporting provides reports from data in the database.

MOM Administrator Console

The MOM Administrator Console provides the central monitoring and configuration point in Microsoft Operations Manager 2000. The MOM Administrator Console consists of snap-in applications that provide monitoring and configuration functionality. The Microsoft Operations Manager 2000 snap-in provides a framework for the following snap-ins:

Monitor | Used to create views for alerts, computers, computer attributes, computer groups, events, and performance data based on selected criteria. Also used to monitor product component status.
Rules | Used to create new computer attributes, computer grouping rules, processing rules, and scripts, and to create and manage notification groups.
Configuration | Used to configure agents, Consolidators, and Agent Managers.

The MOM Administrator Console can integrate with third-party problem ticket applications, customer knowledge bases, and custom business applications. The MOM Administrator Console provides a context menu that you can customize and extend to include applications, commands, or batch files in custom tasks. Right-clicking an item in the Monitor details pane displays the context-sensitive, customized menu, where you can select the custom task and send the selected item to that application.

Web Console

The Web Console allows you to view database information from any Windows platform that supports Microsoft Internet Explorer. The Web Console provides remote monitoring and easy access for roaming administrators.

MOM uses Active Server Pages and Microsoft IIS to provide a complete view of all collected information. The Web Console server connects to the database through the Data Access Server (DAS).

Using the Web Console, you can see many different views of the database information. You can see views related to events, alerts, computers, and performance. You can create custom views for specific situations, such as all Critical Error alerts. The Web Console front page is the Ops Portal, which provides customizable, preconfigured views for specific management areas

The Web Console provides monitoring capabilities. It does not provide rules definition or configuration capabilities.

MOM Reporting

MOM Reporting provides more than 70 standard reports. These reports include specific security auditing and general system monitoring reports and graphs useful for capacity planning or performance analysis.

MOM Reporting uses a run-time version of Microsoft Access and an ODBC connection, authenticated by Windows 2000, to the database. You can generate reports on demand or at scheduled times and save them in HTML format for viewing through an Internet browser, or linked from the MOM Administrator Console or the Web Console.

If you have the full version of Microsoft Access, you can customize the reports to meet your specific needs or to deliver reports in alternate formats for spreadsheets or e-mail.


Components

Microsoft Operations Manager 2000 consists of the following components:

Agent
Service that runs on each computer you want to monitor. An agent captures information from a remote computer, applies processing rules to the collected information, and sends the information to a Consolidator.
Consolidator
Service that runs on a select number of computers in your enterprise. A Consolidator includes an associated Agent Manager component, which installs, uninstalls, and configures agents. A Consolidator also acts as an agent on the computer on which it is installed. Consolidators send collected information to a Data Access Server (DAS).
Data Access Server (DAS)
Service that runs on a select number of computers in your enterprise. The DAS controls the flow of data between the database, Consolidators, and the MOM Administrator Console and Web Console.
Database
Storage facility for configuration information and collected data for a configuration group.
Web Console Server
Component installed on a Microsoft Information Services (IIS) computer that hosts the Web Console.


Understanding Agents

Agents are part of the Business Logic layer. An agent is a service that runs on every computer that you want to monitor. Agents are automatically installed on computers managed by Agent Managers.

When an agent is first installed on a computer, it collects Windows 2000 events from at least the previous two hours. Then the agent collects events and other monitored information as they become available. An agent can capture the following types of information from the computer on which it is running:

  • Events from Windows 2000 event logs
  • Events from third-party application event logs
  • Performance data such as thresholds and capacity planning data
  • Missing events
  • Timed events
  • WMI information, including changes to the system services list and SNMP traps
  • Events created by scripts

The agent applies processing rules to the collected information and performs actions as stipulated by the processing rules. By applying processing rules to collected information, the agent can perform any of the following actions and responses:

  • Filter events
  • Consolidate events into one event
  • Send data to a Consolidator
  • Send an alert when a performance threshold is crossed
  • Send an alert based on an event to a Consolidator
  • Generate an SNMP trap
  • Run a batch or command file
  • Change a state variable
  • Execute a script

The following figure illustrates agent functions.

The agent temporarily stores information in a buffer before sending it through a guaranteed, encrypted delivery mechanism to a Consolidator. Microsoft Operations Manager 2000 can integrate with enterprise management frameworks by sending high-priority events as SNMP traps from each agent.

The agent uses a guaranteed delivery mechanism to ensure that each item of data is sent. Agents continue to collect data even through lengthy network outages by batching and sending data in a controlled fashion when network connectivity resumes.

Encrypted, compressed communications between agents and Consolidators provides increased data security, and prevents network eavesdropping and protocol spoofing attacks. Compression reduces network bandwidth usage, providing performance over slow links. Encrypted and compressed communications are enabled by default.

At regular intervals, the agent initiates communications with a Consolidator. You can configure the amount of data sent at each interval. You can also configure whether the communications are encrypted, and set the encrypted communications port.

Agents send a periodic heartbeat to a Consolidator that helps ensure the agent is operating properly. In response to the heartbeat, the Consolidator lets the agent know if the agent's rules need to be updated. When an agent begins to use updated rules, it generates an event with an event ID of 21240.


Understanding Consolidators

The Consolidator is part of the Business Logic layer. The Consolidator is a service that runs on a select number of computers in a configuration group. A Consolidator provides Consolidator functionality, acts as an agent on the Consolidator computer, and provides Agent Manager functionality.

The following figure illustrates the functions of a Consolidator.

Functions of a Consolidator

Consolidator Functionality

Consolidators receive collected information from agents. Consolidators perform central actions specified by processing rules, such as running a script or a batch file or notifying an operator of a detected condition. Consolidators also send information to the Data Access Server (DAS).

If a change occurs to a processing rule that applies to an agent on a computer in the Managed Computers list, the Consolidator ensures that the latest processing rules reach the agent. The Consolidator sends these processing rules to agents when the agent is installed and whenever the rules change. You can configure how often Consolidators poll for rule changes.

Consolidators can forward alerts to another configuration group. For more information about alert forwarding, see Understanding Alert Forwarding.

Agent on the Consolidator Computer

A Consolidator acts as an agent on the computer on which it is installed. The Consolidator performs all the actions that agents perform on remote computers. Since the Consolidator provides the same services as an agent, Microsoft Operations Manager 2000 (MOM) does not install separate agents on Consolidator computers.

Agent Manager Functionality

The Consolidator includes an associated Agent Manager. The Agent Manager is responsible for installing and configuring agents on all the computers defined in its Managed Computer rule.

You can use wildcards and regular expressions to define the Managed Computer rule. The Managed Computers list, the result of the Managed Computer rule, is a dynamic list of computers that can change as you add, remove, and change computers in your enterprise. You can create and modify the Managed Computer rule using the MOM Administrator Console.

Periodically, the Agent Manager scans for any change in the computers that match the Managed Computer rule. The Agent Manager then installs, uninstalls, and reconfigures agents on computers in the Managed Computers list as necessary. The Agent Manager can perform these functions automatically, or only after your approval. The Agent Manager will install an agent on a computer only if that computer belongs to a computer group.

Why Use Multiple Consolidators?

Configuration groups can contain more than one Consolidator. Having more than one Consolidator in a configuration group might be necessary for the following reasons:

  • Scalability
  • Redundancy
  • Security partitions
  • Collecting data through a firewall

For more information about multiple Consolidators, see the Microsoft Operations Manager 2000 Installation Guide.

Scalability

If you want to ease the load on a Consolidator by having different sets of agents report to different Consolidators, you can install multiple Consolidators in a configuration group for scalability.

You can include a subset of the monitored computers in the configuration group in the Managed Computers list of one Consolidator, and another subset of the monitored computers in the Managed Computers list of another Consolidator. By configuring multiple Consolidators in a single configuration group, you spread the load among multiple computers.

Multiple Consolidators for scalability are also redundant.

Redundancy

MOM can provide Consolidator redundancy in configuration groups, which ensures that data is placed in the database even if a Consolidator is unavailable for some reason. Consolidators are redundant if they are in the same configuration group, connect to the same database, and use the same service account. If a Consolidator is unavailable, agents that typically send data through that Consolidator to the DAS can send data to a redundant Consolidator. Consolidators using different service accounts, that is, within different security partitions, are not redundant.

Multiple Consolidators for scalability are not simply inactive until another Consolidator becomes unavailable. Each Consolidator can manage its own agents and serve as a redundant Consolidator when necessary. If you configure a Consolidator and associated Agent Manager with no managed computer rules, then that Consolidator is inactive until another Consolidator becomes unavailable.

When an Agent Manager installs an agent on a computer, it identifies its associated Consolidator as the primary Consolidator for that agent.

Agents send periodic heartbeats to their primary Consolidator to report on the availability of the agent computer. In response to an agent heartbeat, the Consolidator sends the agent updated rules.

If an agent does not receive a response when it sends a heartbeat to its primary Consolidator, it connects to a redundant Consolidator. After being connected to the redundant Consolidator for 60 seconds, the agent tries its primary Consolidator. The agent keeps retrying its primary Consolidator at specified time intervals. Once the primary Consolidator computer becomes available again, the agent detects it and restores communication.

The MOM Management Pack module contains processing rules that generate alerts when a Consolidator is unavailable, and a redundant Consolidator takes over.

For more information about configuring MOM for redundancy, see the Microsoft Operations Manager 2000 Installation Guide and the Microsoft Operations Manager 2000 Operations Guide.

Security Partitions

If you want a configuration group to monitor computers in different Windows 2000 domains and you do not want the domains to share a common service account, you can install multiple Consolidators for security partitions.

A Consolidator must log on to Windows 2000 using a service account with Administrator privileges on all computers in its Managed Computers list. It must have sufficient privileges to install and uninstall agents. If you want a configuration group to include agents in different Windows 2000 domains and you do not want the domains to share a common service account, you can configure a separate Consolidator for the agents in each domain. Each Consolidator will log on using a service account with Administrator privileges for the computers in one domain.

We recommend that your enterprise configuration install a separate Consolidator to monitor only the Microsoft Exchange Servers. For MOM to properly monitor the Microsoft Exchange Server, the Consolidator must log on to Windows 2000 using an Exchange Administrator account.

This separate Consolidator for Exchange servers allows the agents on the Exchange servers to log on with user accounts, which is a MAPI requirement. The rest of the agents in your enterprise can run as Local System accounts.

Security partitions provide you with greater security and flexibility when designing configuration groups. You can design a configuration group that includes agents from many different domains without having one service account with Administrator privileges in all domains.

The following figure illustrates how multiple Consolidators for security partitions work.

Multiple Consolidators for security partitions

Collecting Data Through a Firewall

MOM can monitor computers outside a firewall. To monitor computers outside a firewall, you must manually install agents on the computers you want to manage that are outside your internal network. For more information about configuring MOM to monitor computers outside a firewall, see the Microsoft Operations Manager 2000 Installation Guide.


Understanding Data Access Servers

The Data Access Server (DAS) is part of the Business Logic layer. Most requests for data from the database and all requests to insert data into the database go through the DAS. The DAS links Consolidators, the MOM Administrator Console, and the Web Console server to the database.

Note

  • MOM Reporting does not use the DAS to request data from the database. MOM Reporting uses an ODBC connection, authenticated by Windows 2000, to the database.

DAS Functionality

The DAS components are based on the Microsoft Universal Data Access platform and use OLE DB application programming interfaces to send data to and receive data from the database. DAS components are installed in Component Services, which provides improved performance using object pooling. The DAS provides centralized database access logic, centralized query logic, shared caching of agent and event information, and pooled connections to the database.

The DAS receives information sent by Consolidators and inserts the information into the database. The DAS also routes processing rules, based on current computer grouping rules, from the database to Consolidators. Consolidators send these processing rules to agents.

The DAS maintains data consistency and logging. For example, when someone changes the resolution state of an alert, the DAS logs all configuration changes, along with the name of the user making the change.

Why Use Multiple Data Access Servers?

Configuration groups can contain more than one DAS. Having more than one DAS in a configuration group might be necessary for the following reasons:

  • Scalability
  • Redundancy

Scalability

When a component or interface attempts to send data to or retrieve data from the database, the component or interface requests a DAS from the database computer. The database computer determines the least-loaded DAS and supplies that DAS to the component or interface requesting a DAS. Having more than one DAS in a configuration group spreads the load.

Redundancy

Microsoft Operations Manager 2000 can provide DAS redundancy in a configuration group, which ensures that data is placed in the database even if a DAS is unavailable for some reason.

When you utilize more than one DAS, the database computer determines the least-loaded DAS and supplies that DAS to the component or interface requesting a DAS.

If a Consolidator and a DAS are on the same computer, the Consolidator usually connects to that DAS, while interfaces usually connect to any DAS that Consolidators are not using.

A component or interface will continue to use the same DAS until the DAS service is interrupted for some reason. Consolidators regularly receive updated DAS information from the database, so within 30 minutes, each Consolidator will know if a DAS has failed or if a new DAS has been added to the configuration group. Every DAS can be active at the same time.

The Operations Management Pack module contains several processing rules that generate alerts when a DAS is unavailable, and a redundant DAS takes over.

For more information about multiple Data Access Servers, see the Microsoft Operations Manager 2000 Installation Guide and the Microsoft Operations Manager 2000 Operations Guide.


Understanding the Database

The database is part of the Data layer. The database is the central storage facility for events, alerts, performance data, rules, and scripts.

Microsoft Operations Manager 2000 (MOM) supports Microsoft SQL Server databases. The database consists of two files: the primary database, which contains tables, indices, views, and stored procedures, and the transaction log. The MOM Express setup installs MSDE, which supports up to 2 GB of data.


Interfaces

Microsoft Operations Manager 2000 (MOM) interfaces allow you to view the health of monitored computers and configure product functionality. MOM offers the following interfaces:

MOM Administrator Console
Allows you to monitor data, create rules, and configure components. The MOM Administrator Console provides central monitoring and configuration of MOM through snap-ins.
Web Console
Allows you to view the data in the database from any Windows platform that can run Microsoft Internet Explorer. The Web Console provides remote monitoring and easy access for roaming administrators.
MOM Reporting
Allows you to run auditing reports and performance management and capacity planning graphs from the information in the database.


MOM Administrator Console

The MOM Administrator Console provides the central monitoring and configuration point in Microsoft Operations Manager 2000 (MOM). The MOM Administrator Console consists of snap-in applications that provide monitoring and configuration functionality. The MOM snap-in provides a framework for the following snap-ins:

Monitor
Used to create views for alerts, computers, computer attributes, computer groups, events, and performance data based on selected criteria. Also used to monitor product component status.
Rules
Used to create new computer attributes, computer grouping rules, processing rules, and scripts, and to create and manage notification groups.
Configuration
Used to configure agents, Consolidators, and Agent Managers.

The MOM Administrator Console can integrate with third-party problem-ticket applications, customer knowledge bases, and custom business applications. The Monitor snap-in provides a context menu that you can customize and extend to include applications, commands, or batch files in custom tasks. Right-clicking an item in the Monitor details pane displays the context-sensitive, customized menu, where you can select the custom task and send the selected item to that application.

Related Topics


Web Console

The Web Console allows you to view database information from any Windows platform that supports Microsoft Internet Explorer. The Web Console provides remote monitoring and easy access for roaming administrators.

Microsoft Operations Manager 2000 uses Active Server Pages and Microsoft Internet Information Services (IIS) to provide a complete view of all collected information. The Web Console server connects to the database through the Data Access Server (DAS).

Using the Web Console, you can see many different views of the database information. You can see views related to events, alerts, computers, and performance. You can create custom views for specific situations, such as all Critical Error alerts. The Web Console front page is the Portal, which provides customizable, preconfigured views for specific management areas.

Note

  • The Web Console provides monitoring capabilities. It does not provide the capability to define rules or configure product components.


MOM Reporting

MOM Reporting provides hundreds of standard reports. These reports include specific security auditing and general system monitoring reports and graphs useful for capacity planning or performance analysis.

MOM Reporting uses a run-time version of Microsoft Access and an ODBC connection, authenticated by Windows 2000, to the database. You can generate reports on demand or at scheduled times and save them in HTML format for viewing through an Internet browser, or linked from the MOM Administrator Console or the Web Console. If you have the full version of Microsoft Access 2000 or later, you can customize the reports to meet your specific needs or to deliver reports in alternate formats for spreadsheets or e-mail.

MOM Reporting Help provides descriptions of each report. Click the report, and right-click to select Report Help.


Understanding Configuration Groups

A configuration group consists of the following components:

  • One database
  • One or more Data Access Servers
  • One or more Consolidators and associated Agent Managers
  • Any number of agents

The following figure illustrates a basic configuration group.

Basic configuration group

Why Use Multiple Configuration Groups?

Each configuration group contains only one database and must have a unique name. The database provides a central storage location for all data collected from that configuration group, as well as alerts, rules, scripts, and configuration data. You can have more than one configuration group in your enterprise. Agents can reside in more than one configuration group, sending the same or different information to each configuration group. You can also forward alerts from one configuration group to another. The following list provides a few examples of why you might want more than one configuration group in your enterprise:

  • Geographic locations
  • Organizational departments
  • Network bandwidth

Naming Your Configuration Groups

Each configuration group in an enterprise must have a unique configuration group name. Microsoft Operations Manager 2000 uses this configuration group name to distinguish one configuration group from another. After you name a configuration group, you cannot change the name without uninstalling all components, including all agents.

For more information about multiple configuration groups, see the Installation Guide.


Rule Groups and Management Pack modules

Microsoft Operations Manager 2000 (MOM) is a rules-based system. Rules group similar computers together, process the majority of information you want to monitor, and define actions MOM will take. You can create two types of rules:

Computer grouping rules
Specify groups of computers.
Processing rules
Specify how MOM collects, handles, and responds to information.

Processing rule groups allow you to categorize processing rules. For example, you could create a processing rule group named High Security for processing rules that are security-related. You can associate a processing rule group with a computer group to carry out processing rules on specific computers.

MOM includes Management Pack modules, predefined computer groups and processing rules for monitoring specific applications or environments.

Related Topics


Understanding Computer Groups

Microsoft Operations Manager 2000 (MOM) allows you to group similar computers for monitoring and management. Then you can monitor and manage the group rather than each individual computer. Monitoring and managing computer groups saves you time and effort and minimizes configuration steps.

Computer grouping rules define these groups of computers. You can group computers together based on their domain, computer name, or attributes such as the operating system version or installed applications. You can also identify computers to always include or exclude from the computer group, regardless of their other characteristics.

You can also name the computer group. The name allows you to easily include one computer group in other computer groups.

Computer groups are dynamic. For example, a computer group of all Microsoft Windows 2000 computers includes all computers running Microsoft Windows 2000 when the rule was created, as well as any new computers onto which Microsoft Windows 2000 is installed. If you remove Windows 2000 from a computer, the computer no longer fits the computer grouping rule. The Agent Manager scans managed computers to track and implement these changes.

Computer grouping rules are created and enforced in only one configuration group. Computer grouping rules created in one configuration group do not apply to other configuration groups.

By Domain and Computer Names

You can group computers using their domain or computer names. MOM allows you to identify the domain or computer name using wildcards, regular expressions, or Boolean regular expressions.

By Computer Attributes

You can group computers using characteristics the computers have in common. These characteristics are called attributes. When you create a computer grouping rule using attributes, you can choose from attributes already created or you can create your own.

You create a new computer attribute based on a Windows Registry key or value. Then, you can use that attribute to create a computer grouping rule. When MOM evaluates the rule, it finds any computers with that attribute and includes them in the computer group.

Using attributes, for example, you could create computer groups that include all computers running Microsoft Windows 2000.

You can also create computer groups using attributes and other computer groups. For example, you could create a computer group that includes all Windows 2000 computers that are not running Microsoft Windows 2000 version 4.5.

By Including or Excluding

You can add computers to a computer group by including them. Computers that are included are always part of the computer group, regardless of their other characteristics. If your enterprise includes computers to be monitored outside a firewall, you must include them in a computer group, since MOM cannot collect information or attributes from a computer outside the firewall.

You can also exclude computers from a computer group. Computers that are excluded are never part of the computer group, regardless of their other characteristics.

Related Topics


Understanding Processing Rule Groups

Processing rules define how Microsoft Operations Manager 2000 collects, handles, and responds to information. Processing rule groups hold and categorize processing rules. For example, a processing rule group named Microsoft SQL Server contains processing rules related to Microsoft SQL Server. Grouping processing rules together allows you to associate more than one processing rule with a computer group.

Processing rule groups provided as part of Management Pack modules contain specific Microsoft Knowledge Base information that defines the purpose, features, and configuration of the processing rule group.

Related Topics


Associating Processing Rule Groups with Computer Groups

You associate a processing rule group with a computer group so Microsoft Operations Manager 2000 evaluates specific processing rules on specific computers. For example, you could associate a processing rule group named High Security with a computer group named Accounting. All processing rules in the High Security processing rule group will be evaluated on computers in the Accounting computer group.

Evaluating the processing rules on all the computers in the computer group ensures similar data collection and management. Using the Monitor snap-in, you can create a monitoring view of only the computers in that computer group.

If you associate a computer group with a parent processing rule group, rules in both the parent and child rule groups are evaluated on the computer group's computers.

If you have parent and child processing rule groups, you might want to associate the individual child groups with computer groups instead of associating the parent group with computer groups. If you want all child group rules to be evaluated on the computers in a computer group, then you can associate the parent group with the computer group.

Also as a general rule, if you associate computer group A with parent rule group 1, and computer group B with the child rule group 1.1, rule group 1.1 is evaluated on computers in both computer groups A and B.

Related Topics


Understanding Management Pack modules

Microsoft provides a number of predefined, out-of-the-box solutions called Management Pack modules. Management Pack modules are ready-to-use knowledge for monitoring and managing specific applications and environments, such as Microsoft Exchange Server. Management Pack modules provide immediate and extensive Windows 2000 expertise.

You can load Management Pack module components and begin specialized event and performance management immediately.

Management Pack modules provide specific processing rule groups, computer groups, and processing rules, such as filters, alerts, and performance sampling and threshold rules. Management Pack modules also provide predefined computer attributes, providers, scripts, and the Microsoft Knowledge Base, as well as public views and default notification groups.

You can install Management Pack modules during the setup process or by importing them. Microsoft offers revised, updated, and additional Management Pack modules as they are developed. You can import updated Management Pack modules, and any changes you have made to earlier versions can be preserved.

You can also export Management Pack modules. You can choose to export a processing rule group, and the export process also exports all the computer groups, data providers, scripts, and other information required by the processing rules within the groups. The exported information is a Management Pack module.

The following list is a sampling of the Management Pack modules available:

  • Default Event Collection for Microsoft Windows NT and Windows 2000
  • Microsoft Windows 2000 Active Directory
  • Microsoft Windows 2000 Operating Syste
    • m
  • Microsoft Internet Naming Service
  • Microsoft Routing and Remote Access Service
  • Microsoft Internet Information Services
  • Microsoft Systems Management Server
  • Microsoft Operations Manager

For detailed information about the purpose, features, and configuration of Management Pack modules, see the Management Pack Module Configuration Guide.

Related Topics


Collected Information

Microsoft Operations Manager 2000 (MOM) can collect an array of information from many different sources. Using processing rules, you can specify how MOM collects, handles, and responds to information.

Processing rules define the information MOM collects and retains in the database. For example, processing rules can specify which events trigger alerts, how the alerts are processed, and which events are filtered from the database.

Processing rules have two parts. The first part defines the information that MOM collects. This information is the focus of this section in the Help. The second part of a processing rule, which defines what MOM does with the information it collects, is covered in the Help section "Information Processing and Responses."


Understanding Providers

Microsoft Operations Manager 2000 (MOM) collects information from a variety of sources called providers. Processing rules define the provider of the information you want to collect. MOM can collect information from the following provider types:

Application log providers
Provide events from Microsoft Internet Information Services (IIS) log files, SQL Server trace log files, generic ASCII log files, and UNIX syslog files.
Timed event providers
Provide events generated by MOM at scheduled times.
WMI event providers
Provide events from Windows Management Instrumentation (WMI), such as SNMP traps sent to the computer or service status changes.
WMI numeric data providers
Provide sampled WMI numeric values.
Generic providers
Provide events that MOM generates internally, such as when an agent heartbeat does not occur on time. Also provides events created by scripts. The Generic provider is available only in Management Pack processing rules.

Related Topics


Understanding Events

Events make up the majority of the information Microsoft Operations Manager 2000 (MOM) collects from providers. An event is a significant occurrence in the system or in an application. MOM monitors events logged in Windows 2000 and other event logs, and responds to timed events, missing events, and script-generated events.

Windows 2000 Events

Windows 2000 log events in specific event logs, and MOM collects events from these logs. MOM can collect events from the following Windows 2000 event logs:

Application
Records events from applications on the computer.
DNS Server
Records events from the Domain Name Service (DNS) server on Windows 2000 computers.
File Replication
Records events from the File Replication service on Windows 2000 computers.
Directory service
Records events from the Active Directory service on Windows 2000 computers.

Application Log Events

Some software applications create their own text log files. Using MOM, you can monitor the following application log files or messages:

  • Microsoft Internet Information Services
    • World Wide Web Service
    • FTP Service
    • Gopher Service
  • Internet Locator Service
  • Microsoft SQL Server trace log
  • Any generic single-line log
  • UNIX syslog files

Note

  • MOM can monitor log files that applications append to, as opposed to log files that applications periodically overwrite. If you want MOM to monitor a generic log file that is periodically overwritten, you can create a utility that monitors the overwritten log file and appends new information to another log file. Configure MOM to monitor the appended log file.

UNIX Syslog Messages

UNIX systems can forward syslog messages, messages about system activity, to another computer. You can configure a UNIX computer to forward syslog messages to a MOM agent. The agent can receive syslog messages and create events for them, adding these events to the datastream.

For more information about configuring MOM to provide UNIX syslog messages as events, see the Installation Guide.

Missing Events

A missing event is an event that is supposed to occur within a specified time interval, but does not. You can create processing rules for events that you expect to occur within a specific time interval. If the event does not occur, it is considered to be missing.

Timed Events

MOM can create timed events, events automatically created on a timed basis. For example, you want to test your third-party paging notification software once a day. You can create a processing rule that creates a daily event at 3:00 P.M. You can then assign a notification response to page a network administrator, sending a test message. Timed events are not stored in the database.

SNMP Traps

MOM can monitor Simple Network Management Protocol (SNMP) traps through extrinsic WMI events. An SNMP trap is a packet of information sent by a network device that is running the SNMP. SNMP is a protocol based on TCP/IP and is used to monitor and manage network devices. The network device can be hardware, such as a router, or a computer running any operating system. An SNMP trap is usually sent in response to an event, such as a service stopping. Some SNMP traps indicate normal system operation.

Service Status Changes

MOM can monitor service status list changes through intrinsic WMI events. A service is a program or routine that provides support to other programs. A WMI event is generated when a service changes from one of the following states to another state:

  • Stopped
  • Starting
  • Stopping
  • Running
  • Continuing
  • Pausing
  • Paused

For example, you might want to monitor the print spooler on a remote computer. You want to know if the spooler service stops for any reason. You can create a processing rule that monitors WMI for an event indicating that the Spooler service on the computer has stopped, and when the event occurs, generates an alert.

Related Topics


Understanding Performance Data

Microsoft Operations Manager 2000 (MOM) can monitor and graph numeric data from WMI. Scripts can also generate performance data. You can create processing rules defining performance thresholds that, when crossed, create an alert.

MOM allows you to monitor WMI numeric properties. In WMI, the namespace is a unit for grouping classes and instances. A class is the basic unit of management. An object is a hardware or software system component represented as an instance of a WMI class, and an instance is the representation of a managed object. The property of the object instance contains the numeric value you want to monitor.

Performance Measurement

MOM measures performance by sampling numeric data from Windows 2000 performance counters and from WMI. You can identify trends by collecting values as often as you specify, and creating graphs of the information.

You can identify WMI numeric properties to track. For example, MOM can monitor a computer's free disk space, collecting a value at a specified interval. You can use this data in capacity planning. Monitoring the free disk space provides useful information for you to use in planning for upgrades or additional drives.

Performance Thresholds

MOM can also monitor computers for performance thresholds using Windows 2000 performance counters or using WMI numeric values. You can create a threshold value, and when the threshold is crossed, MOM generates an alert. For example, you could set a threshold value for free disk space being less than 20 percent. If the sampled free disk space value falls below the 20 percent threshold, MOM can create an alert.

Related Topics


Understanding Criteria

You identify the information you want Microsoft Operations Manager 2000 to process by specifying its criteria. Once you specify the provider, you must define the criteria that identify the specific event, alert, or performance data. For example, specific criteria help distinguish one event from another. You can define some criteria using wildcards, regular expressions, or Boolean regular expressions.

Event Criteria

To identify specific events, you can specify the following criteria, as well as combinations of these and other criteria:

  • Event source
  • Event number
  • Event type
  • Description text
  • User generating the event
  • Source computer
  • Source domain
  • Computer on which the event is logged
  • Domain in which the event is logged

Alert Criteria

An alert processing rule requires that you identify a number of alerts to which to assign a response. To identify specific alerts, you can specify the following criteria, as well as combinations of these and other criteria:

  • Alert source
  • Alert severity
  • Alert owner
  • Resolution state
  • Computer

Performance Criteria

To identify performance data, you can specify the following criteria, as well as combinations of these:

  • Counter
  • Object
  • Instance
  • Domain
  • Computer

Related Topics


Information Processing and Responses

Microsoft Operations Manager 2000 (MOM) can respond in a number of ways to the information collected from monitored computers. Actions and responses are defined within processing rules.

The first part of a processing rule defines the information that MOM collects from monitored computers. The second part of a processing rule defines how MOM processes and responds to the collected information. This section of the Help describes the second part of processing rules.


Processing Events, Alerts, and Performance Data

Processing rules define the actions that Microsoft Operations Manger 2000 takes when it collects specific information. The following sections provide information about processing events, alerts, and performance data:

  • Understanding Processing Rules
  • Collecting Specific Events
  • Saving Monitored Information to the Database
  • Generating Alerts
  • Suppressing Duplicate Alerts
  • Detecting Missing Events
  • Consolidating Similar Events
  • Filtering Events
  • Sampling Performance Values
  • Comparing Performance Values


Understanding Processing Rules

When you create most processing rules, you define how Microsoft Operations Manager 2000 (MOM) collects, handles, and responds to specific information. When MOM then receives information that matches a processing rule, a processing rule match occurs.

When a processing rule match occurs, MOM performs the actions of the processing rule as well as the response defined in that rule. For example, a processing rule might specify that an event is to be saved in the database, generate an alert, and send an e-mail to a network administrator.

MOM allows you to create different types of processing rules. Each type of processing rule has an implicit action, such as generating an event, generating an alert, or storing the data in the database.

When you create a processing rule, you can also define the significance of the specified condition and provide detailed information to help administrators resolve the problem. This information is stored with the processing rule, and is called the company knowledge base.

Note

  • Management Pack modules contain information from Microsoft called the Microsoft Knowledge Base. You cannot edit the Microsoft Knowledge Base.

Event Processing Rules

MOM handles events through event processing rules. MOM evaluates event processing rules in the following order:

Collection rules
Identify events with specific criteria to be collected from specific sources. Collection rules do not generate alerts or provide responses.
Missing event rules
Specify that MOM generates an alert or provides responses when a defined event does not occur during a specified time. MOM stores missing event alerts in the database.
Consolidation rules
Specify that MOM groups multiple similar events on an agent computer into a single summary event. MOM stores summary events in the database.
Filtering rules
Specify whether you want MOM to ignore the specified events. Filtering rules typically identify events that you do not consider significant.
Event rules
Specify that you want MOM to generate an alert or run responses when specific events occur. You can create event rules when certain events are not covered in other processing rules. MOM stores the events and alerts in the database.

Alert Processing Rules

An alert processing rule allows you to specify a response for an alert or for a number of previously defined alerts. For example, you could specify that the High-Priority Notification Group gets paged for all Critical Error alerts resulting from the processing rules in the Microsoft SQL Server processing rule group.

Performance Processing Rules

The following rules define how MOM processes WMI numeric data:

Measuring rules
Specify that MOM collects numeric values from WMI. MOM stores sampled numeric measures in the database. You can view this graphical information using the Monitor snap-in and the Web Console. Measuring rules can include a response.
Threshold rules
Specify that MOM generates an alert when a WMI value crosses a defined threshold. MOM does not store threshold data in the database. Threshold rules can include a response.

Related Topics


Collecting Specific Events

Microsoft Operations Manager 2000 (MOM) collects information based on processing rules. No information is collected by default.

Collection rules are the first processing rules evaluated by MOM. Collection rules allow you to identify events with specific criteria to be collected from specific sources. These events are added to the datastream processed by MOM. Events that match a collection rule are further evaluated for other processing rule matches.

Collection rules do not generate alerts or provide responses. Collection rules provide an easy way to centralize events in a common database.

Related Topics


Saving Monitored Information to the Database

Microsoft Operations Manager 2000 (MOM) saves most information matching a processing rule to the database unless you specify otherwise. For example, if you create a processing rule that generates an alert when a specific event occurs, MOM stores the event and the alert in the database. You can create filtering rules that specify events that you do not want MOM to process or store.

You can monitor the collected events, alerts, and performance data using the Monitor snap-in and the Web Console. You can create reports from the collected data using MOM Reporting.

Related Topics


Generating Alerts

Alerts help you analyze events and performance thresholds to detect conditions and ensure that Microsoft Operations Manager 2000 brings the condition to your attention. Typically, alerts mean that the condition indicates potential problems. You can also create alerts that indicate informational events. Several processing rules can generate alerts, along with other actions:

  • Event rules
  • Missing event rules
  • Performance threshold rules

You can assign more than one alert to an event. For example, a hard disk failure event can generate a Critical Error alert that initiates a paging response. An administrator is paged with the pertinent information about the hard disk failure. The same hard disk failure event can also generate an Error alert that sends an SNMP trap to an administrator.

Note

  • In contrast, an alert processing rule allows you to create the same responses for many alerts. For example, you could specify that a specific administrator is paged whenever a Security Breach alert occurs.

Additional information related to generating alerts is available in the following sections:

  • Alert Severity
  • Alert Resolution

Related Topics


Alert Severity

When an event or threshold occurs that matches a processing rule, Microsoft Operations Manager 2000 associates the specified alert, along with the alert severity, to that event. The alert severity allows you to determine at a glance the importance of the indicated condition. You decide the alert severity when you create the processing rule. Possible alert severities are defined as follows:

Service Unavailable icon | Service Unavailable. Red down arrow identifies events generated for missed agent heartbeats and other events indicating that an application or service is unavailable to its users.
Security Breach icon | Security Breach. Red target identifies an alert that indicates a security compromise has occurred. Systems on the network are at risk.
Critical Error icon | Critical Error. Red stop sign identifies an alert that indicates a serious problem needing attention immediately.
Error icon | Error. Orange square identifies an alert that is important and needs attention soon.
Warning icon | Warning. Yellow triangle identifies an alert that might indicate future problems or lower priority issues requiring research.
Information icon | Information. Green circle identifies an alert that simply provides information.
Success icon | Success. Blue half-circle identifies an alert that indicates a successful event or operation.
No alerts | No alerts. Indicates that no alerts are present.

Related Topics


Alert Resolution

When an event or threshold occurs that matches an alert-generating processing rule, Microsoft Operations Manager 2000 (MOM) generates an alert. You can monitor alerts using the Monitor snap-in and the Web Console.

When you monitor alerts, you can read important information about each alert that helps you determine your next action. An alert includes the following properties, among others:

  • Alert icon and severity
  • Computer generating the event associated with the alert
  • Resolution state
  • Resolution history
  • Knowledge base
  • Custom alert fields

Resolution State

Resolution state indicates whether you have begun to resolve the alert. You can change the resolution state of an alert to track resolution progress. The default resolution states are defined as follows:

New
Indicates this alert has not yet been addressed. Alerts are New by default.
Acknowledged
Indicates that this alert has been read and acknowledged, but not assigned.
Level 1: Assigned to helpdesk or local support
Indicates that the help desk or local support is now responsible for this alert.
Level 2: Assigned to subject matter expert
Indicates that a subject matter expert is now responsible for this alert.
Level 3: Requires scheduled maintenance
Indicates that the alert identifies a condition requiring maintenance, which has been scheduled.
Level 4: Assigned to external group or vendor
Indicates that an external group or vendor is now responsible for this alert.
Resolved
Indicates that the condition that generated this alert has been handled or solved.

You can modify or delete the default resolution states (except New and Resolved) and also create your own to meet the needs of your network enterprise. Example custom resolution states might include In Progress or Deferred.

You can set a service level agreement time for each resolution state. Service level agreement time is the maximum time that an alert can remain in a particular resolution state. For example, company policy might require that no alert can remain in the New resolution state for longer than 10 minutes. If an alert remains in the New state for longer than 10 minutes, it is considered a service level exception. The Monitor snap-in provides a view of all service level exceptions.

Note

  • Scripts can also change alert resolution states. For example, if you run a script to resolve an alert condition, the script can also change the resolution state to Resolved.

Resolution History

MOM automatically tracks and records all changes to alert properties, including changes made by a processing rule, changes made by scripts, and any automatic responses that have occurred. You cannot edit the automatic alert resolution history. It provides a record of alert resolution.

You can, however, add your own information to the resolution history. When you change the resolution state of a specific alert or when you have gathered more information about the issue, you can provide your own comments to keep an up-to-date record of the alert resolution process. Providing specific comments allows you to accumulate knowledge about this particular instance of the alert. By adding resolution comments to individual alerts, you can track how a particular condition was addressed. The resolution history is important in tracking the alert, particularly if the process of resolving the alert spans several operator shifts.

Knowledge Base

Processing rules can contain information about a specified event, alert, or performance condition. This information can describe the condition, its importance or significance, and provide details to help administrators resolve it. This information is stored with the processing rule, and is called the knowledge base. When you view the properties of an alert, you can examine the knowledge base. You can add information to the company knowledge base when you create a processing rule and when you resolve an alert.

Some knowledge base information is already contained in processing rules provided with Management Pack modules. This information is the Microsoft Knowledge Base. You cannot edit this information.

Over time, the company knowledge base can become invaluable to an organization. It reflects specific knowledge gained through experience, and is available to benefit others in your organization.

Custom Alert Fields

You can create your own custom alert property fields. You can view these fields when you view the properties of any alerts. Custom alert fields might include the following examples:

  • Trouble-ticket number from a related help desk system
  • Customer name whose service level agreement is affected by this indicated condition
  • Building containing the affected computer

Related Topics


Suppressing Duplicate Alerts

Event storms occur when an application or system rapidly produces a large number of identical events.

If you have an alert associated with an event in an event storm, receiving multiple alerts for the same event within a short time is more annoying than useful. The Consolidator can provide duplicate alert suppression. If duplicate alerts are received while the original alert remains unresolved, Microsoft Operations Manager 2000 combines the duplicate alerts into a single alert. The Monitor snap-in and the Web Console then display only a single alert. The alert properties indicate the number of alerts that were combined.

You can enable duplicate alert suppression when you create a processing rule. You can specify the fields in the alerts, the events, or the thresholds that generated the alerts that must be the same for the alert to be considered a duplicate.

Related Topics


Detecting Missing Events

A missing event is an event that is supposed to occur within a specified time interval, but does not. If you perform or automate routine tasks such as system backups, Microsoft Operations Manager 2000 (MOM) can generate alerts and responses if these tasks do not occur as planned.

For example, each night, you might run a backup application (BackupApp) that backs up your critical data. The backup should finish successfully between midnight and 6:00 A.M. When this application finishes successfully, it logs a 1001 event in the Application event log. You can create a missing event rule for the 1001 event to show up in the Application event log between midnight and 6:00 A.M. If the 1001 event is not logged during that time, (MOM) can send an alert and respond with a paging notification to a network administrator.

Related Topics


Consolidating Similar Events

Consolidation rules group multiple duplicate events from an agent computer into one summary event and one normal event. Event consolidation provides a combined event to replace many similar events generated in a short time period.

Event consolidation can reduce system stress during an event storm. For example, if a hard disk begins to fail, it might send 100 events each second as failure notification. A consolidation rule could compress all events occurring within 60 seconds into one summary event and one normal event.

The combined, or consolidated, event shows the number of duplicate events that were consolidated during a specified time, and the time of the first and last event that the consolidated event represents.

Microsoft Operations Manger can consolidate events from a single computer. If multiple similar events occur on two computers during the specified time, the individual agents consolidate the events on each computer, resulting in two separate summary events.

Consolidation rules do not generate alerts or define responses. You can create other event rules to generate alerts or provide responses for the consolidated event.

Related Topics


Filtering Events

Filtering helps you effectively manage the large number of events that occur throughout your network. You may not want Microsoft Operations Manager 2000 (MOM) to process every event that occurs on every computer. Filtering rules can specify which events MOM neither processes nor stores in the database.

For example, you might not want to know every time a document is deleted from the print queue. Windows records this event in the System event log with an event ID of 13. You could create a filtering rule that ensures MOM does not process or record print queue events with an event ID of 13.

MOM evaluates filtering rules after consolidation rules and before event rules. MOM provides you with the following choices for filtering actions:

Pre-filter
For events matching a pre-filter, MOM stops evaluating further processing rules, and does not save matching events to the database.
Database filter
For events matching a database filter, MOM continues evaluating processing rules, but does not save matching events to the database. You can define responses for database filters.
Conditional filter
For events matching a conditional filter, MOM continues evaluating processing rules, but saves events to the database only if another processing rule match occurs. You can define responses for conditional filters.

Related Topics


Sampling Performance Values

Creating performance measurement rules allows you to monitor WMI numeric data. You can identify trends by sampling average values as often as you specify.

In a performance measurement rule, you can identify a performance counter or WMI numeric data provider, and then specify a schedule for the data to be sampled. You can view graphs of sampled performance data in the MOM Administrator Console, Web Console, and in certain reports.

Sampled performance data is stored in the database. You can define responses for sampling rules.

Related Topics


Comparing Performance Values

Creating performance threshold rules allows you to monitor computers for performance thresholds that you define. Microsoft Operations Manager 2000 (MOM) compares sampled values to the threshold, and when computer activity crosses the threshold, MOM generates an alert. You can define responses for threshold rules.

An example of a performance threshold is a processing rule that monitors computer processor usage, checking once every three minutes for processor usage over 75 percent. If the processor usage stays over 75 percent for an extended time, MOM can generate an alert.

Related Topics


Understanding Alert Forwarding

Microsoft Operations Manager 2000 (MOM) can forward alerts from one configuration group to another. Alert forwarding can provide MOM functionality to an organization's regional areas, while allowing a central administrative group to monitor alerts from the entire network. Alert forwarding enables Consolidators in one configuration group to send alerts to another configuration group, creating an efficient hierarchical alert management structure for large enterprise networks.

The central configuration group, the group to which alerts are forwarded, is called the master configuration group. Configuration groups that forward alerts to the master configuration group are called zone configuration groups.

Consolidators in a zone configuration group forward all alerts from their associated Agent Manager's managed computers to the master configuration group. Only alerts, and their associated events, are forwarded. Performance data and computer configuration data from the managed computers are not forwarded.

The following figure illustrates alert forwarding from two zone configuration groups to a master configuration group.

Master configuration group

MOM inserts forwarded alerts and their associated events into both the zone and the master configuration group databases. You can manage alerts independently in both configuration groups. Changes you make to a zone alert's resolution status, owner assignment, or history do not affect that alert in the master configuration group. Changes you make to a master alert's resolution status, owner assignment, or history do not affect that alert in the zone configuration group. Duplicate alert suppression is also managed at each configuration group. Alerts are forwarded to the master configuration group before duplicate alert suppression runs.

Alert responses are also independent. The zone agent or Consolidator can carry out responses defined in the original processing rule. These responses are only carried out in the zone configuration group. When the alert is forwarded, alert processing rules in the master configuration group can apply a separate response. If you have a response for a forwarded alert that you want to run specifically in the master configuration group, you should define an alert processing rule for that alert response in the master configuration group, and specify to run the response on the Consolidator computer. If you specify to run the response on the agent computer, the response runs on the zone Consolidator computer.

Note

  • An alert processing rule allows you to define one response for many alerts.

For an alert to be forwarded to the master configuration group, the processing rule that generated the alert must be installed in both zone and master configuration groups. You can ensure that the processing rule is in both configuration groups by installing the same Management Pack modules in both groups. If you create your own alert-generating processing rules, export the processing rules and import them into the other configuration group. If you do not export and import your processing rules, alert forwarding for those rules will not occur. You cannot simply create the same rules in both configuration groups.

If you create a processing rule in a zone configuration group, and this rule does not exist in the master configuration group, the response for the processing rule is carried out only in the zone configuration group. Processing rules that exist in a single configuration group allow you to manage those alerts locally. They are not forwarded to the master configuration group. Processing rules that exist only in the master configuration group can be managed locally, as well.

The zone Consolidator forwards alerts through its local agent to the master configuration group Consolidator, and then through the master Data Access Server (DAS) to the master database. Alert delivery through the agent is assured.

For more information about configuring alert forwarding, see the Microsoft Operations Manager 2000 Installation Guide and the Microsoft Operations Manager 2000 Operations Guide.


Understanding Responses

A response is an action initiated by Microsoft Operations Manager 2000 (MOM) when a processing rule match occurs. Using processing rules, you can define an automated response to a detected condition. Responses help resolve the issue indicated by the event. The following processing rule types allow you to define responses for a processing rule match:

  • Event
  • Filter (database and conditional filters only)
  • Missing event
  • Alert
  • Performance sample
  • Performance threshold

You can define the following automated responses within processing rules:

  • Send a notification to a notification group
    • Send an e-mail
    • Send a page
    • Send an external command notification
  • Execute a command or batch file
  • Send an SNMP trap
  • Change state variables
  • Launch a script

You can define more than one response for each processing rule match. For example, if an event indicates that a critical application has stopped, MOM can respond by restarting the application and by paging a network administrator.

Note

  • In contrast, when you create an alert processing rule, you can assign one response to a number of alerts.

Responses can occur on the Consolidator computer or the agent computer. Responses that occur on the Consolidator computer are central responses. Responses that occur on the agent computer are local responses.

Related Topics


Notifications

Sending a notification to a network administrator is one way Microsoft Operations Manager 2000 can respond to a processing rule match. The Consolidator performs notifications. Notification responses include the following actions:

  • Sending an e-mail
  • Sending a page
  • Sending a notification by external command

For notification responses, you must create notification groups.

Related Topics


Notification Groups

A notification group specifies operators and operator schedules. An operator is someone who can receive and respond to a notification. Operator schedules indicate the days of the week and hours of the day when the person can be reached by e-mail, page, or external command notification. By using notification groups, you can create shift-based responsibility for handling responses.

By using the Rules snap-in, you can create the notification group and assign operators within the notification group. Operators can belong to more than one notification group.

For complete coverage, you must schedule at least one operator in each notification group to receive an e-mail or page for every hour in every day. If certain times are not included in at least one operator's schedule, then no one is notified if the processing rule match occurs during that time.

For example, a default notification group is titled Security Specialists. When you create security-related processing rules, the alert response can include notifying the Security Specialists notification group. The operators within the Security Administrators notification group are individuals whose schedules indicate when they can receive a notification. When a processing rule match occurs, Microsoft Operations Manager 2000 notifies the operators whose schedules indicate their availability.

Related Topics


E-mail

Microsoft Operations Manager 2000 (MOM) can send an e-mail to a notification group when a processing rule match occurs. MOM supports Microsoft Exchange and SMTP for e-mail notifications. For more information about configuring e-mail notification, see the Installation Guide.

For example, you might want a database administrator to receive an e-mail if a Critical Error alert occurs on Microsoft SQL Server computer. You can create an alert processing rule that sends an e-mail response to the database administrator operator for every Critical Error alert rule in a processing rule group.

You can specify information to include in the e-mail, including, but not limited to, the following information:

  • Computer name generating the alert or event
  • Alert description
  • Time of the alert or event
  • Alert severity
  • Alert resolution state

If an application or computer rapidly produces a large number of identical events, called an event storm, and the event is one that calls for an e-mail response, you could potentially receive hundreds of identical e-mails. MOM can suppress duplicate alerts, so that you will see only one alert and receive only one e-mail.

Related Topics


Paging

Microsoft Operations Manager 2000 (MOM) can send a page to designated operators when a processing rule match occurs. A third-party paging service is required. Your paging service must provide an SMTP e-mail service for MOM paging to work. MOM paging works by sending an e-mail to the paging service, which forwards the e-mail to the appropriate paging recipient.

For example, you might want a network administrator to be paged for any Service Unavailable alerts. When a Service Unavailable alert occurs, MOM could page a high-priority notification group, such as Help Desk Supervisors. The pager message could, for example, include the name of the computer generating the alert and the event text.

Related Topics


External Command

Microsoft Operations Manager 2000 (MOM) provides paging through the SMTP e-mail service. You might also want to use another paging software application to avoid paging through the SMTP e-mail service.

You can use third-party paging applications to notify operators of a detected condition. You can configure MOM to use an external command line to run paging software. For information about running a third-party paging application from the command line, see the paging software documentation.

Related Topics


Command or Batch Files

You can configure Microsoft Operations Manager 2000 (MOM) to run a command or batch file when a processing rule match occurs. You can run the command or batch file on the agent or Consolidator computer.

For example, you might want to periodically stop and restart a Windows service with a known memory leak to reclaim the memory. You can create a performance threshold rule that monitors memory usage on the service computer. The processing rule generates an alert when memory usage goes over 85 percent and stays that way for a specified period. In the alert response for the event, you can specify that MOM runs a command or batch file containing the NET STOP BADSERVICE and NET START BADSERVICE commands on the monitored computer.

Note

  • The MOM Administrator Console provides a context menu that you can customize and extend to include custom tasks. These custom tasks can make use of applications, commands, or batch files. Right-clicking an item in a Monitor details window displays the context-sensitive, customized menu, where you can select the custom task you have created and send information about the selected item to that application.

Related Topics


State Variables

Microsoft Operations Manager 2000 (MOM) provides state variables to allow you to keep track of the ongoing state of your enterprise. You can configure MOM to set or change state variables when a processing rule match occurs without needing to launch a script. You can then access the state variables from a script as you would access any named ScriptState object using the GetSet method. This response provides efficient correlation of high volume events. For more information about Scripting and the ScriptState object, see the Help.

For example, you want to monitor logon attempts and page your administrator if an excessive number of logon failures occur within a given period across all computers in your enterprise. A high number of logon failures in a short time might indicate a distributed attempt to break into the network. You can create a processing rule to increment a state variable every time a logon failure occurs. This increment is performed in highly optimized code rather than in a script, and has minimal performance impact, even during the start of the business day when logon activity is very high. You can then run a script at regular intervals to check the state. If the number of failures is not excessive, the script resets the variable. If the number is excessive, the script pages your administrator.

You can configure MOM to update state variables in any of the following ways when a processing rule match occurs:

  • Increment variable value
  • Decrement variable value
  • Set variable value to property
  • Set variable value to text
  • Set variable value to number
  • Store the last n occurrences

You can configure MOM to update the state variable at the agent or Consolidator computer.

Related Topics


Scripts

You can create automated scripts that Microsoft Operations Manager 2000 (MOM) runs in response to a processing rule match. Scripting capabilities provide advanced monitoring and responses. You can use standard Microsoft scripting languages to create scripts for MOM to implement.

Related Topics


SNMP Traps

Microsoft Operations Manager 2000 (MOM) provides SNMP capabilities to allow integration with other network monitoring applications. You can configure MOM to generate an SNMP trap when an alert-generating processing rule match occurs. An SNMP-ready monitoring application can then capture these traps. You can ensure the event information is captured and stored in the database, as well as passed on to other network monitoring applications.

For example, you want MOM to send an SNMP trap whenever a Windows service stops. You can create a processing rule to alert you when a service stop event occurs. The product then sends an SNMP trap that contains all the event information in the SNMP trap variable bindings.

The Windows SNMP service must be installed on the agent computer.

You can specify that SNMP traps are sent from the agent or Consolidator computer. The advantage of sending a trap from the agent computer is the trap originates on the computer experiencing a problem. This is a requirement if you are integrating MOM with other monitoring tools. This solution requires SNMP installation and configuration of SNMP on each agent computer. Sending a trap from the Consolidator computer reduces SNMP installation and configuration.

Related Topics


MOM Administrator Console Overview

Microsoft Operations Manager 2000 (MOM) provides an interface based on Microsoft Management Console (MMC) technology. The MOM Administrator Console is the central monitoring and configuration point for configuration groups.

The MOM Administrator Console contains management snap-ins, basic components of the MOM Administrator Console. You can save these consoles as files with the .msc extension. When you save a console, its configuration settings are also saved. You can mail a console file to another user, who can open it on a different computer or on a different network, and the saved settings are restored for all the console items. Creating custom consoles allows you to reduce training costs by sending administrators an interface tailored to their needs.

The console window contains the workspace of the MOM Administrator Console. The left pane of a MOM Administrator Console window contains the console tree. The console tree contains all the management components available in snap-ins. When you install Microsoft Operations Manager 2000 snap-ins, the snap-ins are items in the console tree.

The Microsoft Operations Manager 2000 snap-in provides a framework for the Monitor, Rules, and Configuration snap-ins. Each Microsoft Operations Manager 2000 snap-in monitors one configuration group. You can add multiple Microsoft Operations Manager 2000 snap-ins if you want to monitor more than one configuration group, or if you want to install multiple Monitor, Rules, or Configuration snap-ins in a single MOM Administrator Console.

The right pane in MOM Administrator Console applications is the details or results pane. When you select an item in the left-pane console tree, the right pane changes to reflect details for that item.

Note

  • To display the Action menu for an item, you can right-click that item instead of clicking Action on the menu bar. If the right mouse button does not cause MOM to display the Action menu, the right and left buttons may be reversed. If the computer is configured to reverse the default right and left mouse button actions, you may need to click the left mouse button to display the Action menu for an item.


Requirements and Permissions

Microsoft Operations Manager 2000 (MOM) uses Windows 2000 groups and accounts to restrict access to product functionality. For information about these groups, see the MIcrosoft Operations Manager 2000 Installation Guide.

Monitor

To use the Monitor snap-in, your user account must be a member of the OnePointOp Users user group. Some tasks also require other group membership.

Task | Group Membership
Creating a processing rule from an existing alert or event | OnePointOp Operators
Viewing the processing rule that generated a specific alert | OnePointOp Operators
Disabling an alert | OnePointOp Operators
Creating a custom task available to all users | OnePointOp Operators
Excluding a computer from the Managed Computers list of an Agent Manager | OnePointOp ConfgAdms
Modifying a private or public view | OnePointOp ConfgAdms (or the user account that created the view)
Ignoring agent status, and stopping ignoring agent status | OnePointOp ConfgAdms

Rules

To use the Rules snap-in, your user account must be a member of the OnePointOp Operators user group.

Configuration

To use the Configuration snap-in, your user account must be a member of the OnePointOp ConfgAdms user group.


Monitor Snap-In

The Monitor snap-in allows you to view information about one configuration group at a time. If you want to monitor information from several configuration groups, you can add other Microsoft Operations Manager 2000 snap-ins to the MOM Administrator Console.

The Monitor snap-in allows you to monitor alerts, events, computers, product components, and other configuration group information stored in the database.

You can use the default views or you can create your own views. You can create views that display information about the following items:

  • Alerts
  • Events
  • Performance data
  • Computers
  • Computer performance
  • Computer groups
  • Computer attributes

When you select the Monitor item in the left-pane console tree, the details pane displays descriptions of the types of views you can create. The details pane also includes descriptions of the MOM Components and Advanced nodes. Clicking an icon or link in the details pane displays a default view of that type of view.

From any location within the Monitor snap-in, you can search for specific events and alerts and access MOM Reporting.

Related Topics


Monitor Snap-In Requirements

Microsoft Operations Manager 2000 (MOM) uses Windows 2000 groups and accounts to restrict access to product functionality.

Some tasks within the Monitor require your user account to be a member of the Operators (OnePointOp Operators) group or the Configuration Administrators (OnePointOp ConfgAdms) group. For specific information about the group membership required for particular tasks, see the How To section of the Help for a specific task. For more information about MOM groups, see the Installation Guide.

Related Topics


Custom Views

The Monitor provides access to information in the database using the following types of views that you can create and customize for your enterprise monitoring needs:

Alert views
Provide information about alerts that have occurred in the configuration group. Service level exceptions views display alerts that do not meet service level agreements. Alert information includes the alert severity, resolution state, and owner.
Event views
Provide information about events that have occurred in the configuration group. This information includes the event type, the time the event occurred, and the computer on which the event occurred.
Computer performance views
Provide the number of performance counters on specified computers in the configuration group. You can graph data in computer performance views.
Performance data views
Provide information about performance measurement in the configuration group. You can graph data in performance data views.
Computer views
Provide information about computers in the configuration group. This information includes the highest severity alert on the computer, the last time the agent contacted a Consolidator, and the number of alerts with a resolution state of New.
Computer group views
Provide information about computer groups in the configuration group. This information includes the most severe unresolved alert on a computer in the computer group.
Computer attribute views
Provide information about computer attributes collected on computers in the configuration group. This information includes the date and time when the attribute was collected, and the value of the attribute.

Related Topics


Default Views

Along with the custom views that you can create, Microsoft Operations Manager 2000 (MOM) provides the following default views of the information in the database.

All Computers
Computer view that shows summary data from every computer in the configuration group, as well as computers from which MOM collected information. Each row in the details pane represents one computer. An icon identifies the highest current unresolved alert on each computer. You can view the properties of a computer you select in the details pane. Double-clicking a computer in the details pane shows all outstanding alerts for the computer.
All Agents
Computer view that shows summary data from every monitored computer, every computer with an agent, in the configuration group. Each row in the details pane represents one monitored computer. An icon identifies the highest current unresolved alert on each computer. You can view the properties of a monitored computer you select in the details pane. Double-clicking a monitored computer in the details pane shows all outstanding alerts for the computer.
All Computer Groups
Computer group view that shows a list of computer groups in the configuration group. Each row in the details pane represents one computer group, with an icon identifying the highest current unresolved alert in the computer group. You can view details of the computers within the computer group. Double-clicking a computer group in the details pane displays a computer view of all computers in the group.
All Open Alerts
Alert view that shows a list of alerts that do not have a resolution state of Resolved from all computers in the configuration group. Each row in the details pane represents one alert, with an icon indicating the alert severity. This window can include more than one alert from any computer. You can view the properties of an alert you select in the details pane, view the alert knowledge base, or change the alert resolution state.
All Service Level Exceptions
Alert view that shows all Service Unavailable alerts and all alerts that have been in their current resolution state past the service level agreement time. This view does not include Information or Success alerts. Each row in the details pane represents an alert, with an icon representing the alert severity. You can view the properties of an alert you select in the detail pane. You can change the alert resolution state in this view.
All Performance
Performance view that lists the number of performance measurements taken for each computer in the configuration group. Double-clicking a computer in the details pane displays a view listing values of all performance counters collected from the computer, where you can graph computer performance.
All Events
Event view that shows a list of all events. Each row in the details pane represents one event. You can view the properties of an event you select in the detail pane.

Related Topics


My Views and Public Views

Custom and default views are saved in the MOM Administrator Console (.msc) file. Custom and default views are accessible to anyone using that particular MOM Administrator Console file. These views are not accessible from the Web Console.

You can create views that you can access from any MOM Administrator Console or Web Console in the configuration group. These views can be private or public.

Private views are accessible only by the user who created them, and are saved in the My Views folder. The user who created these views can access them from any MOM Administrator Console or Web Console. The Web Console provides some private views by default.

Public views are accessible by anyone, and are saved in the Public Views folder. Anyone accessing the configuration group database from a MOM Administrator Console or Web Console can access these views. Management Pack modules provide public views related to the specific application or environment monitored. The Web Console provides some public views by default.

You can create views within the My Views and Public Views folders, or you can create views and copy them into these folders. Moving a view into the My Views folder makes it a private view accessible through any MOM Administrator Console or Web Console in the configuration group. Moving a view into the Public Views folder publishes the view for other users to access through any MOM Administrator Console or Web Console in the configuration group.

Related Topics


Components Window

The Components window provides an overview of the product architecture, along with links to the Web Console, published reports, and component windows. The Agents, Consolidators, and Agent Managers windows allow you to monitor specific product components

Note

  • You can define the web addresses of the Web Console and published reports in the Configuration snap-in Global Settings window.

In the Agents, Consolidators, and Agent Managers windows, you can instruct Microsoft Operations Manager 2000 (MOM) to ignore a specific computer's status. If you know that the monitored computer is offline for service reasons, or if you expect one of the computers in your enterprise to be frequently offline, you can specify that the agent status on that computer is ignored.

MOM determines status using the agent heartbeat. When the product does not receive an expected heartbeat from an agent, the agent status is stopped. The status of an agent is recorded in the Agent Status column in the details pane.

The following windows provide information about MOM components:

Agents window
Lists all computers in the configuration group on which an agent is installed. You can also quickly mark agents that you wish to exclude from the Managed Computers list, and those agents will be marked for removal the next time rules are evaluated.
Consolidators window
Lists all computers in the configuration group on which a Consolidator is installed.
Agent Managers window
Lists all computers in the configuration group on which an Agent Manager is installed.

Related Topics


Advanced Window

The Advanced folder contains the Temporary Views folder. Microsoft Operations Manager 2000 (MOM) uses the Temporary Views folder as a temporary container during the creation of new views. For example, when you double-click a computer group in the All Computer Groups view, the computer view that MOM creates is stored temporarily in the Temporary Views folder. The temporary computer view is removed from the Temporary Views windows when you close the computer view.


Custom Tasks

In the Monitor window, you can create custom tasks to use within Monitor views. You can define custom tasks that are available only to you or that are available to all users.

You can create custom tasks for event, alert, attribute value, and computer items. For example, you can create a custom task that sends alert information to a third-party problem ticket application. The custom task becomes available on the Action menu when you select an alert in an Alert view.

Related Topics


Rules Snap-In

The Rules snap-in displays computer groups, processing rule groups, notification groups, and advanced rule functionality used in one configuration group. You can create or modify computer groups and processing rules using the Rules snap-in. You can create or modify computer attributes, which you can use when creating computer groups. You can also create or modify notification groups, scripts, and data providers, which you can use when creating processing rules.

If you want to create new computer groups and processing rules for several configuration groups, you can add other Microsoft Operations Manager 2000 snap-ins to the MOM Administrator Console.

When you select the Rules item in the left-pane console tree, the details pane displays descriptions of the different windows in the Rules snap-in. Clicking an icon or link in the details pane displays the related window.

Related Topics


Rules Snap-In Requirements

Microsoft Operations Manager 2000 uses Windows groups and accounts to restrict access to product functionality. To use the Rules snap-in, your user account must be a member of the OnePointOp Operators group. For more information about groups, see the Installation Guide.

Related Topics


Computer Groups Window

Computer groups are collections of computers with some attribute in common. Computer groups are defined by computer grouping rules.

The Computer Groups window lists all computer groups defined for the configuration group, and allows you to create new computer groups. You can create computer groups based on their domain, computer name, or attributes such as the operating system version. The Computer Groups window allows you to identify the domain or computer name using wildcard characters, regular expressions, or Boolean regular expressions.

Related Topics


Processing Rule Groups Window

Processing rule groups consist of related processing rules grouped together for categorization. When you create and name a processing rule group, Microsoft Operations Manager 2000 (MOM) automatically creates sub-groups in the console tree:

  • Event Processing Rules
  • Alert Processing Rules
  • Performance Processing Rules

The Processing Rule Groups window provides links to detailed HTML reports on all processing rule groups. You can expand processing rule groups in the right pane to display information about child groups and processing rules. You can print reports about a processing rule group or rules.

Note

  • We do not recommend printing a report for an expanded processing rule group with expanded child groups and expanded processing rules. The report could be prohibitively large. If you want to print a report for all rules in a processing rule group, select the lowest level child processing rule group in the left pane and expand and print the report in the right pane.

If you disable the report display, the Processing Rule Groups window lists all processing rule groups used in this configuration group in the details pane. You can create new processing rule groups in this window, as well as import Management Pack modules.

You can perform a search for a specific processing rule or for rules that match specified search criteria. You can search within all processing rule groups or within a specified rule group, and the rules matching the search criteria are displayed in the details pane.

You can associate a computer group with the processing rule group.

Event Processing Rules Window

Event processing rules collect specified events and take appropriate actions. Event processing rules in MOM to perform the following actions:

  • Collect specific events (Collection rules)
  • Alert on or respond to event (Event rules)
  • Filter event (Filtering rules)
  • Detect missing event (Missing event rules)
  • Consolidate similar events (Consolidation rules)

The Event Processing Rules window lists all event processing rules in this processing rule group. You can create new event processing rules, modify properties of event processing rules, and modify the company knowledge base associated with a rule.

Alert Processing Rules Window

An alert processing rule defines a response for a specified alert or alerts. For example, you could specify that one notification group is paged for all Critical Error alerts occurring in a specific processing rule group.

The Alert Processing Rules window lists all alert processing rules in this processing rule group. You can create new alert processing rules, modify properties of alert rules, and modify the company knowledge base associated with a rule.

Performance Processing Rules Window

Performance processing rules can monitor computers for system resource usage and performance thresholds using Windows Management Instrumentation (WMI) numeric data. You can create processing rules for performance thresholds that create an alert when the threshold is crossed. Performance processing rules instruct MOM to perform the following actions:

  • Sample performance data (Measuring rules)
  • Compare performance data (Threshold rules)

The Performance Processing Rules window lists all performance processing rules in this processing rule group. You can create new performance processing rules, modify properties of performance rules, and modify the company knowledge base associated with a rule.

Related Topics


Notification Groups Window

Part of a processing rule is a defined response, which specifies the action Microsoft Operations Manager 2000 will perform if a specified event, alert, or threshold occurs. E-mail and paging responses require a notification group.

The Notification Groups window lists all notification groups for the configuration group. You can create new notification groups in this window. In each notification group window, you can modify notification group properties.

Related Topics


Advanced Window

When you select the Advanced item in the left-pane console tree, the details pane displays descriptions of the advanced processing rule components. Clicking an icon in the details pane displays the related view.

Scripts Window

The Scripts window lists all scripts that are available to be used within processing rules. You can create new scripts and modify the properties of existing scripts in this window.

Computer Attributes Window

You can group computers using characteristics that the computers have in common, called attributes. The Computer Attributes window lists available computer attributes and allows you to create new ones.

Providers Window

When you create a processing rule, you must define the source, or provider, of the information you want to monitor. The Provider window lists all providers available for this configuration group. You can create new providers and modify existing ones in this window.

Related Topics


Configuration Snap-In

The Configuration snap-in allows you to manage the agents, Consolidator, and Agent Manager components within a single configuration group. You can view and modify configuration group settings for all components, as well as configure individual components. The Configuration snap-in also allows you to view and approve agents before they are automatically installed on or uninstalled from computers within the configuration group. If you want to manage components for several configuration groups, you can add other Microsoft Operations Manager 2000 snap-ins to the MOM Administrator Console.

When you select the Configuration item in the left-pane console tree, the details pane displays descriptions of the different windows in the Rules snap-in. Clicking an icon or link in the details pane displays the related window.

Related Topics


Global Settings Window

The Global Settings window allows you to configure component settings that apply throughout the configuration group. These global settings are defined as follows:

General settings
You can configure settings for the entire configuration group in the following areas:
Custom alert fields
You can create fields that Microsoft Operations Manager 2000 (MOM) displays in alerts. Any alerts generated in the configuration group will contain these fields.
Alert resolution states
You can delete and modify most alert resolution states, as well as add your own. You can specify service level agreement times, the maximum time an alert is expected to stay in a resolution state.
E-mail server
You can specify the e-mail settings used by the Consolidator to send e-mail responses.
Web addresses
You can specify the location of the Web Console and any reports saved to the web.
License
You can read acknowledgment and copyright information, and apply a new license file or product key.
Communications
You can specify the TCP/IP port that agents will use when communicating with the Consolidators.
Database Grooming
You can specify parameters for automatically deleting data from the database. For more information about database grooming, see the Installation Guide.
Notification Command Format
You can specify a third-party paging software application to use when configuring paging responses.
Auditing
You can enable or disable DAS auditing for Configuration Changes reports.
Agent Managers
You can specify how often Agent Managers scan the Managed Computers list, and perform a manual managed computers scan. You can identify the agent service account, and specify how agents are deployed. You can specify whether MOM immediately installs or uninstalls agents as required, or adds them to the Pending Installations list. You can also specify the amount of time MOM waits before removing unneeded agents.
Consolidators
You can specify how often Consolidators poll for rule changes, the number of responses that can run simultaneously, and how the Consolidator buffers data.
Agents
You can specify agent buffering properties, and heartbeat parameters. You can also specify the number of responses that can run simultaneously, communication retry parameters, packet settings, and logging parameters.

Related Topics


Pending Installations Window

Microsoft Operations Manager 2000 (MOM) tracks when an agent needs to be installed or removed, such as in the following instances:

  • If you create a computer group
  • If you change a computer grouping rule
  • If you change a Managed Computers rule
  • If a computer configuration changes so that it no longer matches a computer grouping rule or Managed Computers rule
  • If a computer configuration changes so that it matches a computer grouping rule or Managed Computers rule

You can specify in the Global Settings window whether you want agents installed immediately when required, or if you want them added to the Pending Installations window. The Pending Installations window lists the computers on which an agent installation or uninstallation process is pending. You can approve or cancel all pending actions, or approve or cancel them one at a time.

When you approve actions in the Pending Installations window, you can also choose to process them, and MOM installs or uninstalls the agent immediately. Otherwise, agents are installed at the next managed computer scan.

MOM applies an uninstall delay period to computers that no longer match a Managed Computer rule. After the uninstall delay period expires, MOM adds these computers to the Pending Installation list. When you approve the uninstallation, the agent is uninstalled from these computers at the next managed computer scan.

Related Topics


Agent Managers Window

Agent Managers are responsible for installing and uninstalling agents on computers that match their Managed Computer rules.

The Agent Managers window lists all computers in the configuration group on which an Agent Manager is installed. You can view details of each Agent Manager, including its Managed Computer rules and its Managed Computers list, the list of all computers matching the rules. You can specify when an individual Agent Manager scans computers in its Managed Computers list. You can also specify the service account used by the agents that an Agent Manager installs.

Agent Managers perform managed computer scans to discover computers that match the Managed Computer rules, and scan computers in the Managed Computers list to collect computer attributes, evaluate computer group membership, and install or uninstall agents as appropriate.

You can perform a scan on demand using the Agent Manager window. You can also exclude individual computers from an Agent Manager's Managed Computers list, and immediately uninstall an agent on demand.

Related Topics


Text String Pattern Matching

In many Microsoft Operations Manager 2000 fields, you can enter or select wildcards, regular expressions, or Boolean regular expressions. Wildcards and regular expressions allow you to specify or match many items using one expression or character-string formula.

You can select brief descriptions of wildcards, regular expressions, or Boolean regular expressions from drop-down menus. The menu items and their associated characters or operators are defined in tables in the following sections:

  • Wildcards
  • Regular Expressions
  • Boolean Regular Expressions

Note The MOM Agent Manager does not discover computers based on their IP address or their fully qualified domain name.


Wildcards

You can use wildcards in some areas where you cannot use regular expressions, such as the Monitor snap-in. Wildcard pattern matching is not case-sensitive. Some fields support the following wildcard characters.

Menu Item | Character | Definition
Any Character | Question mark (?) | Matches exactly one character.
Any Digit | Number sign (#) | Matches one digit.
Any Character, 0 or More Matches | Asterisk (*) | Matches zero or more characters.

The following table provides examples of wildcard character specifications and example matches.

Example | Matches | Does Not Match
den??? | Denton and Dennis | Denison
el ????o | El Campo and El Indio | El Paso
houston\? | Houston? | Houstons
houston, tx ##### | Houston, TX 77024 | Houston, TX USOFA
5555 indigo ln \### | 5555 Indigo Ln #32 | 5555 Indigo Ln 320
*TX | Houston, TX and TX | Houston, TX 77024
San * | San Antonio and San Angelo | Santa Fe
b*ville | Brownsville and Beeville | Somerville


Regular Expressions

You can perform advanced text pattern matching using regular expressions. Regular expressions provide more flexibility than simple wildcards in defining rules or views. To match an exact regular expression character, precede the character with a backslash (\). The following table lists regular expression operators and their definitions.

Menu Item | Character | Definition
Any Character | . | Matches any single character.
Character in Range | [ ] | Matches any single character from within the bracketed list. Within square brackets, most characters are interpreted literally.
Character Not in Range | [^] | Specifies a set of characters not to be matched.
Beginning of Line | ^ | Matches the beginning of a line.
End of Line | $ | Matches the end of a line.
Or | | | Matches either the regular expression preceding it or the regular expression following it.
Group | ( ) | Groups one or more regular expressions to establish a logical regular expression consisting of sub-regular expressions. Used to override the standard precedence of certain operators.
0 or 1 Matches | ? | Specifies that the preceding regular expression is matched 0 or 1 times.
0 or More Matches | * | Specifies that the preceding regular expression is matched 0 or more times.
1 or More Matches | + | Specifies that the preceding regular expression is matched 1 or more times.
Exactly n Matches | {n} | Specifies that the preceding regular expression is matched exactly n number of times.
At Least n Matches | {n,} | Specifies that the preceding regular expression is matched n or more times.
At Most n Matches | {,n} | Specifies that the preceding regular expression is matched n or fewer times.
n to m Matches | {n,m} | Specifies that the preceding regular expression is matched a maximum of n times and a minimum of m times. If not specified, m defaults to 0. If n is not specified, the default depends on whether the comma is present. If no comma is present, n defaults to m. If a comma is present, n defaults to a very large number.
New Line Character | \n | Matches a new line.
Tab Character | \t | Matches a tab character.

The following table provides examples of regular expressions and example matches.

Example | Matches | Does Not Match
st.n | Austin and Houston | Webster
st[io]n | Austin and Houston | Stanton
st[^io]n | Stanton | Austin or Houston
^houston | Houston | South Houston or Fort Sam Houston
ston$ | Houston and Galveston | Stonewall
dall|hart | Dallas and Dalhart and Lockhart | Dale
dal(l|h)art | Dalhart | Dallas or Lockhart
il?e$ | Etoile and Wylie | Beeville
il*e$ | Etoile and Wylie and Beeville | Bellaire
il+e$ | Etoile and Beeville | Wylie
ad{2} | Addison and Caddo | Adkins
(la.*){2,} | Highland Villiage and Lake Dallas | Laredo
il{,1}e$ | Bowie and Etoile | Brownsville
(a.*){2,3} | Alamo Heights and La Blanca | Austin or Aransas Pass
not ville | Houston and Dallas | Brownsville


Boolean Regular Expressions

Boolean regular expressions allow you to combine regular expressions using the Boolean and, or, and not operators.

Menu Item | Operator | Definition
Boolean And | and | Specifies that the preceding and following regular expressions must both match.
Boolean Or | or | Specifies that at least one of the preceding and following regular expressions must match.
Boolean Not | not | Specifies that the regular expression following the not must not match.

Regular and Boolean regular expression operators are available from drop-down menus, or you can enter them directly in the appropriate field. The following table shows examples of Boolean regular expressions.

Example | Matches | Does Not Match
la and ia | La Vernia and Lelia Lake | Lake Jackson
ville$ or town$ | Brownsville and Baytown | Lubbock
ille$ and not ^[n-z] | Brownsville and Kerrville | Pflugerville


MOM Reporting Overview

Auditing user actions and resource usage tendencies are among the most important aspects of operations management. To allow you to review and report on these actions and tendencies, Microsoft Operations Manager 2000 (MOM) provides the MOM Reporting component. This component allows you to view, print, and save more than 100 reports. Microsoft Access allows you to customize these reports to meet your specific needs.

MOM Reporting uses Microsoft Access to produce reports from information in the MOM database. The MOM installation program allows you to install the run-time version of Microsoft Access. The run-time version of Access allows you to view, print, and save the reports.

The full version of Microsoft Access allows you to customize the reports to meet your specific needs. You can also use the full version of Access to create additional reports. Microsoft Access requires 32 megabytes (MB) of RAM in addition to other RAM requirements for your computer.

For best performance when running reports with large event databases, you should have at least 128 MB total RAM. You should also use a screen resolution of 800 × 600 or larger.

For descriptions of all reports that are available in Microsoft Operations Manager, refer to Report Descriptions in the Table of Contents of this Help file.

For help on common reporting tasks, refer to How To/Reporting Tasks in the Table of Contents of this Help file.


Recommended Practices for MOM Reporting

You will find these practices helpful in using MOM Reporting to best advantage.

Install MOM Reporting on a separate computer
Install MOM Reporting on a computer other than the database computer. This prevents MOM Reporting-related memory and CPU usage from having a negative impact on Microsoft Operations Manager 2000 (MOM) database performance. When you do this, report generation times may increase due to network latency, but the impact on the MOM database and central computer performance is reduced.

Select specific report criteria
Reduce the size of the result set queried for reporting by:

  • avoiding the All option
  • selecting a short date range
  • selecting specific servers, services and computer groups

Avoid scheduling regular reports that require you to keep intensive auditing enabled
Generate reports that require you to enable intensive auditing only when needed, to track specific problems or monitor usage. Avoid scheduling these reports regularly:

  • MOM Configuration Change reports need DAS auditing enabled
  • IIS Operations reports need IIS logging enabled

Avoid scheduling regular reports that collect stored event parameters
Generate reports that collect stored event parameters as needed, to track specific problems or monitor usage. Avoid scheduling these reports regularly. Disable the event parameter collection when these reports are not needed:

  • RAS report
  • IIS Events Selected by IP Address report

Schedule report generation
MOM Reporting allows you to schedule report generation for reports that are used on a regular basis. Follow these guidelines for scheduling report generation:

  • Select specific reports that are useful for your operations and monitoring setup. Avoid selecting all reports in a category.
  • Run scheduled reports at non-peak hours.
  • Avoid generating multiple reports simultaneously. Create one batch file for all scheduled reports and schedule that batch file instead, of creating multiple batch files and scheduling them separately. This prevents you from inadvertently scheduling different batch files simultaneously.
  • Disable scheduling when reports are not needed.
  • The same data is sometimes available in multiple reports with different presentations. Instead of generating both reports, select the presentation that best suits your needs. For instance:
    • Top 100 Mailboxes report is available by Message Count and by Size
    • Many capacity planning reports are available By Day and By Peak Hours
    • Event log summary is available as a text summary or as a trend graph

    Use performance graphs
    For tracking specific performance counters for a short period of duration, use the performance graphs available on the MOM Administrator Console or Web Console.

    Use views for monitoring events
    To monitor events matching specific criteria, use custom event views in the MOM Administrator Console or the Web Console.

    Disable reporting rules not being used
    Disable reporting rules that are not being used to reduce data collection.


Report Publishing

MOM Reporting allows you to publish reports in several ways. These reports can be made available through the MOM Administrator Consoles and the Web Console, or from another location using Internet Explorer. You can also configure Microsoft Operations Manager 2000 (MOM) to automatically generate and publish reports to HTML files or to a printer.

MOM provides flexible components that allow you to setup your configuration groups in many ways. To support report generation and publication, the default configuration values are set for configurations where MOM Reporting, the Web Console server, and DAS are installed on the same computer. Microsoft IIS must also be installed on that computer.

As a best practice, install MOM Reporting on a separate node from Microsoft Operations Manager 2000 to prevent memory and CPU usage by Access from impacting performance.

The MOM installation program creates directories and sets several configuration values to support HTML report generation and publication:

  • When you install MOM Reporting, the installation program creates a physical directory where the generated reports for that MOM Reporting component are stored. The default location is Program Files\Microsoft Operations Manager 2000\Event\Reports.
  • When you install MOM Reporting and the Web Console server on an IIS computer, the installation program creates the MOM Reporting virtual directory that points to the Reports physical directory on that local computer.

    • In addition, if the database is not installed on that computer, the installation program prompts you for the database computer name. Then, if you have not installed another Web Console server with MOM Reporting for that database, the installation program stores the location of the MOM Reporting virtual directory in the database.

  • The Web Console server and the MOM Administrator Consoles allow you to view Web reports. These interfaces access the reports published in the folder that is specified in the database to which they are connected. You can change the specified folder through the Configuration snap-in.
  • MOM Reporting is configured to publish HTML reports to the Reports physical directory on the local computer. You can change this location through the HTML Properties window in MOM Reporting. For example, you can save the reports to a shared location. Then, users with Read permission to that location can use Internet Explorer to view those HTML reports.
  • With the Web Console server and DAS on the same computer, the Web Console server can use Integrated Windows Authentication. If the Web Console server is not on the same computer as DAS, the Web Console server must use Basic authentication.

Related Topics


Understanding Dates and Times

Microsoft Operations Manager 2000 (MOM) stores dates and times in Greenwich Mean Time. MOM Reporting converts the specified dates and times to ensure the time for an event listed in a report is represented in the local time for that user. If you specify dates and times as criteria for a report, specify the values in your local time. If you create your own reports, you need to convert the dates and times you retrieve from the MOM database.

MOM Reporting uses the Short date style and Time style specified in the Regional and Language Options application in Control Panel. To specify a date and time, separate the two values with a comma. MOM Reporting supports the following date formats:

  • mm/dd/yy
  • mm-dd-yy
  • mm/dd/yyyy
  • mm-dd-yyyy
  • dd/mm/yy
  • dd-mm-yy
  • dd/mm/yyyy
  • dd-mm-yyyy

    •

Related Topics


Understanding Graphs

MOM Reporting provides a number of reports that produce graphs. You can specify which type of graph to produce.

Bar Graphs
Bar graphs show comparisons of data categories over time. To help you compare data over time, categories are organized horizontally and values are organized vertically. Bar graphs work best with a limited number of data points on the X axis.
Bar (3D) Graphs
Bar (3D) graphs can lend a dramatic effect to standard bar graphs. These graphs work best with a limited number of data points on the X axis.
Line Graphs
Line graphs show trends in data over time.

You can also specify some properties for the graph:

Use smooth lines
Specifies whether the graphed lines are smoothed to reduce extreme values.
Y-axis range
Specifies the minimum and maximum values for the Y-axis of the graph.

This range can be adjusted to view values for points in a graph that are otherwise not visible on a report because of different scales for counters plotted.


Lifecycle of an Alert

An alert indicates the severity, or importance, of an event or performance threshold. Typically, alerts indicate potential problems. Alerts can also indicate informational events, or events classified as "None." Alerts help you prioritize conditions.

Management Pack modules provide predefined alerts for events and thresholds specific to the monitored environment or application. You can also create your own alerts to meet the needs of your enterprise.

You create alerts within processing rules using the Rules snap-in. Processing rules tell Microsoft Operations Manager 2000 when to generate alerts and how to respond if the alert occurs.

You monitor alert occurrence using the Monitor snap-in or the Web Console. You can create alert views that display exactly what you want to monitor, including alerts from specific computers, alerts of only a particular severity, or alerts with a specific resolution state.

An event or performance threshold can generate more than one alert. For example, one processing rule can specify that a hard disk failure event generates a Critical Error alert. The Critical Error alert initiates a notification response and pages a network administrator with pertinent information about the hard disk failure. Another processing rule can define that the same hard disk failure event also generates an Error alert that sends an SNMP trap to an administrator.

The lifecycle of an alert comprises several stages, described in the following sections:

  • Defining alerts
  • Monitoring alerts
  • Resolving alerts
  • Creating alert knowledge


Defining Alerts

Microsoft Operations Manager 2000 (MOM) provides predefined alerts for monitored environments or applications within Management Pack modules. You can also create alerts that are specific to your enterprise.

You define alerts when you create processing rules. Processing rules identify the information to be collected, the alert to be generated, and any response to the identified condition. The following types of processing rules allow you to define alerts:

Event rules
Can generate an alert when specific events occur.
Missing event rules
Can generate an alert when a specific event does not occur during a specified time.
Threshold rules
Can generate an alert when a WMI numeric value crosses a defined threshold.

Note

  • An alert processing rule allows you to define one response for alerts that are generated by other processing rules.

Alert Severity

Within a processing rule, you can define the severity of the alert, including Security Breach, Critical Alert, and Success. When you monitor alerts using the Monitor snap-in or the Web Console, the alert severity tells you at a glance the importance of the indicated condition.

Duplicate Alert Suppression

Event storms occur when an application or system rapidly produces a large number of identical events. If you have an alert associated to that particular event, receiving a large number of alerts for the same event could be annoying. MOM provides duplicate alert suppression, which combines duplicate alerts received while the original alert is unresolved into a single alert. You will see only one alert. The one alert indicates the number of alerts that were combined, the time of the first alert, and the time of the last alert.

Alert Response

Processing rules also define responses to an alert. Responses help resolve the issue indicated by the event or alert. Responses can include the following actions:

  • Send a notification to a notification group
  • Execute a command or batch file
  • Send an SNMP trap
  • Change state variables
  • Launch a script

Processing rules can define more than one response. For example, if a Security Breach alert indicates that a security violation has occurred, MOM can respond by running a batch file that locks out an offending user account and by paging a network administrator.

Resolution State

Resolution state indicates the alert's current point in the resolution process. The default resolution state for most alerts is New. You can select any resolution state for an alert within the processing rule. When that alert occurs, its first resolution state is the state defined in the processing rule.

You can rename these resolution states, or create your own to meet the needs of your enterprise. Examples of custom resolution states might include In Progress or Deferred. Using the Configuration snap-in, you can create custom resolution states and the maximum length of time you expect alerts to remain in any particular state.

The maximum length of time you expect an alert to remain in a particular resolution state is called the service level agreement time. For example, a company policy might require all alerts with a resolution state of New to be addressed within ten minutes. If any alert remains with a resolution state of New for longer than ten minutes, it is considered a service level exception. The All Service Level Exceptions view in the Monitor snap-in and the Web Console shows the alerts that have spent more time than expected at a particular service level.

Other Alert Properties

You can assign an Owner to an alert. The owner is typically the person responsible for tracking and resolving the indicated problem. You can assign an Owner when you create a processing rule that generates an alert, or you can assign an Owner when the alert occurs. Alerts can also contain the source of the alert and an alert description.

Related Topics


Monitoring Alerts

Before you can monitor alerts, several conditions have to be met, whether you have created your own processing rules or are using predefined Management Pack modules:

  • An alert has been defined within a processing rule.
  • The processing rule group that contains the processing rule has been associated with a computer group to ensure that the rule is evaluated on the correct computers.
  • The event or performance data specified in the processing rule has occurred.
  • Microsoft Operations Manager 2000 has generated an alert.

Monitoring alerts lets you respond immediately to problems. Alerts provide detailed information about computer conditions. You can read an alert, its associated knowledge base, and its resolution history to see what responses have been performed, and to determine what further actions you need to take to resolve the indicated condition.

You can monitor alerts using the Monitor snap-in or the Web Console. You can use default alert views or create your own alert views. The Monitor snap-in provides default views of alerts, including All Open Alerts and All Service Level Exceptions. Custom views you can create include Open alerts from a specified source and Alerts that are not Resolved, as well as others matching criteria you specify.

Related Topics


Resolving Alerts

Using the Monitor snap-in or the Web Console, you can track alerts throughout the process of resolving the indicated condition. The alert resolution state indicates the alert's current point in the resolution process. The default resolution state for alerts is New. You can change the resolution state to match the current state of the process.

You can assign an Owner to an alert. The Owner is typically the person responsible for resolving the alert.

Microsoft Operations Manager 2000 automatically tracks alert resolution history. The history indicates whether any responses were carried out for this alert, and records all changes made to alert fields. You cannot edit the alert resolution history, but you can add your own resolution comments that are appended to the history.

When the condition that caused the alert has been resolved, you can change the alert resolution state to Resolved.

Related Topics


Creating Alert Knowledge

You can add information to the company knowledge base when you resolve an alert. This information can include details on the resolution of this particular alert, which can help others resolve similar alerts in the future. The information you add to the company knowledge base is appended to the knowledge base of the processing rule that generated the alert, and becomes available in later alerts. You can, over time, collect a valuable knowledge base of alert resolution information specific to your company and enterprise.

Related Topics


Changing Service Account Passwords

Changing the DCAM Service Accounts

Frequently changing the DCAM service accounts is not recommended because this can severely affect your enterprise. However, you might have situations that require occasional change, such as when you are setting up security partitions in your configuration group. To lessen the effect on your enterprise:

  • Implement the change in your test lab prior to implementing enterprise-wide.
  • Coordinate the changes across your IT organization to ensure your change is properly incorporated.
  • Develop a contingency plan that includes a current backup of your MOM data.

Note

  • By editing the settings below, you are not directly changing the user name or password associated with any Windows account. You are changing the stored credentials the service or COM+ application uses to authenticate itself to Windows. You cannot create a new user account or change an account password by editing the properties of a service or COM+ application. Before making any edits, a corresponding change must be made in Active Directory. If you follow the procedure to change a stored password used to authenticate an account, ensure that the password for that account has been changed in Active Directory first. If you enter a new user name and password as part of the procedure, it must correspond to an account that has already been created in Active Directory. DCAM accounts

To change the DAS service account name or password

  1. On the Start menu, point to Programs, point to Administrative Tools, and then click Component Services.
  2. Expand Computers, expand My Computer, and then expand COM+ Applications.
  3. Right-click OnePointActiveOpsDas, and then click Properties.
  4. On the Identity tab, type the new account name or password. If you are changing the password, type the password again in the Confirm password box.
  5. Right click OnePointActiveOpsDas and select Shut down. Right-click OnePointActiveOpsDas again and select Start.

To change the CAM service account name or password

  1. On the Start menu, point to Programs, point to Administrative Tools, and then click Services.
  2. Right-click OnePoint Service, and then click Properties.
  3. On the Logon tab, type the new account name or password. If you are changing the password, type the password again in the Confirm password box.
  4. Stop the OnePoint service, and then restart it.

MOMDasLocator object (database)

The MOMDasLocator object is located on the MOM database server.

To change the MOMDasLocator password

  1. On the Start menu, point to Programs, point to Administrative Tools, and then click Component Services.
  2. Expand Computers, expand My Computer, and then expand COM+ Applications.
  3. Right-click MOMDasLocator and select Properties.
  4. Click the Identity tab, and then enter the new password in the Password box.


Configuring Information Monitoring

Management Pack modules, which you can install during Setup or import later, contain computer groups and processing rules to support specific customer applications or environments. You can monitor your enterprise immediately using Management Pack modules. You might, however, want to define your own computer grouping rules and processing rules to monitor operations in your specific network enterprise.

Computer groups identify similar computers on which specific processing rules will be evaluated. Processing rules define the information to be collected from the computers, and how Microsoft Operations Manager 2000 (MOM) responds to the collected information.

This topic provides overview tasks for configuring information monitoring, which includes creating computer groups and processing rules. The sections below provide links to specific tasks in the configuration process. Although some computer attributes, providers, processing rule groups, scripts, and notification groups required for your custom computer groups or processing rules may already exist, this topic provides instructions for creating them.

Create a Computer Group

You must identify computers from which you want to collect information. These computers have attributes in common that you use to create a computer group. The Agent Manager deploys required agents on computers based on computer grouping rules. For more information, see the following topics:

Creating a Computer Attribute

Creating a Computer Group

Create a Processing Rule

Processing rules define the information you want agents to collect, and how you want MOM to process that information. Processing rules also define responses, such as launching a script or sending an e-mail or page.

The following sections provide links to instructions for creating all the parts of a processing rule: provider, notification group, and script. You must create a processing rule group before you can create a processing rule.

You can create providers, notification groups, and scripts within processing rule wizards. For simplicity, the following sections provide instructions for creating these rule components first, before you create the processing rule.

Create a Provider

Processing rules collect information from data providers. For more information, see Creating a Data Provider.

Create a Processing Rule Group

Before you can create a processing rule, you must create a processing rule group. Processing rule groups are a way to classify processing rules. For more information, see Creating a Processing Rule Group.

Associate the Processing Rule Group with a Computer Group

To ensure that the rules in a particular processing rule group are evaluated on the correct computers, you must associate the processing rule group with a computer group. For more information, see Associating a Processing Rule Group with a Computer Group.

Create a Notification Group

If the processing rule you want to create will contain an e-mail, paging, or command response, you must create the notification group to receive the response. For more information, see Creating a Notification Group.

Create a Script

If the processing rule will include a script, you must create the script. For more information, see Creating a Script.

Create the Rule

The Consolidator informs an agent when there are updated rules that apply to the agent computer. Within a few moments of its creation, a processing rule can be deployed to an agent and begin to be evaluated. You can create three types of processing rules:

Event processing rules
Collect and respond to different types of events. Event processing rules can generate alerts, among other actions. For more information, see Creating an Event Processing Rule.
Alert processing rules
Provide a single response for a number of previously defined alerts. For more information, see Creating an Alert Processing Rule.
Performance processing rules
Collect data from and respond to WMI data. For more information, see Creating a Performance Processing Rule.

Creating a Managed Computer Rule

The Agent Manager is responsible for identifying computers that require an agent to be installed or uninstalled. Managed Computer rules define the computers for which the Agent Manager is responsible. These rules create the Managed Computers list. For more information, see Modifying the Managed Computers List.

Perform a Managed Computer Scan

The Agent Manager performs scheduled managed computer scans to scan for computers that match its Managed Computer rules, collect computer attributes, evaluate computer group membership, and identify computers that require an agent to be installed or uninstalled. If you do not want to wait for the scheduled Managed Computer scan, you can perform a manual scan. For more information, see Scanning Managed Computers.

Handling Pending Installations

After a managed computer scan, MOM lists computers requiring agent installations and uninstallations in the Pending Installations window. You can approve or cancel all pending actions or each individual pending action. For more information, see Handling Pending Installations.


Contacting Microsoft

Online suppport

Please contact us with your questions and comments. We look forward to hearing from you. Many common questions can be answered by consulting the Microsoft Operations Manager 2000 Web site at www.microsoft.com/mom/. Additional online support is available at support.microsoft.com and www.microsoft.com.

Phone Support

In the United States please call (800) 936-4900.
Text Telephone is available 24 hours a day, 7 days a week, including holidays. In the United States call (425) 635-4948.

Conditions: Microsoft Product Support Services are subject to current prices, terms, and conditions, which are subject to change without notice.
Worldwide: Support options, hours and cost in your country/region may differ from the United States. Please check with your local office for details.

Professional Support Options

Advanced support for experts and businesses. Visit our customized support sites for pay-per-incident assistance online in the U.S., or by phone in the U.S. by experts trained to assist business professionals. To advance-purchase support incidents, please call Professional Support Sales at (800) 936-3500.

Get additional information on our support offerings in the U.S.

  • Professional Support for Developers
  • Professional Support for IT Professionals
  • Professional Support for Value Add Partners, Resellers, Consultants
  • Professional Support for Microsoft Certified Partners
  • Professional Support for OEMs

Submit your incident over the phone in the U.S.

  • Developers (800) 936-5800
  • IT Professionals (800) 936-4900
  • Partners (resellers/consultants) (888) 456-5570
  • Microsoft Certified Partners (888) 677-9444
  • Original Equipment Manufacturers (800) 936-2197
  • System Builders (888) 456-5570

International Support

Note

  • Phone numbers for Microsoft Subsidiaries are subject to change. For the most recent listing, please visit support.microsoft.com/directory and select "worldwide support." If there is no Microsoft subsidiary office in your country/region, please contact the establishment from which you obtained your Microsoft product.

Argentina
Microsoft de Argentina S.A.

  • Fax: (54) (11) 4316-1922
  • Customer Service: (54) (11) 4316-4600
  • Technical Support Phone (54) (11) 4316-4664

Armenia
See Russia Australia
Microsoft Pty. Ltd.
  • Phone: 13 20 58
  • Fax: (61) (29) 023-5021
  • Technical Support Phone: 13 20 58
Austria
Microsoft Ges.m.b.H.
  • Fax: (43) (16) 106-4200
  • Information Services: 08000-123 345
  • Fax: (43) (22) 366-4595
  • E-mail: InfoService@microsoft.at
Direct Services (Updates, etc.):
  • (43) -(1) 795 67028
  • Fax: (43) -(1) 795 67029
  • E-mail: austria@msdirectservices.com
Standard Support (Installation and Handling):
  • (43) -(1) 50222-2255
Azerbaijan
See Russia

Belgium
Microsoft NV
  • Phone: (32) (2) 7043000
  • Fax: (32) (2) 7043535
  • TechNet Subscription: (353) (1) 703 8738
  • MSDN Subscription: (32) (2) 5138684
  • Microsoft Information Center: (32) (2) 5133113
Technical Support:
  • (32) (2) 513 32 74 (Dutch-speaking)
  • (32) (2) 502 34 32 (English-speaking)
  • (32) (2) 513 22 68 (French-speaking)

Belarus
See Russia

Bolivia
See Uruguay

Brazil
Microsoft Informatica Ltda.
  • Phone: (55) (11) 5514 - 7100
  • Fax: (55) (11) 5514 - 7106/5514-7107
Technical Support:
  • Phone: (55) (11) 5504-2155
  • Fax: (55) (11) 5504-2227
  • Automatic Fax: (55) (11) 5506-8506
  • Bulletin Board Service: (55) (11) 5506-1234
  • Customer Services: (55) (11) 822-5764
  • Customer Services Fax: (55) (11) 822-6227

Canada
Microsoft Canada Co.
  • Head Office Phone: (905) 568-0434
  • Customer Information Centre: (800) 563-9048
Technical Support:
  • Desktop Systems including Microsoft Windows 95: (905) 568-4494
  • Microsoft Office and Office Components: (905) 568-2294
  • Other Standard Technical Support: (905) 568-3503
  • Priority Support Information: (800) 668-7975
  • Text Telephone (TTY/TDD) (905) 568-9641

Caribbean Microsoft Caribbean, Inc.
  • Phone: (809) 273-3600
  • Fax: (809) 273-3636
  • Technical Support/Soporte Tecnico: (408) 953-8086
  • Support E-mail/Correo Electronico para Soporte Tecnico: mscasup
  • Customer Service/Centro de Servicios: (800) 297-5982 for area codes 787 and 809 only
  • Customer Service E-mail/Correo Electronico para Atencion a Usarios: msccatus

Central America
  • Technical Support/Soporte Tecnico: (506) 298-2020
  • Support E-mail/Correo Electronico para Soporte Tecnico: mscasup
  • Customer Service/Centro de Servicios: (506) 298-2000
  • Customer Service E-mail/Correo Electronico para Atencion a Usarios: mscarsup

Chile
Microsoft Chile S.A.
  • Phone: (56) -(2) 330-6000
  • Fax: (56) -(2) 330-6190
  • Customer Service: (56) -(2) 800-330600
Personal Operating System and Applications:
  • Phone: (56) -(2) 330-6222
  • Fax: (56) -(2) 341-1439

China
Microsoft (China) Co. Ltd
6/F, Beijing Sigma Center
No. 49, Zhichun Road, Haidian District
Beijing, 100080, PRC
  • Phone: (011) -(86) 10-6261 7711
  • Fax: (011) -(86) 10-6253 6630

Microsoft Asia Regional Engineering Center
19th - 20th Floor, Metro Tower
No. 30 Tian Yao Qiao Road,
Shanghai, 200030, P.R.C.
  • Phone: (011) -(86) 21-64691188
    (011) -(86) 21-6469 8899
  • Fax: (011_ (86) 21-6469 1166
    (011) -(86) 21-6469 9900

Colombia
Microsoft Colombia
Carrera 7a. # 71-21 Torre B Piso 7
Santa Fé de Bogotá
  • Phone: (571) 3173838
  • Fax: (571) 3173494
Technical Support:
  • Línea de Respuesta Bogota
  • Phone: 524-0404
  • Other cities: 9800-10595
  • Fax: (091) 524-0405

Croatia
Microsoft Hrvatska d.o.o.
Trg D. Petrovica 3
10 000 Zagreb
Croatia
  • Phone: (385) (1) 4802 500
  • Fax: (385) (1) 4843 688
Product Support
  • Phone: (385) (1) 393539
  • E-mail: hot-line@microsoft.hr
Customer Service:
  • Phone: (385) (0800) 300 300
  • E-mail: info-line@microsoft.hr

Czech Republic
Microsoft s.r.o.
  • Phone (420) (2) 611 97 111
  • Fax: (420) (2) 611 97 100
  • Technical Support: (420) (2) 2150 3222

Denmark
Microsoft Denmark
  • Phone: (45) (44) 89 01 00
  • Fax: (45) (44) 68 55 10
Technical Support:
  • Phone: (45) (44) 89 01 11
  • Microsoft Sales Support: (45) (44) 89 01 90
  • Microsoft FastTips: (45) (44) 89 01 44 (Document 303030 in FastTips contains detailed instructions)
  • Microsoft MSDL (BBS): (45) (44) 66 90 46

Dominican Republic
See Central America

Dubai
Microsoft Middle East
  • Phone: (971) (4) 3973888
  • Fax: (971) (4) 3972244
Technical Support (Personal Operating Systems and Desktop Applications only):
  • Phone: (971) (4) 3975443
  • Fax: (971) (4) 3972304
  • E-mail: mswsgulf@microsoft.com
Customer Service Center (Version upgrade/TechNet and MSDN subscription):
  • Phone: (971) (4) 3975752
  • Fax: (971) (4) 3972304

Ecuador
Corporation Microsoft del Ecuador S.A.
  • Phone/PBX: (593) (2) 460453
  • Fax: (593) (2) 463093
  • Customer Service: (593) (2) 258025
  • Technical Support: (593) (2) 258025

Egypt
Technical Support (Personal Operating Systems, Desktop Applications, and Development Tools Installation ONLY):
  • Telephone: (202) 338 8724
    (202) 338 9794
  • Fax: (202) 360 4976
  • E-mail: mssupport@gbrands.com

England
See United Kingdom

Estonia
  • Technical Support: (372) 650 49 99

Finland
Microsoft OY
  • Phone: (358) (0) 9-525 501
  • Fax: (358) (0) 9-878 8770
Technical Support:
  • Phone: (358) (0) 9-525 502 5026
  • Standard: (358) (0) 9-525-502-500
  • Priority: (358) (0) 9-525-502-20

France
  • Phone: (011) (33) 825 827 829 (indigo number 0,99 F TTC per minute)
  • Customer Service Phone: (011) (33) 0 825 827 829 (*)
  • Fax: (33) 01 64-46-06-60
  • Telex: MSPARIS 604322
  • Customer Service Phone: (011) (33) 0 825 827 829 (indigo number 0,99 F TTC per minute)
  • Technical Support Phone: (011) (33) 825 827 829 (indigo number 0,99 F TTC per minute) access code 1020
  • Technical Support Fax: (011) (33) 1 69 28 00 28

French Polynesia
See France

Georgia
See Russia

Germany
Microsoft GmbH
  • Fax: (089) 3176-1000
  • Telex: (17) (89) 83 28 MS GMBH D
  • Information: (089) 3176 1199
  • Prices, updates, etc.: (01805) 25 11 99
  • Standard Support (Installation and Handling): 01805/67 22 55
General information about Microsoft Support in Central Europe:
  • Fax: 1805-25-1191

Greece
Microsoft Hellas, S.A.
  • Phone: (30) (1) 6806-775 through (30) (1) 6806-779
  • Fax: (30) (1) 6806 780
Technical Support:
  • Phone: (30) (1) 6806111
  • Fax: (30) (1) 6809528

Gulf and Eastern Mediterranean
PO Box 52244
Dubai, UAE
  • Tel: (971) (4) 3973888
  • Fax: (971) (4) 3972244
Personal Support Contact Details (Personal Operating Systems and Desktop Applications ONLY):
  • Gulf (Bahrain, Malta, Qatar, and United Arab Emirates)
    • Phone: (971) (4) 3975443
    • Fax : (971) (4) 3972304
    • E-Mail: mswsgulf@microsoft.com

Lebanon (Cyprus and Lebanon)
  • Phone: (961) (1) 983348
  • Fax: (961) (1) 983349
  • E-Mail: mts@lebanon-online.com.lb

Oman
  • Phone: (968) 691191
  • Fax: (968) 698568
  • E-Mail: mspss@gto.net.om

Pakistan
  • Phone: (92) (21) 111 674357
  • Fax: (92) (21) 4533370
  • E-mail: mssupport@nets.net.pk
Customer Service Center (Version upgrade / TechNet and MSDN subscription):
  • Phone: (971) (4) 3975752
  • Fax: (971) (4) 3972304

Hong Kong SAR, PRC
Microsoft Hong Kong SAR, PRC Limited
  • Fax: (852) 2560-2217
  • Microsoft Information Hotline: (852) 2804-4234
  • Personal Technical Support: (852) 2804-4222
  • Professional Technical Support: (852) 2804-4288

Hungary
Microsoft Hungary
  • Phone: (36) (1) 437-2800
  • Fax: (36) (1) 437-2899
  • Customer Services: (36) (1) 267-4636 (2MSINFO
  • Technical Support: (36) (1) 267-7846 (2MSSUGO)

Iceland
See Denmark

India
Microsoft India
  • Phone: (91) (80) 559-5733
    (91) (11) 629-4600,629-4601
    (91) (22) 285-0193
  • Fax: (91) (80) 559-7133, (91) (11) 629-2650

Indonesia
Microsoft Indonesia - Jakarta
Technical Support:
  • Phone: (62) (21) 570 42 54
  • Fax: (62) (21) 520 81 22

Ireland
Technical Support:
  • Phone: 706 5353
See also United Kingdom

Israel
Microsoft Israel Ltd.
Reception:
  • Phone: (972) -(9) 952-5353
  • Fax: (972) -(9) 952-5333
Customer Service and Information Center:
  • Phone: (972) -(9) -952-5400
  • Fax: (972) -(9) -952-5411
Technical Free Support for Windows, Office:
  • Phone: (972) -(9) -952-5400
  • Fax: (972) -(9) -952-5403

Italy
Microsoft Srl
  • Phone: (39) (2) 70-398-398
  • Fax: (39) (2) 7039-2020
Microsoft Rome Office:
  • (39) (6) 5095-01
  • Fax: (39) (6) 5095-0600
  • Customer Service (New product information, product literature): (39) (2) 70-398-398
  • Operatori del Settore IT (Customer Service for IT): (39) (2) 70-398-398
  • Technical Support: (39) (2) 70-398-398
  • Microsoft Consulting Service: (39) (2) 70-398-398

Japan
Microsoft Company Ltd.
  • Technical Support (Standard Support): (81) (3) 5354-4500
  • Technical Support Options/ Support Contract: (81) (3) 5354-4700
Channel Marketing Information Center (Presales Product Support):
  • Tokyo Phone: (81) (3) 5454-2300
  • Osaka Phone: (81) (6) 6245-6995
Customer Service Phone (Version upgrade/Registration):
  • Phone: (81) (48) 226-5500
  • Fax: (81) (48) 226-5511

Kazakhstan
See Russia

Kingdom of Saudi Arabia
  • Phone: (966) -(1) 488-1165
  • Fax: (966) -(1) 488-1576
Technical Support (Personal Operating System and Desktop Applications only):
  • Phone: (800) 124 0500 (toll-free within Saudi Arabia)
  • Fax: (966) -(1) 4740576

Kyrgyzstan
See Russia

Korea
Microsoft CH
  • Phone: (82) (2) 531-4500
  • Fax: (82) (2) 531-1724
  • Game and Hardware Service Center: (080) 645-1000 (toll free domestic only)
  • Customer Satisfaction Center: (080) 985-2000 (toll free domestic only)
    (82) (2) 558-8161
  • Technical Support Center: (82) (2) 508-0040
  • Microsoft FastTips: (82) (2) 3453-7555
  • Support Sales: (82) (2) 531-4544

Kuwait
PO Box 5244
13053 Safat
  • Tel: (965) 243-0248
  • Fax: (965) 243-0249
Technical Support (Personal Operating Systems, Desktop Applications, and Developer Tools ONLY):
  • (965) 243-1071

Latin America
Microsoft Latin American Headquarters (U.S.)
  • Phone: (305) 489-4800
  • Fax: (305) 491-1616
  • Customer Service: (425) 936-8661
  • Technical Support: (214) 714-9100

Liechtenstein
See Switzerland

Luxembourg
Microsoft NV
  • Phone: (32) (2) 730 39 11
  • Microsoft Support Network Information Center: (31) -(800) 9977-57
  • TechNet Subscription: (353) -(1) 703 8738
  • MSDN Subscription: (353) -(1) 708-8690
  • Microsoft Information Center: (32) -(2) 481 52 52
  • Bulletin Board: (32) (2) 726 85 45 (1200/2400/9600/14400 bd, 8N1, ANSI)
Technical Support:
  • (32) (2) 513 32 74 (Dutch speaking)
  • (32) (2) 502 34 32 (English speaking)
  • (32) (2) 513 22 68 (French speaking)

Malaysia
Microsoft (Malaysia) Sdn Bhd:
  • Phone: (6) (03) 757-2266
  • Fax: (6) (03) 757-2265
Customer Services:
  • Phone: Toll-free - (1) -(800) 88-3249
  • Fax: (6) (03) 758-5011
Technical Support:
  • Phone: (6) (03) 793-9595
  • Fax: (6) (03) 295-2065

México
Microsoft México, S.A. de C.V.
  • 267-2110 Atencion a Distribuidores
  • 265-3380 Atencion a Clientes
  • 265-3399 Soporte Sistemas Operativos y Applicaciones de Escritorio
  • 267-2190 Soporte de Servidores y Herramientas de Desarrollo
  • Fast Tips: (52)(5) 2612199
  • Microsoft BBS 628-6200/02 MSMEXICO

Middle East
Microsoft Middle East
  • Phone: (971) (4) 397 3888
  • Fax: (971) (4) 397 2244
Technical Support (Personal Operating Systems and Desktop Applications ONLY):
  • Phone: (971) (4) 397 5443
  • Fax: (971) (4) 397 2304
  • E-mail: mswsgulf@microsoft.com
Customer Service Center (Version upgrade / TechNet and MSDN subscription):
  • Phone: (971) (4) 299 5082
  • Fax: (971) (4) 299 5097

Morocco

Microsoft Afrique du Nord et de l'Ouest
  • Phone: (212) (2) 95 80 80
  • Fax: (212) (2) 95 85 85

Netherlands, The
Jaar 2000 informatie centrum
  • Netherlands: (020) 5001033
  • Belgium: (32) -(2) 7043000
  • Luxemburg: (32) -(2) 5139979
Support and Services
  • Product Support:
    • Netherlands (Dutch): (020) 5001005
    • Netherlands (English): (020) 5001053
    • Belgium (Dutch): (32) (2) 513 31 13
    • Belgium (French): (32) (2) 513 22 68
    • Belgium (English): (32) (2) 502 34 32
    • Luxemburg (French): (32) (2) 513 2268
    • Luxemburg (English): (32) (2) 502 3432

Microsoft Consulting Services Benelux
  • Netherlands, Belgium, and Luxemburg: (31) (0) 20 5001005
Information Services and Subscriptions
  • TechNet
    • Netherlands: (020) 5001035
    • Belgium: (32) (2) 5022176
    • Luxemburg: (32) (2) 5022176
    Microsoft Developer Network
    • Netherlands: (020) 5001037
    • Belgium: (32) (2) 5138684
    • Luxemburg: (32) (2) 5138684

New Zealand
Microsoft New Zealand Ltd
  • Phone: (64) (9) 357-5800
  • Fax: (64) (9) 357-0868
Technical Support:
  • Phone: (64) (9) 357-5575
  • Fax: (64) (9) 357-5577

Northern Ireland
See United Kingdom

Norway
Microsoft Norway AS
  • Phone: (47) (22) 02 25 00
  • Fax: (47) (22) 95 06 64
Technical Support:
  • Standard: (47) (22) 02 25 50
  • Priority: (47) (22) 02 25 45
  • Premier: (47) (22) 02 25 46
  • Microsoft Sales Support: (47) (22) 02 25 80
  • Microsoft MSDL: (47) (22) 18 22 09
  • Microsoft FastTips: (47) (22) 02 25 70 (Document 404040 in FastTips contains detailed instructions)

Panama
  • Technical Support/Soporte Tecnico: (506) 298 2020
  • Support E-mail/Correo Electronico Para soporte tecnico: mscasup
  • Customer Service/Centro de Servicios: (506) 298 2000
  • Customer Service E-mail/Correo Electronico para Atencion a Usuarios: msccatus

Papua New Guinea
See Australia

Paraguay
See Uruguay

Perú
  • Phone: (511) 421-1200
  • Fax (511) 421-7307
Technical Support:
  • (511) 215-5002
  • (511) 215-5005

Philippines
  • Phone: (632) 811-0062
Technical Support:
  • Phone: (632) 892-2295/2495
  • Fax: (632) 813-2493

Poland
Microsoft Sp. z o.o.
  • Phone: (48) -(22) 661-54-00
  • Fax: (48) -(22) 661-54-34
  • Information Service: (48) -(22) 865-99-33
  • Technical Support: (48) -(22) 865-99-66

Portugal
Microsoft Portugal MSFT, Lda.
  • Phone: (351) (1) 4409200
  • Fax: (351) (1) 4412101
Technical Support:
  • Standard Support: (351) (1) 4409280
  • Fax: (351) (1) 4411655

Puerto Rico
  • Soporte Tecnico: (408) 953 8086
  • Support E-Mail/Correo Electronico Para soporte tecnico: mscarsup
    • C
  • ustomer Service/Centro de Servicios: (800) 297 5982 for area codes 787 and 809 only
  • Customer Service E-mail/Correo Electronico para Atencion a Usuarios: msccatus

Romania
Microsoft s.r.l.
  • Phone: (40) (1) 222 90 16
  • Fax: (40) (1) 222 90 12
  • Technical Support: (40) (1) 312 09 48

Russia
Microsoft Z.A.O.
Microsoft Information Center:
Phone:
  • Moscow: (7) (095) 916-7171
  • St. Petersburg: (7) (812) 118-3636
  • Novosibirsk: (7) (3832) 119-019
  • Kiev: (380) (044) 2305101
Fax:
  • Moscow: (7) (095) 916-7112
Technical Support:
Phone:
  • Moscow: (7) (095) 745-5445
  • St. Petersburg: (7) (812) 118-3636
  • Novosibirsk: (7) (3832) 119-019
  • Kiev: (380) (044) 2305102
Fax:
  • Moscow: (7) (095) 916-7112

Saudi Arabia
  • Phone: (966) (1) 218-0808
  • Fax: (966) (1) 218-0809
Technical Support (Personal Operating System and Desktop Applications only):
  • Phone: (800) 124-2255 (toll free within Saudi Arabia)
  • Fax: (800) 124-2255 (Press 2 to send a fax)

Scotland
See United Kingdom

Singapore
Microsoft Singapore Pte Ltd
  • Phone: (65) 337-6088
  • Fax: (65) 337-6788
  • Customer Services Phone: (65) 324-5255
  • Customer Services Fax: (65) 324-6181
  • Product Support Services Phone: (65) 378-3600
  • Product Support Services Fax: (65) 378-3662

Slovakia
Microsoft Slovakia s.r.o.
Bratislava Business Center IV
Prievozska 6/A
821 09 Bratislava
SLOVAK REPUBLIC
  • Phone: (421) -(7) 5341 9841
  • Fax: (421) -(7) 5341 9840
  • Hotline: (421) -(7) 67 296 296
  • Infoservice: (421) -(7) 67 296 297
  • Y2K Infoservice: (421) -(7) 67 296 200

Slovenia
Microsoft d.o.o.
  • Phone: (386) (61) 1 800 800
  • Fax: (386) (61) 1 800 822
  • Technical Support: (386) (61) 185 3449

South Africa
Microsoft South Africa
All services
  • Phone: (27) (11) 257 0000; or
  • 0860225567 (inside South Africa)
  • Fax: (27) (11) 257 0257
  • Technical Support Fax: (27) (11) 257-0424

South East Africa and Indian Ocean Islands
See South Africa

Spain
Microsoft Iberica SRL
Inside Spain
  • Phone: (902) 197 198
  • Fax: (91) 803 8310
  • Technical Support: (902) 197 198
  • Customer Service: (902) 197 198
  • Fax Back Telephone: (902) 197 198
Outside Spain
  • Phone: (34) (91) 353 69 60
  • Fax: (34) (91) 803 8310
  • Technical Support: (34) (91) 353 69 60
  • Customer Service: (34) (91) 353 69 60
  • Fax Back Telephone: (34) (91) 353 69 60

Sweden
Microsoft AB
  • Phone: (46) (0) (8) 752 56 00
  • Fax: (46) (0) (8) 750 51 58
Technical Support:
  • Standard: (46) (0) (8) 752 09 29
  • Priority: (46) (0) (8) 751 09 80
  • Premier: (46) (0) (8) 632 57 01
  • Sales Support: (46) (0) 8 752 56 30

Switzerland Microsoft AG
  • Phone: (01) 839 61 11
  • Fax: (01) 831 08 69
  • Customer Service Phone: (0848) 858-868
Microsoft Information-Service, Postfach, 8001 Zürich
  • Fax: (01) 311-72-27
Support:
  • Standard Technical Support (German speaking) Installation and Handling: Phone (0848) 80 - 2255
  • Standard Technical Support (French speaking): Phone (022) 738 96 88
  • General information about Microsoft Support in Central Europe: Phone (0848) 80-2330

Tajikistan
See Russia

Taiwan
Microsoft Taiwan Corp.
  • Phone: (886) (2) 2504-3122
  • Fax: (886) (2) 2504-3121
Technical Support:
  • Phone: (886) (2) 2508-9501
  • Fax: (886) (2) 2508-9575

Thailand
Microsoft (Thailand) Limited
  • Phone: (662) 266-3300
  • Fax: (662) 266-3310
Product Support:
  • Phone: (662) 613-7208 through 11
  • Fax: (662) 613-7198

Turkey
Microsoft Turkey
  • Phone: (90) (212) 258 59 98
  • Fax: (90) (212) 258 59 54
Support Hotline:
  • Phone: (90) (212) 275 2466
  • Fax: (90) (212) 272 7755

Turkmenistan
See Russia

United Kingdom
Microsoft Limited
  • Phone: (0870) 60 10 100
  • Fax: (0870) 60 20 100
Microsoft Product Support Services
  • Desktop Applications, Home Products, Personal Operating Systems, and Hardware: (0870) 50 10 100
  • Developer Products: (0870) 50 10 200
  • Business Systems: (0870) 50 10 300
  • Customers phoning from Ireland should dial 706 5353 for technical support.
  • Pre-Sales Information: Microsoft Connection (0345) 00 2000

Uruguay
Technical Support:
  • Phone: (598) (2) 774934
  • Fax: (598) (2) 774935

Uzbekistan
See Russia

Venezuela
Corporation MS 90 de Venezuela S.A.
  • Other information: (582) 265-9922
  • Fax: (582) 265-0863
  • Technical Support: (582) 993-6755

Wales
See United Kingdom


Collecting Events

Microsoft Operations Manager 2000 collects information and stores it in the configuration group database. Events typically make up the majority of the collected information. You can define the events you want to collect and the providers from which to collect them. You can collect all events from all providers on all computers, or you can collect a limited number of specific events.

Collection rules identify the specific events and providers, but do not provide alerts or responses. Management Pack modules contain collection rules. You can also create your own collection rules.

You can create processing rules, including collection rules, in the Rules snap-in. For more information about using the Rules snap-in, see Requirements and Permissions. For more information about creating collection rules, see Collecting Specific Events.

Other types of processing rules define events to be collected, and also provide alerts or responses when the event occurs. For more information, see the following topics:

  • Alerting on or Responding to an Event
  • Filtering an Event
  • Consolidating Similar Events
  • Detecting a Missing Event


Creating a Management Pack Module

A Management Pack module consists of a processing rule group that is associated with a computer group. Processing rule groups are made up of individual processing rules and other processing rule groups. Computer groups define which computers will be monitored.

The Management Pack module defines which computers are monitored, what they are monitored for, and what response, if any, is initiated when a processing rule match occurs.

  1. Define a computer group
    • Does the computer group already exist?
      • If yes, select the computer group and proceed to Define a processing rule group in this topic.
      • If no, is the computer group based on a registry-based attribute?
        • If yes, follow the steps in Creating a Computer Attribute, and then follow the steps in Creating a Computer Group.
        • If no, follow the steps in Creating a Computer Group. Select No when prompted to deploy a group of processing rules to computers that match the new computer group.
  2. Define a processing rule group
    • Does the processing rule group already exist?
      • If yes, follow the steps for Associating a Processing Rule Group with a Computer Group.
      • If no, follow the steps in Creating a Processing Rule Group. Select Yes when prompted to deploy the processing rules in the new processing rule group to a group of computers.
      • In the Processing Rule Group properties dialog, click Add, and then select the computer group you want to associate with this processing rule group. Click OK.
      • Click OK to apply change and close the Processing Rule Group properties dialog.

Note

  • When you create a new computer or processing rule group, or associate a processing rule group with a computer group, it is not immediately reflected in MOM. The default time for new rules to be deployed is 2:05 A.M. However you can force instant deployment of a new computer group, new processing rule group or new association by following steps 7 and 8 in Creating a Computer Group.

Related Topics


Installing Agents

Microsoft Operations Manager 2000 (MOM) installs agents based on computer grouping rules and the Agent Manager Managed Computer rules.

Many computer grouping rules are predefined in Management Pack modules. For information about creating additional computer grouping rules, see Creating a Computer Group.

When MOM was installed, the setup program created one Managed Computer rule for the Consolidator computer. Managed Computer rules create a Managed Computers list, so by default, the local computer is in the Managed Computers list. The Agent Manager is responsible for computers in its Managed Computers list. For information about creating additional Managed Computer rules, see Modifying the Managed Computers List.

During a managed computer scan, the Agent Manager identifies computers that require agent installation or uninstallation. For more information about scanning computers, see Scanning Managed Computers.

By default, the Pending Installations window of the Configuration snap-in lists the computers requiring agent installation or uninstallation. You can choose to approve or cancel pending actions. For more information, see Handling Pending Installations.

After the Agent Manager installs an agent on a computer, you might need to restart the computer before the agent will start. If you must restart the agent computer, the Agent Manager logs an event with an event ID of 21116, 21118, or 21169. For information about checking events in the Monitor, see Viewing Events.

Note

  • If the computer on which you want to install an agent is connected by a slow WAN connection, is outside your interior network firewall, or is in a highly controlled environment, you can install agents manually. For more information about installing agents manually, see the Installation Guide.


Monitoring the Health of Your Network

Microsoft Operations Manager 2000 allows you to quickly identify potentially serious network problems, track resolution progress, and provide resolution information that others in your organization can use.

For a quick overview of network conditions, you can view the Today window. For more information, see Viewing the Today Window.

Default Monitor views can show you information about all service level exceptions, all open alerts, and all computers in the configuration. You can quickly view specific alert and event details, performance data, and product component status. For more information, see the following topics:

  • Viewing All Computers
  • Viewing All Computer Groups
  • Viewing Alerts
  • Viewing Service Level Exceptions
  • Viewing Performance of a Computer
  • Viewing Events
  • Viewing Component Status

For example, for a closer look at network activity, expand Monitor in the left pane, and then click All Computers. The most severe alert for each computer in the configuration group is indicated in the left column.

The All Computers view provides an easy way to retrieve useful information about computers and their alerts. You can click a computer in this window, and view computer properties, alerts, events, performance, computer group membership, and the processing rules applied to this computer.

Double-click a computer in the All Computers view to see its open alerts. You can view details for alerts that include the times they occurred, their sources, and their current resolution states. Alert properties also include any associated knowledge base information and the resolution history. The resolution history shows if any responses were carried out for the alert.

For more information about monitoring alerts, see the following topics:

  • Viewing Alerts
  • Finding an Alert
  • Resolving an Alert
  • Viewing Events Associated with an Alert
  • Viewing the Processing Rule that Generated an Alert
  • Defining a Response for an Alert


Monitoring the Performance of Your Network

Microsoft Operations Manager 2000 allows you to monitor the performance of your network using Windows Management Instrumentation (WMI). You can track performance thresholds and collect sampled data for trend analysis. You can create and view graphs of sampled data, and use the information for capacity planning.

Typically, performance thresholds generate an alert, so you can track performance thresholds in alert views. For more information about performance threshold alerts, see Viewing Alerts.

You can view sampled performance data in the Monitor. The All Performance view shows the number of counters sampled for each computer in the configuration group. In the All Performance view, you can double-click computers to see a view of performance counters evaluated on the computer. You can graph counters in this view. For more information, see Viewing Sampled Performance Data and Graphing Performance Data.

Related Topics


Monitoring the Product

Using Microsoft Operations Manager 2000, you can track events and alerts to monitor the status of your network. You can also monitor the status of product components and view the status of agents in the configuration group. For more information, see Monitoring the Agent Status of a Component Computer.

The Agent Manager, which is part of the Consolidator, is responsible for deploying agents on its managed computers. Managed Computer rules specify the computers in an Agent Manager's Managed Computers list. To view information about the computers for which an Agent Manager is responsible, or to examine an Agent Manager's agent installation parameters, see Configuring Agent Manager Properties.

The Agent Manager, by default, performs a daily scan of its managed computers to see if it should install or remove agents. You can perform a manual scan if you do not want to wait for the automatic scan to be performed. For example, if you create or change computer grouping rules, a scan can determine if any actions are required on the managed computers. For more information, see Scanning Managed Computers.

By default, when an Agent Manager determines that an agent needs to be installed or removed, it places the agent computer in the Pending Installations list to wait for your approval or cancellation. For more information, see Handling Pending Installations.

You might determine that the Managed Computers list includes computers for which you do not want the Agent Manager to be responsible. For more information, see Excluding a Computer from the Managed Computers List.


Printing Help Topics

You can print a single Help topic or all Help topics under a selected heading. If you want to print all Help topics under a selected heading, configure Microsoft Internet Explorer to optimize printing.

To configure Internet Explorer settings to print multiple Help topics:

  1. Start Microsoft Internet Explorer in the Microsoft Office program folder.
  2. Click View on the menu bar.
  3. Click Text Size on the View menu.
  4. Click Smallest on the Text Size menu.
  5. Click Tools on the menu bar.
  6. Click Internet Options on the Tools menu.
  7. Click Fonts on the Internet Options window.
  8. Select Arial, and then click OK.
  9. Click OK on the Internet Options window, and then close Microsoft Internet Explorer.

To print all Help topics under a heading:

  1. In the left pane of Microsoft Operations Manager 2000 Help, click the heading containing the topics you want to print.
  2. Click the Print icon on the toolbar.
  3. Click Print the selected heading and all its subtopics.
  4. Specify the desired print parameters, and then click OK.

To print a single Help topic:

  1. In the left pane of Microsoft Operations Manager 2000 Help, expand the heading containing the topic you want to print.
  2. Click the topic you want to print.
  3. Click the Print icon on the toolbar.
  4. Click OK to print only the selected topic.
  5. Specify the desired print parameters, and then click OK.


Resolving an Alert

Alerts can indicate that a condition or occurrence on your network needs to be addressed. Resolving alerts is a process that includes several tasks.

To resolve an alert:

  1. View the alert. For more information, see Viewing Alerts.
  2. View the alert properties to find out details about the indicated condition. For more information, see Viewing Alert Properties.
    • If you want to assign the alert to the person responsible for resolving the indicated condition, see Assigning an Alert.
  3. Change the resolution state of the alert to track the resolution process. For more information, see Changing the Resolution State of an Alert.
    • If you want to add comments to the alert resolution history detailing the efforts for this specific alert, see Modifying the Resolution History of an Alert.
  4. When the condition that prompted the alert is resolved, you can add pertinent information to the company knowledge base for the processing rule that generated the alert.
    • If you want to add information that others can use to resolve similar conditions in the future, see Modifying the Knowledge Base for an Alert.

Related Topics


Creating an Alert Definition

Microsoft Operations Manager 2000 (MOM) can generate alerts for enterprise conditions that require attention or special action. You can define alerts when you create some types of processing rules. When a processing rule match occurs, MOM generates an alert.

You can define an alert in the following processing rules:

  • Event rules
  • Missing event rules
  • Threshold rules

For more information about creating an event rule or missing event rule, see Creating an Event Processing Rule.

For more information about creating a threshold rule, see Creating a Performance Processing Rule.

You can also create an alert based on an existing event. For more information, see Creating an Alert Based on an Event.


Defining a Response for an Alert

You can define a response for an existing alert in the Monitor snap-in. When the alert occurs again, Microsoft Operations Manager 2000 will perform the response.

Defining a response for an existing alert in the Monitor snap-in requires your user account to be a member of the Operators (OnePointOps Operators) user group. For more information, see Requirements and Permissions.

You can also create an alert processing rule in the Rules snap-in. For more information, see Creating an Alert Processing Rule.

To define a response for an alert in the Monitor:

  1. Expand Microsoft Operations Manager (default) in the left pane.
  2. Expand Monitor in the left pane.
  3. Display the alert. For more information, see Viewing Alerts.
  4. Click the alert in the right pane.
  5. Click Action on the menu bar.
  6. Click New Rule to Respond to Alert on the menu bar.
  7. Follow the instructions until you reach the Responses window.
  8. Click Add.
  9. Click one or more of the following responses:
    10. Launch a script
    Allows you to specify or create a script to run in response to the alert.
    Send an SNMP trap
    Allows you to choose whether the SNMP trap will be generated on the agent or Consolidator computer when the alert occurs.
    Send a notification to a notification group
    Allows you to specify or create a notification group to be notified when the alert occurs.
    Execute a command or batch file
    Allows you to define a command or batch file to run when the alert occurs.
    Update state variable
    Allows you to update the state variable for later use in a script.
  10. Follow the instructions until you finish defining the response for the alert. For more information about the fields on a window, click Help.

Related Topics


Configuring Custom Fields for Alerts

You can create fields that Microsoft Operations Manager 2000 displays in alerts. All alerts generated in the configuration group will contain these fields.

To configure custom alert fields:

  1. Expand Microsoft Operations Manager (default) in the left pane.
  2. Expand Configuration in the left pane.
  3. Click Global Settings in the left pane.
  4. Click Custom Alert Fields in the right pane.
  5. Click Action on the menu bar.
  6. Click Properties on the Action menu.
  7. Specify the desired settings, and then click OK.

Related Topics


Viewing Alerts

You can view all open alerts, which are alerts that do not have a resolution state of Resolved. You can also create custom views that let you specify the alerts you want to see.

To view alerts:

  1. Expand Microsoft Operations Manager (default) in the left pane.
  2. Expand Monitor in the left pane.
    • If you want to view all open alerts, click All Open Alerts in the left pane.
    • If you want to view specific alerts, complete the following steps:
      1. Click Action on the menu bar.
      2. Click Find Alerts on the Action menu.
      3. Follow the instructions until you have finished creating an alert view that displays the specified alerts. For more information about the fields on a window, click Help.

Related Topics


Viewing Service Level Exceptions

Service level exceptions are alerts that have remained in a particular resolution state longer than a specified service level agreement time. These alerts may need attention as soon as possible. For more information about setting the service level agreement time, see Configuring Alert Resolution States.

To view service level exceptions:

  1. Expand Microsoft Operations Manager (default) in the left pane.
  2. Expand Monitor in the left pane.
  3. Click All Service Level Exceptions in the left pane.

Related Topics


Copying an Alert

You can copy the text of an alert to the Clipboard to be pasted within another application. The text includes alert properties, the alert's globally unique identifier (GUID), and the alert's URL in the Web Console.

To copy alert text to the Clipboard:

  1. Expand Microsoft Operations Manager (default) in the left pane.
  2. Expand Monitor in the left pane.
  3. Display the alert. For more information, see Viewing Alerts.
  4. Click the alert in the right pane.

    5. Note

    • You can use the CTRL key or the SHIFT key to select multiple alerts.

  5. Click Action on the menu bar.
  6. Click Copy to Clipboard on the Action menu.

Related Topics


Finding an Alert

You can create custom views to display specific alerts.

To find an alert:

  1. Expand Microsoft Operations Manager (default) in the left pane.
  2. Click Monitor in the left pane.
  3. Click Action on the menu bar.
  4. Click Find alerts on the Action menu.
  5. Follow the instructions until you have finished creating an alert view to display the specified alert. For more information about the fields on a window, click Help.

Related Topics


Viewing Alert Properties

Alert properties show specific information about an alert, including the computer that generated the alert, the events associated with the alert, and the time the alert occurred.

To view alert properties:

  1. Expand Microsoft Operations Manager (default) in the left pane.
  2. Expand Monitor in the left pane.
  3. Display the alert. For more information, see Viewing Alerts.
  4. Click the alert in the right pane.
  5. Click Action on the menu bar.
  6. Click Properties on the Action menu.

Related Topics


Viewing the Knowledge Base for an Alert

The alert knowledge base can include information from Microsoft or from your company. You can view the knowledge base in the alert properties.

To view the knowledge base for an alert:

  1. Expand Microsoft Operations Manager (default) in the left pane.
  2. Expand Monitor in the left pane.
  3. Display the alert. For more information, see Viewing Alerts.
  4. Click the alert in the right pane.
  5. Click Action on the menu bar.
  6. Click View Knowledge Base on the Action menu.

Related Topics


Viewing Events Associated with an Alert

Alerts are often associated with event occurrences. When the specific event occurs, an event processing rule generates an alert.

To view the events associated with an alert:

  1. Expand Microsoft Operations Manager (default) in the left pane.
  2. Expand Monitor in the left pane.
  3. Display the alert. For more information, see Viewing Alerts.
  4. Click the alert in the right pane.
  5. Click Action on the menu bar.
  6. Click Properties on the Action menu.
  7. Select the Events tab.

Related Topics


Viewing the Processing Rule that Generated an Alert

You can view detailed properties of the processing rule that generated an alert.

Viewing the processing rule that generated a specific alert requires your user account to be a member of the Operators (OnePointOps Operators) Windows NT user group. For more information, see Requirements and Permissions.

To view the processing rule that generated an alert:

  1. Expand Microsoft Operations Manager (default) in the left pane.
  2. Expand Monitor in the left pane.
  3. Display the alert. For more information, see Viewing Alerts.
  4. Click the alert in the right pane.
  5. Click Action on the menu bar.
  6. Click All Tasks on the Action menu.
  7. Click View Rule.

Related Topics


Assigning an Alert

You can assign an owner to an alert. For example, the owner might be the person responsible for resolving the alert condition. By default, alert views display owner names for each alert.

To assign an alert:

  1. Expand Microsoft Operations Manager (default) in the left pane.
  2. Expand Monitor in the left pane.
  3. Display the alert. For more information, see Viewing Alerts.
  4. Click the alert in the right pane.
  5. Click the Action menu.
  6. Click Properties on the Action menu.
  7. Click the State tab.
  8. Type the owner's name in the Owner field, and then click OK.

Related Topics


Changing the Resolution State of an Alert

You can change the resolution state of an alert to track resolution progress.

To change the resolution state of an alert:

  1. Expand Microsoft Operations Manager (default) in the left pane.
  2. Expand Monitor in the left pane.
  3. Display the alert. For more information, see Viewing Alerts.
  4. Click the alert in the right pane.
  5. Click Action on the menu bar.
    • If you want to change the resolution state to Resolved, click Set State to Resolved on the Action menu.
    • If you want to change the resolution state to a state other than Resolved, complete the following steps:
      1. Click All Tasks on the Action menu.
      2. Click one of the following options:
        • Set State to Acknowledged
        • Set State to Level 1: Assigned to helpdesk or local support
        • Set State to Level 2: Assigned to subject matter expert
        • Set State to Level 3: Requires scheduled maintenance
        • Set State to Level 4: Assigned to external group or vendor

Related Topics


Modifying the Knowledge Base for an Alert

You can add information to the company knowledge base for an alert to save comments about its resolution. Your comments are added to the processing rule that generated the alert, and are included in any alerts later generated by the processing rule.

Monitor users can append information to the company knowledge base. To modify existing information in the company knowledge base, your user account must be a member of the Operators (OnePointOps Operators) user group. For more information, see Requirements and Permissions.

To modify the alert knowledge base:

  1. Expand Microsoft Operations Manager (default) in the left pane.
  2. Expand Monitor in the left pane.
  3. Display the alert. For more information, see Viewing Alerts.
  4. Click the alert in the right pane.
  5. Click Action on the menu bar.
  6. Click View Knowledge Base on the Action menu.
  7. Click Edit on the Knowledge Base tab.
  8. Type your comments in the text field, and then click OK.

Related Topics


Modifying the Resolution History of an Alert

Microsoft Operations Manager 2000 automatically tracks and records all changes to alert properties. You cannot edit this information, but you can add your own comments to it.

To modify the resolution history of an alert:

  1. Expand Microsoft Operations Manager (default) in the left pane.
  2. Expand Monitor in the left pane.
  3. Display the alert. For more information, see Viewing Alerts.
  4. Click the alert in the right pane.
  5. Click Action on the menu bar.
  6. Click Properties on the Action menu.
  7. Click the State tab.
  8. Type your comments in the Comment field.
  9. Click Apply.
    • If you want to view your alert resolution history comments, click the History tab.

Related Topics


Creating a Custom Task

Custom tasks send information about a results pane item to another application. These custom tasks can include applications, commands, or batch files. You can create custom tasks for specific view types, including event, alert, attribute value, and computer views.

For example, you could create a custom alert task that allows you to send alert information to a trouble-ticket application. This custom task is then available on the Action menu when you select an alert in an alert view.

To create a custom task:

  1. In the left pane, expand Microsoft Operations Manager (default).
  2. In the left pane, click Monitor.
  3. On the menu bar, click Action.
  4. On the Action menu, click New.
  5. Click Custom Task.
  6. Specify the desired values, and then click OK.

Related Topics


Creating a Computer Group

Computer groups define sets of computers with something in common, such as a computer group of all computers with Microsoft SQL Server installed. You can associate computer groups with processing rule groups so that the rules apply to all computers in the group.

Computer groups are updated at the next Managed Computer scan.

To create a computer group:

  1. Expand Microsoft Operations Manager (default) in the left pane.
  2. Expand Rules in the left pane.
  3. Click Computer Groups in the left pane.
  4. Click Action on the menu bar.
  5. Click Create Computer Group on the Action menu.
  6. Follow the instructions until you have finished creating a new computer group and associating it with processing rule groups. For more information about the fields on a window, click Help.
    • If you want the computer group and associated processing rules to take effect immediately, complete the following steps:
      1. Expand Microsoft Operations Manager (default) in the left pane.
      2. Expand Configuration in the left pane.
      3. Click Agent Managers in the left pane.
      4. Click Action on the menu bar.
      5. Click Scan All Managed Computers on the Action menu.
      6. Click Pending Installations in the left pane to view the results of the scan.

Related Topics


Modifying Computer Group Properties

You can modify the properties of existing computer groups as your network changes. Some changes take place immediately. Some changes will take effect at the next managed computer scan.

  1. Expand Microsoft Operations Manager (default) in the left pane.
  2. Expand Rules in the left pane.
  3. Expand Computer Groups in the left pane.
  4. In the right pane, click the computer group you want to modify.
  5. Click Action on the menu bar.
  6. Click Properties on the Action menu.
  7. Specify the desired settings, and then click OK.

Related Topics


Excluding or Including Computers in Computer Groups

You can specify, by domain and computer name, which computers to always exclude or include in the computer group. The computers are excluded from or included in the computer group regardless of their other properties. These changes take effect at the next managed computer scan.

To exclude computers from the computer group:

  1. Expand Microsoft Operations Manager (default) in the left pane.
  2. Expand Rules in the left pane.
  3. Expand Computer Groups in the left pane.
  4. In the right pane, click the computer group from which you want to exclude computers.
  5. Click Action on the menu bar.
  6. Click Properties on the Action menu.
  7. Click the Excluded Computers tab.
  8. Click Add.
  9. Identify the computer you want to exclude, and then click OK. You may also browse to identify the computer to be excluded.

To include computers in the computer group:

  1. Expand Microsoft Operations Manager (default) in the left pane.
  2. Expand Rules in the left pane.
  3. Expand Computer Groups in the left pane.
  4. In the right pane, click the computer group in which you want to include computers.
  5. Click Action on the menu bar.
  6. Click Properties on the Action menu.
  7. Click the Included Computers tab.
  8. Click Add.
  9. Identify the computer you want to include, and then click OK. You may also browse to identify the computer to be included.


Copying a Computer Group

You can copy a computer group, paste it, and modify its properties to create a new computer group. You can copy and paste a computer group within the current Rules snap-in or into a Rules snap-in for another configuration group.

To copy a computer group:

  1. Expand Microsoft Operations Manager (default) in the left pane.
  2. Expand Rules in the left pane.
  3. Click Computer Groups in the left pane.
  4. In the right pane, click the computer group you want to copy.
  5. Click the Action menu.
  6. Click Copy on the Action menu.
  7. Click Computer Groups in the left pane. You can paste a computer group only into a Computer Groups folder in a Rules snap-in.
  8. Click the Action menu.
  9. Click Paste on the Action menu.

Related Topics


Deleting a Computer Group

If a computer group is no longer required, you can delete it. When you delete a computer group, the processing rule groups associated with the computer group are no longer applied to the computers in the computer group.

To delete a computer group:

  1. Expand Microsoft Operations Manager (default) in the left pane.
  2. Expand Rules in the left pane.
  3. Click Computer Groups in the left pane.
  4. In the right pane, click the computer group that you want to delete.
  5. Click Action on the menu bar.
  6. Click Delete on the Action menu.
  7. Click Yes.

Related Topics


Viewing Computer Attribute Properties

You can view the properties of computer attributes, which include the attribute registry path and value.

To view computer attribute properties:

  1. Expand Microsoft Operations Manager (default) in the left pane.
  2. Expand Rules in the left pane.
  3. Expand Advanced in the left pane.
  4. Click Computer Attributes in the left pane.
  5. In the right pane, click the computer attribute with properties you want to view.
  6. Click Action on the menu bar.
  7. Click Properties on the Action menu.

Related Topics


Creating a Computer Attribute

You can use attributes to group computers. For example, you can create an attribute that identifies computers running Windows 2000. You can then use the attribute to create a computer group.

To create a computer attribute:

  1. Expand Microsoft Operations Manager (default) in the left pane.
  2. Expand Rules in the left pane.
  3. Expand Advanced in the left pane.
  4. Click Computer Attributes in the left pane.
  5. Click Action on the menu bar.
  6. Click Create Registry-Based Computer Attribute on the Action menu.
  7. Follow the instructions until you finish creating a computer attribute. For more information about the fields on a window, click Help.

Related Topics


Copying a Computer Attribute

You can copy a computer attribute, paste it, and modify its properties to create a new computer attribute. You can copy and paste a computer attribute within the current Rules snap-in or into a Rules snap-in for another configuration group.

To copy a computer attribute:

  1. Expand Microsoft Operations Manager (default) in the left pane.
  2. Expand Rules in the left pane.
  3. Expand Advanced in the left pane.
  4. Click Computer Attributes in the left pane.
  5. In the right pane, click the computer attribute you want to copy.
  6. Select Action on the menu bar.
  7. Click Copy on the Action menu.
  8. Click Computer Attributes in the left pane. You can paste a computer attribute only into a Computer Attributes folder in a Rules snap-in.
  9. Select Action on the menu bar.
  10. Click Paste on the Action menu.

Related Topics


Modifying Computer Attribute Properties

You can modify the properties of computer attributes as your network changes.

Warning

  • Renaming an attribute invalidates computer grouping rules that use the attribute. Ensure that no computer grouping rule uses the attribute before renaming it.

To modify a computer attribute:

  1. Expand Microsoft Operations Manager (default) in the left pane.
  2. Expand Rules in the left pane.
  3. Expand Advanced in the left pane.
  4. Click Computer Attributes in the left pane.
  5. In the right pane, click the computer attribute you want to modify.
  6. Select Action on the menu bar.
  7. Click Properties on the Action menu.
  8. Specify the desired settings, and then click OK.

Related Topics


Deleting a Computer Attribute

You might want to delete a computer attribute if it is no longer required by computer grouping rules. If you delete an attribute that is part of a computer grouping rule, the computer grouping rule becomes invalid.

To delete a computer attribute:

  1. Expand Microsoft Operations Manager (default) in the left pane.
  2. Expand Rules in the left pane.
  3. Expand Advanced in the left pane.
  4. Click Computer Attributes in the left pane.
  5. In the right pane, click the attribute that you want to delete.
  6. Click Action on the menu bar.
  7. Click Delete on the Action menu.
  8. Click Yes.

Related Topics


Associating a Computer Group with a Processing Rule Group

To enable agents to apply processing rules to the correct computers, you must associate computer groups with processing rule groups. Agents on computers within the computer group apply the processing rules within the processing rule group as necessary.

To associate a computer group with a processing rule group:

  1. Expand Microsoft Operations Manager (default) in the left pane.
  2. Expand Rules in the left pane.
  3. Click Computer Groups in the left pane.
  4. In the right pane, click the computer group you want to associate with a processing rule group.
  5. Click Action on the menu bar.
  6. Click Properties on the Action menu.
  7. Click the Processing Rules tab.
  8. Follow the instructions on the Processing Rules tab. For more information about the fields on a window, click Help.

Related Topics


Viewing All Agents

You can view a list of all monitored computers, computers with agents installed, within the configuration group. By default, the most severe unresolved alert on each computer is indicated in the first column of the view.

To view all agent computers:

  1. Expand Microsoft Operations Manager (default) in the left pane.
  2. Expand Monitor in the left pane.
  3. Click All Agents in the left pane.

Related Topics


Viewing All Computers

You can view a list of all computers within the configuration group. By default, the most severe unresolved alert on each computer is indicated in the first column of the view.

To view all computers:

  1. Expand Microsoft Operations Manager (default) in the left pane.
  2. Expand Monitor in the left pane.
  3. Click All Computers in the left pane.

Related Topics


Viewing All Alerts for a Computer

You can view all the alerts that have occurred on a specific computer.

To view all alerts for a computer:

  1. Expand Microsoft Operations Manager (default) in the left pane.
  2. Expand Monitor in the left pane.
  3. Click All Computers in the left pane.
  4. In the right pane, click the computer with alerts you want to view.
  5. Click Action on the menu bar.
  6. Click View All Alerts on the Action menu.

Related Topics


Viewing Open Alerts for a Computer

You can view all the open alerts on a computer. Open alerts have a resolution state other than Resolved and may require attention.

To view all open alerts for a computer:

  1. Expand Microsoft Operations Manager (default) in the left pane.
  2. Expand Monitor in the left pane.
  3. Click All Computers in the left pane.
  4. In the right pane, click the computer with open alerts you want to view.
  5. Click Action on the menu bar.
  6. Click View Open Alerts on the Action menu.

Related Topics


Viewing Events for a Computer

You can view all events that have occurred on a computer.

To view all events for a computer:

  1. Expand Microsoft Operations Manager (default) in the left pane.
  2. Expand Monitor in the left pane.
  3. Click All Computers in the left pane.
  4. In the right pane, click the computer with events you want to view.
  5. Click Action on the menu bar.
  6. Click View Events on the Action menu.

Related Topics


Viewing Performance of a Computer

You can view the performance counter properties and values for a specific computer.

To view the performance counter properties and values for a computer:

  1. Expand Microsoft Operations Manager (default) in the left pane.
  2. Expand Monitor in the left pane.
  3. Click All Performance in the left pane.
  4. In the right pane, click the computer with the performance counters you want to view.
  5. Click Action on the menu bar.
  6. Click View Performance on the Action menu.

Related Topics


Viewing Attributes for a Computer

You can view the attributes of a specific computer. Attributes are used in computer grouping rules to group similar computers together.

To view the attributes of a computer:

  1. Expand Microsoft Operations Manager (default) in the left pane.
  2. Expand Monitor in the left pane.
  3. Click All Computers in the left pane.
  4. In the right pane, click the computer with attributes you want to view.
  5. Click Action on the menu bar.
  6. Click View Attributes on the Action menu.

Related Topics


Viewing Processing Rules for a Computer

You can view the processing rules that agents apply to a specific computer.

To view the processing rules for a computer:

  1. Expand Microsoft Operations Manager (default) in the left pane.
  2. Expand Monitor in the left pane.
  3. Click All Computers in the left pane.
  4. In the right pane, click the computer with processing rules you want to view.
  5. Click Action on the menu bar.
  6. Click All Tasks on the Action menu.
  7. Click View Processing Rules.

Related Topics


Viewing Computer Properties

You can view the properties of computers in the current configuration group. Properties include the number of new and unresolved alerts for the computer, the computer groups to which the computer belongs, and the processing rules applied to the computer.

To view computer properties:

  1. Expand Microsoft Operations Manager (default) in the left pane.
  2. Expand Monitor in the left pane.
  3. Click All Computers in the left pane.
  4. In the right pane, click the computer with properties you want to view.
  5. Click Action on the menu bar.
  6. Click Properties on the Action menu.

Related Topics


Viewing Computer Group Memberships for a Computer

You can view the computer groups to which a computer belongs. Processing rules associated with these computer groups are applied to the computer.

To view the computer groups to which a computer belongs:

  1. Expand Microsoft Operations Manager (default) in the left pane.
  2. Expand Monitor in the left pane.
  3. Click All Computers in the left pane.
  4. In the right pane, click the computer with computer group memberships you want to view.
  5. Click Action on the menu bar.
  6. Click View Computer Groups on the Action menu.

Related Topics


Viewing All Computer Groups

You can view a list of all computer groups in the configuration group.

To view all computer groups:

  1. Expand Microsoft Operations Manager (default) in the left pane.
  2. Expand Monitor in the left pane.
  3. Click All Computer Groups in the left pane.

Related Topics


Viewing Computer Group Properties

You can view the properties of computer groups in the current configuration group. Computer group properties include the computer grouping rule specifications and the processing rules associated with the computer group.

To view computer group properties:

  1. Expand Microsoft Operations Manager (default) in the left pane.
  2. Expand Rules in the left pane.
  3. Click Computer Groups in the left pane.
  4. In the right pane, click the computer group with properties you want to view.
  5. Click Action on the menu bar.
  6. Click Properties on the Action menu.

Related Topics


Viewing the Computers in a Computer Group

You can view a list of all computers matching a computer grouping rule specification.

To view computers in a computer group:

  1. Expand Microsoft Operations Manager (default) in the left pane.
  2. Expand Monitor in the left pane.
  3. Click All Computer Groups in the left pane.
  4. In the right pane, click the computer group with member computers you want to view.
  5. Click Action on the menu bar.
  6. Click View Computers on the Action menu.

Related Topics


Viewing Computer Attributes

You can view a list of all attributes that exist for computers within the configuration group. Computer attributes are used in computer grouping rules.

To view computer attributes:

  1. Expand Microsoft Operations Manager (default) in the left pane.
  2. Expand Rules in the left pane.
  3. Expand Advanced in the left pane.
  4. Click Computer Attributes in the left pane.

Related Topics


Monitoring the Agent Status of a Component Computer

You can monitor the status of agents on computers within the configuration group. You can monitor individual agents, as well as the status of agents on Consolidator or Agent Manager component computers.

To monitor agent status on component computers:

  1. Expand Microsoft Operations Manager (default) in the left pane.
  2. Expand Monitor in the left pane.
  3. Expand Components in the left pane.
    • If you want to view the status of agents, click Agents in the left pane.
    • If you want to view the status of agents on Consolidator computers, click Consolidator in the left pane.
    • If you want to view the status of agents on Agent Manager computers, click Agent Manager in the left pane.

Related Topics


Ignoring Agent Status

Microsoft Operations Manager 2000 can ignore the status of the agent on a component computer. For example, if an agent computer is disconnected from the network and you know the reason, you might not want its status to be displayed in the Monitor.

Ignoring agent status and stopping ignoring agent status require your user account to be a member of the Configuration Administrators (OnePointOp ConfgAdms) group. For more information about user accounts and groups, see Requirements and Permissions.

To ignore the status of an agent:

  1. Expand Microsoft Operations Manager (default) in the left pane.
  2. Expand Monitor in the left pane.
  3. Expand Components in the left pane.
  4. In the left pane, click Agents.
  5. In the right pane, click the agent computer whose status you want to ignore.
  6. Click Action on the menu bar.
  7. Click All Tasks on the menu bar.
    • If you want to ignore the status even if the agent reconnects, click Ignore Agent Status Forever.
    • If you want to ignore the status until the agent reconnects, click Ignore Status until Agent Reconnects. When the agent computer reconnects to the network, the Monitor will stop ignoring the status.

To stop ignoring agent status:

  1. Expand Microsoft Operations Manager (default) in the left pane.
  2. Expand Monitor in the left pane.
  3. Expand Components in the left pane.
  4. In the left pane, click Agents.
  5. In the right pane, click the agent computer whose status you want to stop ignoring.
  6. Click Action on the menu bar.
  7. Click All Tasks on the menu bar.
  8. Click Stop Ignoring Agent Status.

Related Topics


Configuring Agent Manager Properties

The Agent Manager is responsible for automatically installing and configuring agents on all the computers specified in its Managed Computer rules.

To configure an individual Agent Manager:

  1. Expand Microsoft Operations Manager (default) in the left pane.
  2. Expand Configuration in the left pane.
  3. Click Agent Managers in the left pane.
  4. In the right pane, click the Agent Manager you want to configure.
  5. Click Action on the menu bar.
  6. Click Properties on the Action menu.
  7. Specify the desired values on the Properties tabs, and then click OK.

Related Topics


Configuring Agent Properties

You can configure individual agent properties if necessary, including buffering, service checking, and response handling parameters, among others.

To configure individual agent properties:

  1. Expand Microsoft Operations Manager (default) in the left pane.
  2. Expand Configuration in the left pane.
  3. Click Agent Managers in the left pane.
  4. In the right pane, click the Agent Manager for the agent you want to configure. For more information about determining the Agent Manager for an agent, see Monitoring the Status of a Component.
  5. Click Action on the menu bar.
  6. Click Properties on the Action menu.
  7. On the Managed Computers tab, click the computer with the agent you want to configure.
  8. Click Settings.
  9. Specify the desired values on the Properties tabs, and then click OK.

Related Topics


Viewing the Managed Computers List for an Agent Manager

The Managed Computers list contains computers that match the Agent Manager Managed Computer rules. The Agent Manager finds computers that match the Managed Computer rules, collects computer attributes, evaluates computer group membership, and installs or uninstalls an agent as appropriate.

To view the Managed Computers list for an Agent Manager:

  1. Expand Microsoft Operations Manager (default) in the left pane.
  2. Expand Configuration in the left pane.
  3. Click Agent Managers in the left pane.
  4. In the right pane, click the Agent Manager with the Managed Computers list you want to view.
  5. Click Action on the menu bar.
  6. Click View Managed Computers on the Action menu.

Related Topics


Creating a Managed Computer Rule

Creating a Managed Computer rule changes the Managed Computers list. For more information about creating a Managed Computer rule and changing the Managed Computers list, see Modifying the Managed Computers List.

Related Topics


Modifying the Managed Computers List

Agent Managers are responsible for installing and uninstalling agents on computers that match the Managed Computer rules. You can modify the Managed Computer rules, which modify the Managed Computers list.

To modify the Managed Computer rules:

  1. Expand Configuration in the left pane.
  2. Click Agent Managers in the left pane.
  3. In the right pane, click the Agent Manager with the Managed Computer rules you want to modify.
  4. Click Action on the menu bar.
  5. Click Properties on the Action menu.
  6. On the Managed Computer Rules tab, specify the desired values.
  7. Click Apply.
  8. If you want the rules to take effect immediately, complete the following steps. Otherwise, the rules will take effect at the next scheduled Managed Computer scan.
    • Select the Managed Computer Scan tab.
    • Click Scan managed computers now.
  9. Click Pending Installations in the left pane.
  10. Click Action on the menu bar.
  11. Click Refresh on the Action menu to view results of the scan.

Related Topics


Scanning Managed Computers

Agent Managers periodically scan the Managed Computers list. You can also scan on demand. Scanning finds computers that match the Managed Computer rule, collects computer attributes, evaluates computer group membership, and identifies computers requiring an agent installation or uninstallation. By default, MOM lists these computers in the Pending Installations window of the Configuration Manager, where you can choose to approve or cancel pending actions.

To scan managed computers:

  1. Expand Microsoft Operations Manager (default) in the left pane.
  2. Expand Configuration in the left pane.
  3. Click Global Settings in the left pane.
  4. Click Agent Managers in the right pane.
  5. Click Action on the menu bar.
  6. Click Properties on the Action menu.
    • If you want to change the time and frequency that Agent Managers automatically scan managed computers, specify the desired values on the Managed Computer Scan tab.
      • If a zero value is entered, the zero value cancels the periodic scan.
    • If you want the Agent Manager to perform a scan now, click Scan managed computers now on the Managed Computer Scan tab.
  7. Click Pending Installations in the left pane to see the results of the scan.

If you change the configuration of an agent computer or install a new computer onto the network, you can prompt the Agent Manager to scan only the affeted computer instead of all managed computers. Changes take place when the service is restarted or during the next scheduled scan.

Related Topics


Scanning a Managed Computer

If you change the configuration of an agent computer or install a new computer onto the network, you can prompt the Agent Manager to scan only that computer instead of all managed computers. Scanning only the affected computer takes less time than scanning all managed computers. Changes will take place when the service is restarted or during the next scheduled scan.

To scan a single managed computer, create two custom tasks to run a Microsoft Operations Manager 2000 (MOM) script. The first custom task defines the syntax for scanning an agent computer in the Managed Computers list. The second task defines the syntax for scanning and installing an agent on a new computer. When you run the second task, a window prompts you for the name of the new computer.

You can run the tasks from the Consolidator and associated Agent Manager computer or from a remote MOM Administrator Console computer. If you run the tasks from a remote MOM Administrator Console computer, download and install version 5.1 of the command shell-based Windows Script Host (CSCRIPT.EXE) from the Microsoft Web site at www.microsoft.com. You do not need version 5.1 if you run the tasks from the Agent Manager computer.

To create a task for scanning a single agent computer in the Managed Computers list:

  1. If the computer from which you are running the script is not the Consolidator and associated Agent Manager computer, ensure that the computer has version 5.1 of Windows Script Host (CSCRIPT.EXE) installed.
  2. Start the MOM Administrator Console from the Microsoft Operations Manager program folder.
  3. Expand Microsoft Operations Manager (default) in the left pane.
  4. Click Monitor in the left pane.
  5. Click Action on the menu bar.
  6. Click New on the Action menu.
  7. Click Custom Task.
  8. Select the appropriate user name from the Task Available To list.
  9. Select computer items from the Task Available for list.
  10. Click Add.
  11. In the Name box, type Agent Manager scan this computer.
  12. In the Description box, type Causes the Agent Manager to scan an agent computer.
  13. In the Command box, type:

    14. CSCRIPT.EXE "$Agent Directory$\AMScanSingle.vbs" /a:AGENTMANAGER_COMPUTER_NAME /s:$Computer$

    /a:AGENTMANAGER_COMPUTER_NAME Specifies the name of the Agent Manager computer.

    For example:

    CSCRIPT.EXE "$Agent Directory$\AMScanSingle.vbs" /a:NYC_AM023 /s:$Computer$

To create a task for scanning and installing an agent on a new computer:

  1. If the computer from which you are running the script is not the Agent Manager computer, ensure that the computer has version 5.1 of Windows Script Host (CSCRIPT.EXE) installed.
  2. Start the MOM Administrator Console from the Microsoft Operations Manager program folder.
  3. Expand Microsoft Operations Manager (default) in the left pane.
  4. Click Monitor in the left pane.
  5. Click Action on the menu bar.
  6. Click New on the Action menu.
  7. Click Custom Task.
  8. Select the appropriate user name from the Task Available To list.
  9. Select computer items from the Task Available for list.
  10. Click Add.
  11. In the Name box, type Agent Manager scan a new computer.
  12. In the Description box, type Causes the Agent Manager to scan a computer and install an agent.
  13. In the Command box, type:

    14. CSCRIPT.EXE "$Agent Directory$\AMScanSingle.vbs" /a:AGENTMANAGER_COMPUTER_NAME

    /a:AGENTMANAGER_COMPUTER_NAME Specifies the name of the Agent Manager computer.

    For example:

    CSCRIPT.EXE "$Agent Directory$\AMScanSingle.vbs" /a:NYC_AM023

To run the custom task to scan an agent computer in the Managed Computers list:

  1. Start the MOM Administrator Console from the Microsoft Operations Manager program folder.
  2. Expand Microsoft Operations Manager (default) in the left pane.
  3. Click Monitor in the left pane.
  4. Click All Computers in the left pane.
  5. In the right pane, click the computer you want to scan.
  6. Click Action on the menu bar.
  7. Click Custom Tasks on the Action menu.
  8. Click Agent Manager scan this computer on the Custom Tasks menu.

To run the custom task to scan and install an agent on a new computer:

  1. Start the MOM Administrator Console from the Microsoft Operations Manager program folder.
  2. Expand Microsoft Operations Manager (default) in the left pane.
  3. Click Monitor in the left pane.
  4. Click All Computers in the left pane.
  5. Click any computer in the right pane. You will specify the new computer in a later step.
  6. Click Action on the menu bar.
  7. Click Custom Tasks on the Action menu.
  8. Click Agent Manager scan a new computer on the Custom Tasks menu.
  9. At the prompt, type the name of the new computer.

Related Topics


Excluding a Computer from the Managed Computers List

You can exclude a computer from the Managed Computers list of an Agent Manager if you no longer want the Agent Manager to maintain an agent on the computer. You can exclude a computer in the Configuration or the Monitor snap-ins.

For more information, see the following topics:

  • Excluding a Computer in the Configuration Snap-in
  • Excluding a Computer in the Monitor Snap-in

Related Topics


Handling Pending Installations

Agent Managers track when an agent needs to be installed on or removed from a computer. After a managed computer scan, the Pending Installations window lists computers requiring agent installations and uninstallations. You can approve or cancel all pending actions or each individual pending action.

For more information, see the following topics:

  • Approving All Pending Actions
  • Canceling All Pending Actions
  • Approving a Pending Action
  • Canceling a Pending Action


Uninstalling an Agent

Agent Managers automatically install and uninstall agents based on the requirements of computer grouping rules. Agent Managers are responsible for deploying agents on their managed computers, which are computers matching the Managed Computer rules.

You may decide, however, that an agent installed on a computer is not required. For example, the computer might match a Managed Computer rule, but you don't want an agent deployed on it. To remove the agent from the computer, or to prevent an agent from being installed on it, you have several choices.

You can exclude the computer from the Managed Computers list. The Agent Manager will not install agents on computers excluded from the list. The Agent Manager will automatically remove an agent from the computer after the specified uninstall delay. The default global setting for the uninstall delay is 48 hours. For more information, see Excluding a Computer from the Managed Computers List. For more information about specifying the uninstall delay, see Configuring Global Agent Manager Settings.

You can also manually uninstall an agent. Uninstalling an agent excludes the agent computer from the Managed Computers list and immediately removes the agent from the computer. For more information, see Uninstalling an Agent Now.

You can also remove all agents from an Agent Manager. This task is typically part of removing the product installation from an enterprise. For more information, see Uninstalling All Agents.

Note

  • An Agent Manager cannot uninstall agents that were manually installed, such as outside a firewall, unless the Agent Manager has been granted control of the agents. For more information about uninstalling manually installed agents, see the Installation Guide.

Related Topics


Configuring Alert Resolution States

You can create your own alert resolution states, as well as modify most of the default states. You can also specify the service level agreement time, the maximum amount of time an alert should remain in a resolution state before it becomes a service level exception.

To configure alert resolution states:

  1. Expand Microsoft Operations Manager (default) in the left pane.
  2. Expand Configuration in the left pane.
  3. Click Global Settings in the left pane.
  4. Click Alert Resolution States in the right pane.
  5. Click Action on the menu bar.
  6. Click Properties on the Action menu.
  7. Specify the desired settings, and then click OK.

Related Topics


Configuring Consolidator Email Settings

You can configure settings for all Consolidators to use when sending email responses to notification groups.

To configure global Consolidator email settings:

  1. Expand Microsoft Operations Manager (default) in the left pane.
  2. Expand Configuration in the left pane.
  3. Click Global Settings in the left pane.
  4. Click Email Server in the right pane.
  5. Click Action on the menu bar.
  6. Click Properties on the Action menu.
  7. Specify the desired settings, and then click OK.

Related Topics


Configuring Web Addresses

You can specify the addresses for the Web Console and reports you have published on the Web. You can then access the Web Console or the reports from within the MOM Administrator Console.

To configure Web addresses:

  1. Expand Microsoft Operations Manager (default) in the left pane.
  2. Expand Configuration in the left pane.
  3. Click Global Settings in the left pane.
  4. Click Web Addresses in the right pane.
  5. Click Action on the menu bar.
  6. Click Properties on the Action menu.
  7. Specify the desired settings, and then click OK.

Related Topics


Configuring Communication Ports

You can change the default TCP/IP port for communications between agents and Consolidators in a configuration group.

To configure the TCP/IP port:

  1. Expand Microsoft Operations Manager (default) in the left pane.
  2. Expand Configuration in the left pane.
  3. Click Global Settings in the left pane.
  4. Click Communications in the right pane.
  5. Click Action on the menu bar.
  6. Click Properties on the Action menu.
  7. Specify the desired port number, and then click OK.
  8. Perform a managed computer scan on all agents. For more information about scanning agents, see Scanning Managed Computers.
  9. Stop and restart the OnePoint service on all agent computers.
  10. Stop and restart the OnePoint service on all Consolidator computers.

Related Topics


Configuring Database Grooming

Microsoft Operations Manager 2000 (MOM) provides the following default database grooming jobs in the database:

OnePoint -Check Free Data Space
Scheduled to run every 30 minutes, starting daily at 12:45 A.M. This job calculates the percentage of free database space and sends the information to MOM as an event.
OnePoint-Check Integrity
Scheduled to run once a week on Saturday at 10:00 P.M. This job validates the integrity of the database. For example, it checks that the index and data pages are correctly linked and that indices are in their proper sort order.
OnePoint-Groom Alerts
Scheduled to run every hour. This job grooms resolved alerts from the database based on the information specified in Global Settings.
OnePoint-Groom Events
Scheduled to run every hour. This job grooms events from the database based on the information specified in Global Settings.
OnePoint-Groom Sampled Numeric Data
Scheduled to run every hour. This job grooms sampled numeric data from the database based on the information specified in Global Settings.
OnePoint-Reindex
Scheduled to run once a week on Sunday at 10:00 P.M. This job rebuilds the table indices to improve performance. The OnePoint-Reindex database job requires approximately 40 percent free space within the database to successfully complete. For example, a 10-GB database needs 14 GB total space in the database to successfully rebuild the indices. If the jobs fail due to lack of disk space, the failure of the jobs will not adversely affect your MOM implementation.
OnePoint-Reindex Event Table
Scheduled to run once a day at 12:00 A.M. This job rebuilds the event table indices to improve performance. The OnePoint-Reindex Event Table database job requires approximately 40% free space within the database to successfully complete. For example, a 10-GB database needs 14 GB total space in the database to successfully rebuild the indices. If the jobs fail due to lack of disk space, the failure of the jobs will not adversely affect your MOM implementation. This job does not run on Sundays, when the OnePoint-Reindex job rebuilds all table indices.
OnePoint-TodayStatisticsUpdateComputersAndAlerts
Scheduled to run every five minutes. This job updates the Today window.
OnePoint-TodayStatisticsUpdateEvents
Scheduled to run every 30 minutes. This job updates the Today window.
OnePoint-TodayStatisticsUpdatePerfmonRulesKB
Scheduled to run every hour. This job updates the Today window.
OnePoint-Update Database
Scheduled to run every hour. This job grooms auto-resolved alerts based on the information specified in Global Settings.
OnePoint-Update Statistics
Scheduled to run once a day at 1:00 A.M. This job updates information on key value distribution in the database to improve performance.

Modifying Grooming Settings

MOM provides easy access to database grooming default settings in the MOM Administrator Console Configuration snap-in Global Settings. From the Database Grooming tab, you can change the number of records deleted and the retention time for events, alerts, performance data, and logs. You can also set the retention time for automatic resolution of alerts.

MOM provides default grooming jobs in the database. These grooming jobs use the retention times and the number of records to delete specified in Global Settings in the MOM Administrator Console Configuration snap-in.

For example, if you set the retention time for All Sampled Numeric Data to 90 days and to delete 4,000 records, the OnePoint-Groom Sampled Numeric Data grooming job runs every five minutes, checking for data older than 90 days and deleting 4,000 records older than 90 days.

The following table provides the default database grooming settings:

Records to Delete | Retention Time | Number of Records
All Sampled Numeric Data | 90 days | 4,000
Auto Resolve Error Alerts | Two days | All
Auto Resolve Information Alerts | Four hours | All
Auto Resolve Success Alerts | Four hours | All
Auto Resolve Warning Alerts | One day | All
Other Events | Seven days | 4,000
Resolved Alerts | 30 days | 4,000
Windows Logs Not Including Security | Seven days | 4,000
Windows Security Event Log | 30 days | 4,000

These settings are adequate for most enterprise environments.

To modify database grooming settings:

  1. Log on to the central computer or a Consolidator computer with a Windows 2000 account in the OnePointOp ConfigAdms group.
  2. Start the MOM Administrator Console from the MOM program folder.
  3. Expand Microsoft Operations Manager (default) in the left pane.
  4. Expand Configuration in the left pane.
  5. Click Global Settings in the left pane.
  6. Click Database Grooming in the right pane.
  7. Click Action on the menu bar.
  8. Click Properties on the Action menu.
  9. Click a data type, click Edit to set its grooming parameters, and then click OK.

Related Topics


Configuring Global Agent Manager Settings

You can configure settings for all Agent Managers in the configuration group. These settings specify the agent service account and the Managed Computer scan settings. You can also specify how Agent Managers deploy agents, including whether agents are installed automatically or are added to the Pending Installations list to wait for approval. You can also specify the uninstall delay, the amount of time the Agent Manager waits before uninstalling an unnecessary agent.

To configure global Agent Manager settings:

  1. Expand Microsoft Operations Manager (default) in the left pane.
  2. Expand Configuration in the left pane.
  3. Click Global Settings in the left pane.
  4. Click Action on the menu bar.
  5. Click Edit Agent Manager Settings on the Action menu.
  6. Specify the desired settings, and then click OK.

Related Topics


Configuring Global Consolidators Settings

You can configure settings for all Consolidators in the configuration group, including how often to poll for rule changes, how to temporarily store data, and the number of script, e-mail, or paging responses that can run at the same time.

To configure global Consolidators settings:

  1. Expand Microsoft Operations Manager (default) in the left pane.
  2. Expand Configuration in the left pane.
  3. Click Global Settings in the left pane.
  4. Click Action on the menu bar.
  5. Click Edit Consolidator Settings on the Action menu.
  6. Specify the desired settings, and then click OK.

Related Topics


Configuring DAS Auditing

You can audit changes to rules and product configuration. DAS auditing provides data for the Configuration Changes reports.

Note

  • DAS auditing is CPU-intensive and stores a considerable amount of data in the database.

To configure DAS auditing:

  1. Expand Microsoft Operations Manager (default) in the left pane.
  2. Expand Configuration in the left pane.
  3. Click Global Settings in the left pane.
  4. Click Auditing in the right pane.
  5. Click Action on the menu bar.
  6. Click Properties on the Action menu.
  7. Check Audit changes made through the DAS, and then click OK.

    8. Note

    • If your user account does not have read and write access to the DAS computer Registry, this option is unavailable.

Related Topics


Configuring Global Agent Settings

You can configure settings for all agents in the configuration group, including buffering, service checking, and response handling parameters, among others.

To configure global agent settings:

  1. Expand Microsoft Operations Manager (default) in the left pane.
  2. Expand Configuration in the left pane.
  3. Click Global Settings in the left pane.
  4. Click Action on the menu bar.
  5. Click Edit Agent Settings on the Action menu.
  6. Specify the desired settings, and then click OK.

Related Topics


Importing a Management Pack Component

Importing a Management Pack Module Component

A Management Pack module component, also called an ADF file, contains SeNTry 2.x filters, alerts, and missing events. An imported Management Pack module component is converted into a Management Pack module and creates a new processing rule group.

To import a Management Pack module component:

  1. Expand Microsoft Operations Manager (default) in the left pane.
  2. Expand Rules in the left pane.
  3. Expand Processing Rule Group in the left pane.
  4. Click the processing rule group into which you want to import the Management Pack module component.
  5. Click Action on the menu bar.
  6. Click Import ADF.
  7. Specify the desired values.
  8. Click Import.

Related Topics


Importing a Management Pack Module

Management Pack modules contain computer grouping and processing rules, as well as other information. You can import Management Pack modules to use to monitor computers in the current configuration group.

To import a Management Pack module:

  1. Expand Microsoft Operations Manager (default) in the left pane.
  2. Expand Rules in the left pane.
  3. Click Processing Rule Groups in the left pane.
  4. Click Action on the menu bar.
  5. Click Import Management Pack module on the Action menu.
  6. Follow the instructions until you have finished importing a Management Pack module. For more information about the fields on a window, click Help.

Related Topics


Adding a Snap-In

The MOM Administrator Console contains Microsoft Operations Manager 2000 snap-ins. A snap-in manages a single configuration group. To manage more than one configuration group within a console, you can add more than one instance of a snap-in. For more information, see MOM Administrator Console Overview.

To add a snap-in:

  1. Click Console on the menu bar.
  2. Click Add/Remove Snap-in on the Console menu.
  3. Click Add.
  4. Click Operations Manager.
  5. Click Add.
    • If you want the snap-in to manage the configuration group database on the local computer, click Default configuration group for this computer.
    • If your enterprise is a Windows 2000 Active Directory environment, you can select the configuration group to be managed by clicking Another named configuration and selecting the configuration group from the drop-down list.
    • If you want the snap-in to manage the configuration group database on a different computer, click Another computer and specify the computer name where the database is located.
  6. Clear the check boxes for the Monitor, Rules, or Configuration snap-ins you do not want to install. All snap-ins are checked and installed by default.
  7. Click Finish, click Close, and then click OK.

Related Topics


Adding and Removing Columns

You can customize the right pane display by adding and removing columns and changing their order.

To add or remove columns:

  1. Expand Microsoft Operations Manager (default) in the left pane.
  2. Expand Monitor in the left pane.
  3. In the left pane, click the view you want to modify.
  4. Click View on the menu bar.
  5. Click Columns on the View menu.
    • If you want to add a column to the right pane, complete the following steps:
      1. Click the column name in the Available columns field.
      2. Click Add.
    • If you want to remove a column from the right pane, complete the following steps:
      1. Click the column name in the Displayed columns field.
      2. Click Remove.
    • If you want to change the order in which the columns are displayed, complete the following steps:
      1. Click a column name in the Displayed columns field. This column will change location in the right pane.
      2. Click Move Up or Move Down.
    • If you want to return the right pane to its default column settings, click Reset.

Related Topics


Displaying the Console Tree

The console tree is in the left pane of the console window, and shows the structure of all snap-ins.

To display the console tree:

  1. Click View on the menu bar.
  2. Select Console Tree.

To hide the console tree:

  1. Click View on the menu bar.
  2. Clear Console Tree.

Related Topics


Displaying the Description Bar

In a list view, the description bar provides the number of items in the result pane. In a page view, the description bar also provides page size, the number of items in a single page.

To display the description bar:

  1. Click View on the menu bar.
  2. Select Description Bar on the View menu.

To hide the description bar:

  1. Click View on the menu bar.
  2. Clear Description Bar on the View menu.

Related Topics


Displaying the Status Bar

The status bar, displayed at the bottom of the console window, provides contextual and current state information about menu items and views.

To display the status bar:

  1. Click View on the menu bar.
  2. Select Status Bar on the View menu.

To hide the status bar:

  1. Click View on the menu bar.
  2. Clear Status Bar on the View menu.

Related Topics


Displaying Toolbars

Toolbars display menus and buttons corresponding to menu items. You can choose to display or hide toolbars.

To display a toolbar:

  1. Click View on the menu bar.
  2. Click Toolbars on the View menu.
  3. Select one of the following toolbars:
    4. Standard menus | Displays standard MMC menus.
Standard buttons | Displays standard MMC buttons.
Snap-in menus | Displays menus specific to snap-ins.
Snap-in buttons | Displays buttons specific to snap-ins.

To hide a toolbar:

  1. Click View on the menu bar.
  2. Click Toolbars on the View menu.
  3. Clear the toolbar you want to hide.

Related Topics


Deleting a Snap-In

If a snap-in is no longer necessary, you can delete it from the MOM Administrator Console.

To delete a snap-in:

  1. Click Console on the menu bar.
  2. Click Add/Remove Snap-in on the Console menu.
  3. Click the snap-in you want to delete, click Remove, and then click OK.

Related Topics


Scheduling Database Grooming Jobs

You can change scheduled times for the default grooming jobs using SQL Server Enterprise Manager.

Warning

  • If you change the default scheduled times for database grooming, the new times must not interfere with other scheduled Microsoft Operations Manager 2000 tasks. For example, do not schedule a database grooming job for 2:05 A.M., the default time to scan for managed computers.

To change scheduled database grooming:

  1. Log on with an Administrator account to the computer on which you installed the database.
  2. Run Enterprise Manager from the Microsoft SQL Server folder.
  3. Expand SQL Server Group.
  4. Expand the server that contains the Microsoft Operations Manager 2000 database.
  5. Expand Management.
  6. Expand SQL Server Agent.
  7. Click Jobs in the left pane.
  8. Select the job you want to reschedule.
  9. Click Action.
  10. Click Properties.
  11. Select the Schedules tab.
  12. Click Edit on the Properties window.
  13. Click Change on the Edit Job Schedule window.
  14. Specify the desired values on the Edit Recurring Job Schedule window, and then click OK.
  15. Click OK on the Edit Job Schedule window.
  16. Click OK on the Properties window, and then click Yes.
  17. Close the SQL Server Enterprise Manager.

Related Topics


Disabling Database Reindexing Jobs

You can disable the OnePoint-Reindex and OnePoint-Reindex Event Table default database jobs using SQL Server Enterprise Manager. If you do not expand the database, allocating at least 40 percent free space, these jobs fail. The failure of the reindexing jobs does not affect your Microsoft Operations Manager 2000 implementation. If you disable the reindexing jobs, you will not experience the performance boost the jobs create.

To disable the database reindexing jobs:

  1. Log on with an Administrator account to the computer on which you installed the database.
  2. Run Enterprise Manager from the Microsoft SQL Server folder.
  3. Expand SQL Server Group.
  4. Expand the server that contains the database.
  5. Expand Management.
  6. Expand SQL Server Agent.
  7. Click Jobs in the left pane.
  8. Select the job in the right pane you want to disable.
  9. Click Action.
  10. Click Disable Job on the Action menu.
  11. Close the SQL Server Enterprise Manager.

Related Topics


Expanding Your Database

If your database needs to expand beyond the initial limits you specified for either the data file or the transaction log file, you can manually expand the database using SQL Server Enterprise Manager.

Warning

  • Do not use the automatic file growth option of SQL Server. Using this option may adversely affect the performance of your Microsoft Operations Manager 2000 implementation.

To expand your database:

  1. Log on with an Administrator account to the computer on which you installed the database.
  2. Run Enterprise Manager from the Microsoft SQL Server folder.
  3. Expand SQL Server Group.
  4. Expand the server that contains the database.
  5. Expand Databases.
  6. Click OnePoint.
  7. Click Action on the menu bar.
  8. Click Properties on the Action menu.
  9. Select the General tab on the Microsoft Operations Manager 2000 Properties window.
  10. Click the number in the Space Allocated column of the Database Files text box.

    11. This number is the size of the database data file in megabytes.

  11. Type the new size of the database data file.
  12. Select the Transaction Log tab on the Microsoft Operations Manager 2000 Properties window.
  13. Click the number in the Space Allocated column of the Transaction Log Files text box.

    14. This number is the size of the database transaction log file in megabytes.

  14. Type the new size of the database transaction log file, and then click OK.
  15. Close the SQL Server Enterprise Manager.

Related Topics


Creating an Alert Based on An Event

You can create a processing rule that will generate an alert based on an existing event. Creating a processing rule from an existing event in the Monitor snap-in requires your user account to be a member of the Operators (OnePointOp Operators) Windows NT user group. For more information, see Requirements and Permissions.

You can also create an alert based on an event in the Rules snap-in. For more information, see Creating an Event Processing Rule.

To create a processing rule based on an event in the Monitor:

  1. Expand Microsoft Operations Manager (default) in the left pane.
  2. Click Monitor in the left pane.
  3. Display the event. For more information, see Viewing Events.
  4. Click the event in the right pane.
  5. Click Action on the menu bar.
  6. Click New Processing Rule on the Action menu.
  7. Follow the instructions until you have completed defining a processing rule based on the selected event. For more information about the fields on a window, click Help.

Related Topics


Alerting on or Responding to an Event

To alert on or respond to a particular event, you must create an event rule. You can create an event rule when specific events are not covered by other processing rules.

For information about creating a processing rule based on an existing event, see Creating an Alert Based on an Event.

To create an event rule:

  1. Expand Microsoft Operations Manager (default) in the left pane.
  2. Expand Rules in the left pane.
  3. Expand Processing Rule Groups in the left pane.
  4. Expand the processing rule group to which you want to add the new event rule. For information about creating a processing rule group, see Creating a Processing Rule Group.
  5. Click Event Processing Rules in the left pane.
  6. Click Action on the menu bar.
  7. Click Alert on or Respond to Event on the Action menu.
  8. Follow the instructions until you have finished creating the event rule. For more information about the fields on a window, click Help.

Related Topics


Filtering an Event

To filter an event, you must create a filtering rule. A filtering rule is an event processing rule that identifies events you want Microsoft Operations Manager 2000 (MOM) to ignore. You can specify a type of filter:

Pre-filter | For events matching the filter, MOM stops evaluating further processing rules, and does not save matching events to the database.
Database filter | For events matching the filter, MOM continues evaluating processing rules, but does not save matching events to the database.
Conditional filter | For events matching the filter, MOM continues evaluating processing rules, but saves events to the database only if another processing rule match occurs.

To create a filtering rule:

  1. Expand Microsoft Operations Manager (default) in the left pane.
  2. Expand Rules in the left pane.
  3. Expand Processing Rule Groups in the left pane.
  4. Expand the processing rule group to which you want to add the new filtering rule. For information about creating a processing rule group, see Creating a Processing Rule Group.
  5. Click Event Processing Rules in the left pane.
  6. Click Action on the menu bar.
  7. Click Filter Event on the Action menu.
  8. Follow the instructions until you have completed creating the filtering rule. For more information about the fields on a window, click Help.

Related Topics


Detecting a Missing Event

To detect a missing event, you must create a missing event rule. A missing event rule is a type of event processing rule that identifies an event that should occur at a specified time. If the event does not occur, it is considered "missing" and you can define an alert or responses to occur.

To create a missing event rule:

  1. Expand Microsoft Operations Manager (default) in the left pane.
  2. Expand Rules in the left pane.
  3. Expand Processing Rule Groups in the left pane.
  4. Expand the processing rule group to which you want to add the new missing event rule. For information about creating a processing rule group, see Creating a Processing Rule Group.
  5. Click Event Processing Rules in the left pane.
  6. Click Action on the menu bar.
  7. Click Detect Missing Event on the Action menu.
  8. Follow the instructions until you have completed creating the missing event rule. For more information about the fields on a window, click Help.

Related Topics


Consolidating Similar Events (Consolidation Rule)

To consolidate events, you must create a consolidation rule. A consolidation rule is a type of event processing rule that specifies that multiple similar events on an agent computer will be grouped into one summary event and one normal event.

Consolidation rules do not provide responses or generate alerts. You can create other processing rules to generate alerts or provide responses for the summary event specified in a consolidation rule.

To create a consolidation rule:

  1. Expand Microsoft Operations Manager in the left pane.
  2. Expand Rules in the left pane.
  3. Expand Processing Rule Groups in the left pane.
  4. Expand the processing rule group to which you want to add the new consolidation rule. For information about creating a processing rule group, see Creating a Processing Rule Group.
  5. Click Event Processing Rules in the left pane.
  6. Click Action on the menu bar.
  7. Click Consolidate Similar Events on the Action menu.
  8. Follow the instructions until you have completed creating the consolidation rule. For more information about the fields on a window, click Help.

Related Topics


Collecting a Specific Event

To specify particular events to collect, you must create a collection rule. A collection rule is a type of event processing rule that identifies events with specified criteria to be collected from specified providers.

Collection rules do not provide responses or generate alerts. They simply identify events to collect. You can create other processing rules to generate alerts or provide responses for the events specified in collection rules.

To create an event collection rule:

  1. Expand Microsoft Operations Manager (default) in the left pane.
  2. Expand Rules in the left pane.
  3. Expand Processing Rule Groups in the left pane.
  4. Expand the processing rule group to which you want to add the new collection rule. For information about creating a processing rule group, see Creating a Processing Rule Group.
  5. Click Event Processing Rules in the left pane.
  6. Click Action on the menu bar.
  7. Click Collect Specific Events on the Action menu.
  8. Follow the instructions until you have completed creating the collection rule. For more information about the fields on a window, click Help.

Related Topics


Viewing Events

You can view all events that have occurred in the configuration group, or you can create custom views that let you specify the events you want to see.

To view events:

  1. Expand Microsoft Operations Manager (default) in the left pane.
  2. Expand Monitor in the left pane.
    • To view specific events, complete the following steps:
      1. Click Action on the menu bar.
      2. Click Find Events on the Action menu.
      3. Follow the instructions until you have finished creating an event view that displays the specified events.

Related Topics


Finding an Event

You can create custom views that display specific events.

To find an event:

  1. Expand Microsoft Operations Manager (default) in the left pane.
  2. Click Monitor in the left pane.
  3. Click Action on the menu bar.
  4. Click Find Events on the Action menu.
  5. Follow the instructions until you have finished creating a specified event view. For more information about the fields on a window, click Help.

Related Topics


Viewing Event Properties

You can view the properties for an event to learn more about it.

To view event properties:

  1. Expand Microsoft Operations Manager (deafult) in the left pane.
  2. Expand Monitor in the left pane.
  3. Display the event. For more information, see Viewing Events.
  4. Click the event in the right pane.
  5. Click Action on the Action menu.
  6. Click Properties on the Action menu.

Related Topics


Copying an Event

You can copy the text of an event to the Clipboard to be pasted within another application.

To copy event text to the Clipboard:

  1. Expand Microsoft Operations Manager (default) in the left pane.
  2. Expand Monitor in the left pane.
  3. Display the event. For more information, see Viewing Events.
  4. Click the event in the right pane.

    5. Note

    • You can use the Ctrl or Shift keys to select multiple events.

  5. Click Action on the menu bar.
  6. Click Copy to Clipboard on the Action menu.

Related Topics


Viewing Alerts Generated by an Event

You can view the alerts that have been generated by a specific event.

To view the alerts generated by an event:

  1. Expand Microsoft Operations Manager (default) in the left pane.
  2. Expand Monitor in the left pane.
  3. Display the event. For more information, see Viewing Events.
  4. Click the event in the right pane.
  5. Click Action on the menu bar.
  6. Click View Alerts on the Action menu.

Related Topics


Viewing the Today Window

The Today window provides current network monitoring statistics. To view the Today window, click Microsoft Operations Manager in the left pane.

Related Topics


Configuring Report Viewing From the Today Window

You can access HTML reports from the Today window and from the toolbar. HTML reports must be saved to the Web first. For more information, see Publishing HTML Reports.

Then you can specify the Web addresses where the reports are saved. For more information, see Configuring Web Addresses.


Pasting Within the Console

If you copy items within a Microsoft Operations Manager 2000 snap-in, you can paste them only within similar-item folders. For example, in the Rules snap-in, you can paste event processing rules in the Event Processing Rules folder, but not within the Performance Processing Rules folder.

You cannot copy or paste processing rule groups or notification groups in the Rules snap-in.

Copying and pasting are not supported within the Configuration snap-in.

To paste an item:

  1. After copying an item, click the folder in the left pane where you want to paste the item.
  2. Click Action on the menu bar.
  3. Click Paste on the Action menu.

    4. Note

    • If Paste is not available, you cannot paste the item you have copied into the selected folder. Click another folder.

Related Topics


Uninstalling the Product

You can remove all Microsoft Operations Manager 2000 components from your enterprise.

To uninstall Microsoft Operations Manager 2000:

  1. Delete all Managed Computer rules from all Agent Managers and uninstall all agents. For more information about deleting Managed Computer rules and permanently removing agents, see Uninstalling All Agents.
  2. On each computer containing a component other than an agent, use the Add/Remove Programs application in Control Panel to remove Microsoft Operations Manager. This step removes the following components:
    • Consolidator
    • DAS
    • Web Server
    • Web Console
    • MOM Administrator Console
    • MOM Reporting
  3. On the database computer, use Microsoft SQL Server to delete the database. For more information, see the Microsoft SQL Server documentation.

Related Topics


Sampling Performance Counters

To collect performance counter values on a regular basis, you must create a measuring rule. A measuring rule is a type of performance rule that specifies the collection of a numeric value from a WMI performance counter. You can view graphs created from this information.

To create a measuring rule:

  1. Expand Microsoft Operations Manager (default) in the left pane.
  2. Expand Rules in the left pane.
  3. Expand Processing Rule Groups in the left pane.
  4. Expand the processing rule group to which you want to add the new measuring rule. For information about creating a processing rule group, see Creating a Processing Rule Group.
  5. Click Performance Processing Rules in the left pane.
  6. Click Action on the menu bar.
  7. Click Sample Performance Data on the Action menu.
  8. Follow the instructions until you have completed creating the measuring rule. For more information about the fields on a window, click Help.

Related Topics


Defining a Threshold for a Performance Counter

To define a threshold for a performance counter, you must create a performance threshold rule. A threshold rule is a type of performance processing rule. It defines a value that can generate an alert and responses.

To create a threshold processing rule:

  1. Expand Microsoft Operations Manager (default) in the left pane.
  2. Expand Rules in the left pane.
  3. Expand Processing Rule Groups in the left pane.
  4. Expand the processing rule group to which you want to add the new threshold rule. For information about creating a processing rule group, see Creating a Processing Rule Group.
  5. Click Performance Processing Rules in the left pane.
  6. Click Action on the menu bar.
  7. Click Compare Performance Data on the Action menu.
  8. Follow the instructions until you have completed creating the threshold rule. For more information about the fields on a window, click Help.

Related Topics


Viewing Sampled Performance Data

You can view the data collected by performance measuring rules.

To view sampled performance data:

  1. Expand Microsoft Operations Manager (default) in the left pane.
  2. Expand Monitor in the left pane.
  3. Click All Performance in the left pane.
  4. In the right pane, click the computer with performance data you want to view.
  5. Click Action on the menu bar.
  6. Click View Performance on the Action menu.
    • If you want to graph performance items, see Graphing Performance Data.
    • If you want to create a specific performance view, see Creating a View.

Related Topics


Viewing Performance Counter Properties

You can view the properties of individual performance counters.

To view performance counter properties:

  1. Expand Microsoft Operations Manager (default) in the left pane.
  2. Expand Monitor in the left pane.
  3. Click All Performance in the left pane.
  4. In the right pane, click the computer with the performance counter whose properties you want to view.
  5. Click Action on the menu bar.
  6. Click View Performance on the Action menu.
  7. Click the performance counter with properties you want to view.
  8. Click Action on the menu bar.
  9. Click Properties on the Action menu.

Related Topics


Graphing Performance Data

You can graph sampled performance data in performance data views. You can view a performance data graph from the All Performance view, or from a custom performance data view. This topic includes steps for both views.

To view a graph of sampled performance data from the All Performance view:

  1. Expand Microsoft Operations Manager (default) in the left pane.
  2. Expand Monitor in the left pane.
  3. Click All Performance in the left pane.
  4. In the right pane, click the computer with performance data you want to graph.
  5. Click Action on the menu bar.
  6. Click View Performance on the Action menu.
    • If you want to set the time range for the graph, complete the following steps:
      1. Click Action on the menu bar.
      2. Click Properties on the Action menu.
      3. Select the Graph tab.
      4. Choose the time range options for the graph.
    • If you do not want the performance graph set as the default view, clear the Display performance graph as default view check box.
  7. Click the performance item you want to graph.
  8. Click Action on the menu bar.
  9. Click Add to Graph on the menu bar. The graph can display up to 33 items with accompanying graph legends.
  10. Click View on the menu bar.
  11. Select Graph on the View menu.
  12. To change the graph type, select a type from the Graph Type drop-down list.
  13. To print the graph, click Print.
  14. To copy the graph, click Copy to Clipboard.
    • If you want to view the list of performance items again, complete the following steps:
      1. Click View on the menu bar.
      2. Clear Graph on the View menu.

To view a graph of sampled performance data from a custom performance data view:

  1. Expand Microsoft Operations Manager (default) in the left pane.
  2. Expand Monitor in the left pane.
  3. Click the custom performance data view in the left pane.
    • If you want to set the time range for the graph, complete the following steps:
      1. Click Action on the menu bar.
      2. Click Properties on the Action menu.
      3. Select the Graph tab.
      4. Choose the time range options for the graph.
    • If you do not want the performance graph set as the default view, clear the Display performance graph as default view check box.
    • If you want to graph all performance counters in this view, complete the following steps:
      1. Click Action on the menu bar.
      2. Click Graph All Counters on the Action menu.
    • If you want to graph only selected performance items, complete the following steps:
      1. Click a performance item in the right pane.
      2. Click Action on the menu bar.
      3. Click Add to Graph on the menu bar.
      4. Click Action on the menu bar.
      5. Check Graph Selected Counters on the Action menu.
  4. To change the graph type, select a type from the Graph Type drop-down list.
  5. To print the graph, click Print.
  6. To copy the graph, click Copy to Clipboard.
    • If you want to view the list of performance items again, complete the following steps:
      1. Click View on the menu bar.
      2. Clear Graph on the View menu.

Related Topics


Associating a Processing Rule Group with a Computer Group

To enable agents to apply processing rules to the correct computers, you must associate a processing rule group with a computer group. Agents on computers within the computer group apply the rules in the processing rule group as necessary.

Note

  • If you have a child processing rule group, which is a processing rule group contained within another processing rule group, you might want to associate computer groups to the child processing rule group.

To associate a processing rule group with a computer group:

  1. Expand Microsoft Operations Manager (default) in the left pane.
  2. Expand Rules in the left pane.
  3. Expand Processing Rule Groups in the left pane.
  4. In the right pane, click the processing rule group you want to associate with a computer group.
  5. Click Action on the menu bar.
  6. Click Associate with Computer Group on the Action menu.
  7. Follow the instructions on the Computer Groups tab. For more information about the fields on a window, click Help.

Related Topics


Viewing Processing Rule Group Properties

You can view, modify, and print the properties of a processing rule group, including knowledge base and computer group information. You can view the properties of a processing rule group in two ways. The Processing Rule Group Properties window allows you to view and modify the properties. The right pane HTML report allows you to view and print properties. You cannot modify processing rule group properties in the HTML report.

To view processing rule group properties in the Processing Rule Group Properties window:

  1. Expand Microsoft Operations Manager (default) in the left pane.
  2. Expand Rules in the left pane.
  3. Expand Processing Rule Groups in the left pane.
  4. In the left pane, click the processing rule group with properties you want to view.
  5. Click Action on the menu bar.
  6. Click Properties on the menu bar.

To view processing rule group properties in an HTML report in the right pane:

  1. Expand Microsoft Operations Manager (default) in the left pane.
  2. Expand Rules in the left pane.
  3. Expand Processing Rule Groups in the left pane.
  4. In the left pane, click the processing rule group with properties you want to view. The processing rule group properties will appear in the right pane.
  5. Click the Expand/Collapse all subprocessing rule groups button on the toolbar.
    6. Expand/Collapse all subprocessing rule groups button
    Expands the view in the right pane to include child processing rule group properties.

Related Topics


Creating a Processing Rule Group

Processing rule groups contain processing rules. Creating different processing rule groups allows you to categorize processing rules. You can also create child groups, which are processing rule groups within a processing rule group.

To create a processing rule group:

  1. Expand Microsoft Operations Manager (default) in the left pane.
  2. Expand Rules in the left pane.
  3. Click Processing Rule Groups in the left pane.
  4. Click Action on the menu bar.
  5. Click Create Processing Rule Group on the Action menu.
  6. Follow the instructions until you have finished creating the processing rule group. For more information about the fields on a window, click Help. The following folders are created automatically within the processing rule group:
    • Event Processing Rules
    • Alert Processing Rules
    • Performance Processing Rules

Related Topics


Modifying Processing Rule Group Properties

You can modify processing rule group properties, including the company knowledge base and associated computer groups.

To modify processing rule group properties:

  1. Expand Microsoft Operations Manager (default) in the left pane.
  2. Expand Rules in the left pane.
  3. Expand Processing Rule Groups in the left pane.
  4. In the left pane, click the processing rule group with properties you want to modify.
  5. Click Action on the menu bar.
  6. Click Properties on the menu bar.
  7. Specify the desired values on the Properties tabs, and then click OK.

Related Topics


Creating a Processing Rule Group

Adding a Child Processing Rule Group

You can add a child processing rule group to a parent processing rule group. Child groups are processing rule groups within a processing rule group.

When a child processing rule group is added from another processing rule group, it is added as a shared child processing rule group and is shared between the two parent rule groups. When a processing rule group is added as a child at the same level as the parent processing rule group, it is moved under the new parent as a child, and is not shared.

To add a child processing rule group:

  1. In the left pane, expand Microsoft Operations Manager (default).
  2. In the left pane, expand Rules.
  3. In the left pane, click Processing Rule Groups.
  4. Click the parent processing rule group.
  5. On the menu bar, click Action.
  6. On the Action menu, click All Tasks.
  7. On the All Tasks menu, click Add Child Processing Rule Group.
  8. Select the child processing rule group that you want to add, and then click OK.

Related Topics


Disabling a Processing Rule Group

You can disable a processing rule group to temporarily stop its processing rules from being evaluated on monitored computers. Child processing rule groups that are not individually associated with computer groups are also disabled. If child processing groups are individually associated with computer groups, they are not disabled.

To disable a processing rule group:

  1. Expand Microsoft Operations Manager (default) in the left pane.
  2. Expand Rules in the left pane.
  3. Expand Processing Rule Groups in the left pane.
  4. In the left pane, click the processing rule group that you want to disable.
  5. Click Action on the menu bar.
  6. Click Properties on the Action menu.
  7. Clear the Enabled check box, and then click OK.

Related Topics


Deleting a Processing Rule Group

If a processing rule group is no longer required, you can delete it. All rules within the group are also deleted.

Note

  • In many instances, you must refresh the Processing Rule Groups folder to see your changes.

To delete a processing rule group:

  1. Expand Microsoft Operations Manager (default) in the left pane.
  2. Expand Rules in the left pane.
  3. Click Processing Rule Groups in the left pane.
  4. Click the processing rule group in the right pane that you want to delete.
  5. Click the Action menu.
  6. Click Delete on the Action menu.
    • If you are deleting a parent rule group, click Yes. Child groups are not deleted. Child groups are moved to the top level of the rule group hierarchy.
    • If you are deleting a child rule group, click one of the following options:
      • Delete the relationship with the parent rule group. The rule group is not deleted.
      The selected processing rule group is moved up to the top level in the rule group hierarchy. It is not deleted. If the child rule group is the child of a second rule group, the child group is displayed only in the hierarchy of the second rule group.
      Delete the rule group. Do not delete child rule groups.
      The selected rule group is deleted. Child rule groups are not deleted but are now displayed at the top level, unless the child rule group is the child of a second rule group. If the child rule group is the child of a second rule group, the child group is displayed only in the hierarchy of the second rule group.
  7. Click Processing Rule Groups in the left pane.
  8. Click the Action menu.
  9. Click Refresh on the Action menu.

Related Topics


Printing a Processing Rule Group Report

You can print a detailed report of a processing rule group.

To print the report of a processing rule group:

  1. Expand Microsoft Operations Manager (default) in the left pane.
  2. Expand Rules in the left pane.
  3. Expand Processing Rule Groups in the left pane.
  4. Select a processing rule group in the left pane.
  5. Click Print in the right pane.

Warning

  • If you have expanded all child processing rule groups and processing rules within a processing rule group in the right pane, the resulting printed report may be prohibitive in length. If you wish to print a report for all rules in a processing rule group, select the lowest level child processing rule group in the left pane and expand and print the report in the right pane.

Related Topics


Disabling Processing Rule Group Report

When you click a processing rule group in the left pane the right pane displays a detailed report on the processing rule group properties, child processing rule groups, and rules. It may take a moment for the report to display. You can disable the report display.

To disable the display of the processing rule group report and display only the list of child processing rule groups:

  1. Expand Microsoft Operations Manager (default) in the left pane.
  2. Click Rules in the left pane.
  3. Click Action on the menu bar.
  4. Click Properties on the menu bar.
  5. Clear the Enable check box.


Viewing Processing Rule Properties

You can view and modify the properties of a processing rule, including knowledge base and scheduling information.

To view processing rule properties in the Processing Rule Properties window:

  1. Expand Microsoft Operations Manager (default) in the left pane.
  2. Expand Rules in the left pane.
  3. Expand Processing Rule Groups in the left pane.
  4. Expand the Management Pack module in the left pane that contains the processing rule you want to view.
  5. Click the processing rule group in the left pane that contains the processing rule you want to view.
  6. In the right pane, click the processing rule with properties you want to view.

Related Topics


Finding Processing Rules

You can search the database to find a specific processing rule or rules that match a specific search criteria. You search for rules by name, date last modified, or by the specified rule response.

To find a specific processing rule:

  1. Expand Microsoft Operations Manager (default) in the left pane.
  2. Expand Rules in the left pane.
  3. Expand Processing Rule Groups in the left pane.
  4. Click a processing rule group in the left pane.
  5. Click Action on the menu bar.
  6. Click Find Processing Rules on the Action menu.
  7. Follow the instructions until you have finished specifying the search criteria. For more information about the fields on a window, click Help.

Related Topics


Creating an Event Processing Rule

Event processing rules define what Microsoft Operations Manager 2000 (MOM) will do with specified events.

To create an event processing rule:

  1. Expand Microsoft Operations Manager (default) in the left pane.
  2. Expand Rules in the left pane.
  3. Expand Processing Rule Groups in the left pane.
  4. Expand the processing rule group to which you want to add an event processing rule. For information about creating a processing rule group, see Creating a Processing Rule Group.
  5. Click Event Processing Rules in the left pane.
  6. Click Action on the menu bar.
  7. Click one of the following items on the Action menu:
    8. Alert on or Respond to Event
    Specifies that you want MOM to generate an alert or run a response when specific events occur. You can create event rules when certain events are not covered in other processing rules.
    Filter Event
    Specifies whether you want MOM to ignore specified events. Filtering rules typically identify events that you do not consider significant.
    Detect Missing Event
    Specifies that MOM generates an alert or a response when particular events do not occur during a specified time.
    Consolidate Similar Events
    Specifies that MOM groups multiple similar events on an agent computer into a single summary event.
    Collect Specific Events
    Identify events with specific criteria to be collected from specific sources. Collection rules do not provide responses or generate alerts.
  8. Follow the instructions until you have finished creating an event processing rule. For more information about the fields on a window, click Help.

Related Topics


Creating an Alert Processing Rule

An alert processing rule allows you to specify a response for an alert or for a number of previously defined alerts.

To create an alert processing rule:

  1. Expand Microsoft Operations Manager (default) in the left pane.
  2. Expand Rules in the left pane.
  3. Expand Processing Rule Groups in the left pane.
  4. Expand the processing rule group to which you want to add an alert processing rule. For information about creating a processing rule group, see Creating a Processing Rule Group.
  5. Click Alert Processing Rules in the left pane.
  6. Click Action on the menu bar.
  7. Click Respond to Alert on the Action menu.
  8. Follow the instructions until you have finished creating an alert processing rule. For more information about the fields on a window, click Help.

Related Topics


Creating a Performance Processing Rule

Performance processing rules define how Microsoft Operations Manager 2000 (MOM) processes performance counter data.

To create a performance processing rule:

  1. Expand Microsoft Operations Manager (default) in the left pane.
  2. Expand Rules in the left pane.
  3. Expand Processing Rule Groups in the left pane.
  4. Expand the processing rule group to which you want to add a performance processing rule. For information about creating a processing rule group, see Creating a Processing Rule Group.
  5. Click Performance Processing Rules in the left pane.
  6. Click Action on the menu bar.
  7. Click one of the following items on the Action menu:
    8. Sample Performance Data
    Specifies that MOM collects a numeric value from WMI performance counters. You can graph this information.
    Compare Performance Data
    Specifies that MOM generates an alert when a performance counter value crosses a defined threshold in either direction. Threshold rules can also define a response.
  8. Follow the instructions until you have finished creating a performance processing rule. For more information about the fields on a window, click Help.

Related Topics


Modifying Processing Rule Properties

You can modify the properties of a processing rule, including knowledge base and scheduling information.

To modify processing rule properties:

  1. Expand Microsoft Operations Manager (default) in the left pane.
  2. Expand Rules in the left pane.
  3. Expand Processing Rule Groups in the left pane.
  4. Expand the processing rule group containing the processing rule you want to modify.
  5. Click the Event, Alert, or Performance Processing Rules folder containing the processing rule you want to modify.
  6. In the right pane, click the processing rule you want to modify.
  7. Click Action on the menu bar.
  8. Click Properties on the Action menu.
  9. Specify the desired values on the Properties tabs, and then click OK.

Related Topics


Disabling a Processing Rule

You can disable a processing rule to temporarily stop it from being evaluated on monitored computers.

To disable a processing rule:

  1. Expand Microsoft Operations Manager (default) in the left pane.
  2. Expand Rules in the left pane.
  3. Expand Processing Rule Groups in the left pane.
  4. In the left pane, expand the processing rule group that contains the processing rule you want to disable.
  5. In the left pane, click the Event, Alert, or Performance Processing Rules folder that contains the processing rule you want to disable.
  6. In the right pane, click the processing rule you want to disable.
  7. Click Action on the menu bar.
  8. Click Properties on the Action menu.
  9. Clear the Enabled check box, and then click OK.

Related Topics


Copying a Processing Rule

You can copy a processing rule in one processing rule group and paste it within another. You can copy a processing rule and modify its properties to create a new processing rule. You can copy and paste a processing rule within a single Rules snap-in or into a Rules snap-in for another configuration group.

Note

  • You can paste a processing rule only within a folder containing its type of rule: Event, Alert, or Performance Processing Rules.

To copy a processing rule:

  1. Expand Microsoft Operations Manager (default) in the left pane.
  2. Expand Rules in the left pane.
  3. Expand Processing Rule Groups in the left pane.
  4. Expand the processing rule group containing the processing rule you want to copy.
  5. In the left pane, click the Event, Alert, or Performance Processing Rules node containing the rule you want to copy.
  6. In the right pane, click the rule that you want to copy.
  7. Click the Action menu.
  8. Click Copy on the Action menu.
  9. In the left pane, click the Event, Alert, or Performance Processing Rules node where you want to paste the rule.
  10. Click the Action menu.
  11. Click Paste on the Action menu.

    12. Note

    • In some instances, you might need to refresh the view to see the rule pasted in the new location.

Related Topics


Deleting a Processing Rule

If a processing rule is no longer required, you can delete it.

To delete a processing rule:

  1. Expand Microsoft Operations Manager (default) in the left pane.
  2. Expand Rules in the left pane.
  3. Expand Processing Rule Groups in the left pane.
  4. Expand the processing rule group containing the processing rule you want to delete.
  5. Click the Event, Alert, or Performance Processing Rules node containing the rule you want to delete.
  6. In the right pane, click the rule that you want to delete.
  7. Click the Action menu.
  8. Click Delete on the Action menu.
  9. Click Yes.

Related Topics


Exporting Processing Rules

You can export processing rules as Management Pack modules for backup purposes or to use in other configuration groups.

To export processing rules:

  1. Expand Microsoft Operations Manager (default) in the left pane.
  2. Expand Rules in the left pane.
  3. Expand Processing Rule Groups in the left pane.
  4. Click the processing rule group containing rules you want to export.
  5. Click Action on the menu bar.
  6. Click Export Management Pack module on the Action menu.
  7. Specify the desired values, and then click. OK.

Related Topics


Forcing Processing Rule Changes

When you create, edit, or delete processing rules, Microsoft Operations Manager 2000 (MOM) automatically ensures that these changes are sent to the Consolidator, depending on the Consolidator polling interval. Agents receive the changes from the Consolidator at the next heartbeat. We recommend that you allow MOM to automatically send the changes to the Consolidator. You can, however, send the changes to the Consolidator on demand.

To force processing rule changes to the Consolidator:

  1. Expand Microsoft Operations Manager (default) in the left pane.
  2. Click Rules in the left pane.
  3. Click Action on the menu bar.
  4. Click Force Configuration Changes Now on the Action menu.
  5. Click Close.

Related Topics


Creating a Data Provider

A data provider is a source of collected information. You create providers to be used when creating processing rules.

To create a data provider:

  1. Expand Microsoft Operations Manager (default) in the left pane.
  2. Expand Rules in the left pane.
  3. Expand Advanced in the left pane.
  4. Click Providers in the left pane.
  5. Click Action on the menu bar.
  6. Click New on the Action menu.
  7. Click Provider.
  8. Follow the instructions until you have finished creating a new data provider. For more information about the fields on a window, click Help.

Related Topics


Viewing Data Provider Properties

You can view properties for most data providers. Some providers, such as the Generic provider, do not have properties to view.

To view data provider properties:

  1. Expand Microsoft Operations Manager (default) in the left pane.
  2. Expand Rules in the left pane.
  3. Expand Advanced in the left pane.
  4. Click Providers in the left pane.
  5. In the right pane, click the data provider with properties you want to view.
  6. Click Action on the menu bar.
  7. Click Properties on the Action menu.

Related Topics


Modifying Data Provider Properties

You can modify properties for most data providers. You cannot modify some predefined providers.

To modify data provider properties:

  1. Expand Microsoft Operations Manager (default) in the left pane.
  2. Expand Rules in the left pane.
  3. Expand Advanced in the left pane.
  4. Click Providers in the left pane.
  5. In the right pane, click the data provider with properties you want to modify.
  6. Click Action on the menu bar.
  7. Click Properties on the Action menu.
  8. Specify the desired values, and then click OK.

Related Topics


Deleting a Data Provider

You can delete most data providers if they are no longer required by processing rules. You cannot delete some predefined data providers.

To delete a data provider:

  1. Expand Microsoft Operations Manager (default) in the left pane.
  2. Expand Rules in the left pane.
  3. Expand Advanced in the left pane.
  4. Click Providers in the left pane.
  5. In the right pane, click the provider that you want to delete.
  6. Click the Action menu.
  7. Click Delete on the Action menu.
  8. Click Yes.

Related Topics


Copying a Data Provider

You can copy a provider, paste it, and modify its properties to create a new provider. You can copy and paste a provider within the current Rules snap-in or into a Rules snap-in for another configuration group.

To copy a provider:

  1. Expand Microsoft Operations Manager (default) in the left pane.
  2. Expand Rules in the left pane.
  3. Expand Advanced in the left pane.
  4. Click Providers in the left pane.
  5. In the right pane, click the data provider you want to copy.
  6. Click Action on the menu bar.
  7. Click Copy on the Action menu.
  8. Click Providers in the left pane. You can paste a provider only into a Providers folder in a Rules snap-in.
  9. Click Action on the menu bar.
  10. Click Paste on the Action menu.

Related Topics


Creating a Notification Group

Notification groups include operators that you can schedule to receive e-mail, page, or command notifications. Operators can belong to more than one notification group.

To create a notification group and include operators

  1. In the left pane, expand Microsoft Operations Manager (default).
  2. In the left pane, expand Rules.
  3. In the left pane, expand Notification Groups.
  4. On the menu bar, click Action.
  5. On the Action menu, click Create Notification Group .
  6. Type an appropriate name for the group.
  7. If you want to add an existing operator to the group, complete the following steps:
    • From the Available operators list, select the operator name.
    • Click the bottom arrow to move the name to the Group operators list.
  8. On the Notification Group Properties window, click Finish.

Creating a New Operator

To create a new operator

  1. In the left pane, expand Rules, expand Advanced, and then select New Operator.
  2. Type a name or description of the operator.
  3. Follow the instructions until you have finished creating an operator. For more information about the fields on a window, click Help.

    4. Related Topics


Deleting a Notification Group

If a notification group is no longer required by processing rules, you can delete it. If you delete a notification group used within a processing rule, the notifications will not occur.

To delete a notification group:

  1. Expand Microsoft Operations Manager (default) in the left pane.
  2. Expand Rules in the left pane.
  3. Expand Notification Groups in the left pane.
  4. Click the notification group in the right pane that you want to delete.
  5. Click the Action menu.
  6. Click Delete on the Action menu.
  7. Click Yes.

Related Topics


Adding an Operator to a Notification Group

Adding an operator to a notification group ensures that the operator receives notifications. An operator can belong to more than one notification group.

To add an operator to a notification group

  1. In the left pane, expand Microsoft Operations Manager (default).
  2. In the left pane, expand Rules.
  3. In the left pane, expand Notification Groups.
  4. In the left pane, click the notification group that you want to add an operator to.
  5. On the menu bar, click Action.
  6. On the Action menu, click Properties.
  7. If you want to add an existing operator to the group:
    • From the Available operators list, select the operator name.
    • Click the top arrow to move the name to the Group operators list.

Creating a New Operator

To create a new operator

  1. In the left pane, expand Rules, expand Advanced, and then select New Operator.
  2. Type a name or description of the operator.
  3. Follow the instructions until you have finished creating an operator. For more information about the fields on a window, click Help.

    4. Related Topics


Modifying an Operator

You can change the properties of a notification group operator, including the e-mail, page, and command notification options. An operator can belong to more than one notification group.

To modify operator properties:

  1. Expand Microsoft Operations Manager (default) in the left pane.
  2. Expand Rules in the left pane.
  3. Expand Notification Groups in the left pane.
  4. In the left pane, select a notification group to which the operator belongs.
  5. Select the operator in the right pane.
  6. Click Action on the menu bar.
  7. Click Properties on the Action menu.
  8. Specify the desired values on the Operator Properties tabs. For more information about the fields on a window, click Help.

Related Topics


Copying an Operator

You can copy an operator, paste it in a notification group, and modify its properties to create a new operator. You can copy and paste an operator within the current Rules snap-in or into a Rules snap-in for another configuration group.

To copy an operator:

  1. Expand Microsoft Operations Manager (default) in the left pane.
  2. Expand Rules in the left pane.
  3. Expand Notification Groups in the left pane.
  4. In the left pane, click the notification group containing the operator you want to copy.
  5. In the right pane, click the operator you want to copy.
  6. Click Action on the menu bar.
  7. Click Copy on the Action menu.
  8. Click Notification Groups in the left pane. You can paste an operator only into a notification group in a Rules snap-in.
  9. Click Action on the menu bar.
  10. Click Paste on the Action menu.

Related Topics


Deleting an Operator From a Notification Group

You can remove an operator from only one notification group, or delete the operator record to remove the operator from all notification groups.

To delete or remove an operator:

  1. Expand Microsoft Operations Manager (default) in the left pane.
  2. Expand Rules in the left pane.
  3. Expand Notification Groups in the left pane.
  4. In the left pane, click the notification group from which you want to delete an operator.
  5. Click the operator you want to delete.
  6. Click Action on the menu bar.
  7. Click Delete on the Action menu.
    • If you want to remove the operator only from the selected notification group, click Remove this operator from the current notification group. This option removes the operator from the current notification group, but does not delete the operator record.
    • If you want to delete the operator from all notification groups, click Delete operator. This option removes the operator from all notification groups and deletes the operator record.

Related Topics


Creating a Script

You can use scripts within processing rules. They can run as responses or on a timed basis.

To create a script within Microsoft Operations Manager:

  1. Expand Microsoft Operations Manager (default) in the left pane.
  2. Expand Rules in the left pane.
  3. Expand Advanced in the left pane.
  4. Click Scripts in the left pane.
  5. Click Action on the menu bar.
  6. Click Create New Script on the menu bar.
  7. Follow the instructions until you have finished creating a script. For more information about the fields on a window, click Help.

Related Topics


Modifying a Script

You can modify a script, including its source code and parameters, when necessary.

To modify a script:

  1. Expand Microsoft Operations Manager (default) in the left pane.
  2. Expand Rules in the left pane.
  3. Expand Advanced in the left pane.
  4. Click Scripts in the left pane.
  5. In the right pane, click the script that you want to modify.
  6. Click the Action menu.
  7. Click Properties on the Action menu.
  8. Specify the desired values on the Properties tabs, and then click OK.

Related Topics


Deleting a Script

If a script is no longer required by a processing rule, you can delete it. You cannot delete a script that is referenced by a processing rule. You must first delete the reference to the script from the processing rule.

To delete a script:

  1. Expand Microsoft Operations Manager (default) in the left pane.
  2. Expand Rules in the left pane.
  3. Expand Advanced in the left pane.
  4. Click Scripts in the left pane.
  5. Click the script in the right pane that you want to delete.
  6. Click the Action menu.
  7. Click Delete on the Action menu.
  8. Click Yes.

Related Topics


Copying a Script

You can copy a script, paste it, and modify it to create a new script. You can copy and paste a script within the current Rules snap-in or into a Rules snap-in for another configuration group.

  1. Expand Microsoft Operations Manager (default) in the left pane.
  2. Expand Rules in the left pane.
  3. Expand Advanced in the left pane.
  4. Click Scripts in the left pane.
  5. In the right pane, click the script that you want to copy.
  6. Click the Action menu.
  7. Click Copy on the Action menu.
  8. Click Scripts in the left pane. You can paste scripts only into a Scripts folder in a Rules snap-in.
  9. Click the Action menu.
  10. Click Paste.

Related Topics


Adding An ODBC Data Source

MOM Reporting allows you to select, view, and print reports from more than one Microsoft Operations Manager 2000 database.

To add a new ODBC data source:

  • Double-click Administrative Tools in Control Panel.

Related Topics


Archiving HTML Reports

In MOM Reporting, you can archive HTML reports for future use.

Use archived reports for comparison to help you understand changes or operational issues that affect your network. Archived reports can help you diagnose problems and maintain a history of operational changes.

  • From the Start menu, point to Programs, Microsoft Operations Manager, and then to MOM Reporting.
  • Open the Tools menu.
  • Select Archive Previous Report(s).
  • In the Archive Previous Report(s) dialog box, select Archive previously generated HTML report(s) and click OK.
Note You can also archive reports when using batch files to generate reports. For details refer to Using the Command Line Interface and Using the Command Line Wizard.

Related Topics


Automating Report Generation

MOM Reporting provides a command-line interface. This interface allows you to automate the report generation process. For example, you can create a batch file that contains the commands to generate the reports you want. Then, you can use the Windows Task Scheduler, as explained in Scheduling Report Generation, to run that batch file at scheduled times.

MOM Reporting also provides a wizard that allows you to create a batch file with a command to generate specific reports. You can use the wizard to create the batch file and see what options are required to generate a specific report. You can also run the wizard several times, saving each command to a separate batch file, and then combine the commands into one batch file.

To generate multiple reports from a batch file, prefix each command in the file with the START/WAIT command. For more information about the START /WAIT command, see the MS-DOS help.

To automate report generation:

  1. Set the options for saving HTML reports to identify the correct location to save the generated reports.
  2. Create a batch file with the commands to generate the reports you want. For more information, see:
    • Using the Command-Line Interface
    • Using the Command-Line Wizard
  3. Use Windows Task Scheduler, as explained in Scheduling Report Generation,to run the batch file at scheduled times.

Related Topics


Configuring Internet Explorer for Viewing Published Web Reports

To allow Internet Explorer to display published Web reports, change the default settings for the Local intranet security level. The default settings do not allow Internet Explorer to download the unsigned ActiveX control needed to display the Web reports.

To configure Internet Explorer for viewing published Web reports:

  1. Start Internet Explorer from the Programs menu.
  2. Select Tools on the Internet Explorer taskbar.
  3. Select Internet Options from the Tools menu.
  4. Click the Security tab on the Internet Options window.
  5. Click Local intranet.
  6. Click Custom Level.
  7. Select Medium in the Reset to list box.
  8. Click Reset.
  9. Click Yes.
  10. Select Prompt for the Download unsigned ActiveX controls setting.
  11. Click OK on the Security Settings window.
  12. Click Yes.
  13. Click OK on the Internet Options window.
  14. Close Internet Explorer.

Related Topics


Configuring Automatically Published Reports

MOM Reporting allows you to publish reports (saved as HTML) and make them available through the MOM Administrator Consoles and the Web Console. You can also configure Microsoft Operations Manager 2000 (MOM) to automatically generate and publish reports.

MOM provides flexible components that allow you to setup your configuration groups in many ways. The MOM setup program creates directories and sets several configuration values to support HTML report generation and publication. To automatically generate reports and make them available in the MOM Administrator Console and the Web Console, you should understand these settings. For more information about these default settings, see Report Publishing.

To configure MOM to automatically publish reports:

  1. If the Web Console server and MOM Reporting are installed on different computers, set the MOM Reporting virtual directory on your Web Console server to point to the directory on the MOM Reporting server that you have designated for saving HTML reports.
  2. Set the Web Console server virtual directory locations in the database by completing the following steps:
    • Expand Microsoft Operations Manager (default) in the left pane of the MOM Administrator Console.
    • Expand Configuration in the left pane.
    • Click Global Settings in the left pane.
    • Click Web Addresses in the right pane.
    • Click Action on the menu bar.
    • Click Properties on the Action menu.
    • Specify the computer name and virtual directory for the Web Console server (computer/OnePointOperations) and MOM Reporting (computer/Reporting), and then click OK.
  3. Add the users who should be able to view the reports to the OnePointOp MOM Reporting group. This group enables users to view the data in the database.
  4. Create a batch file that contains the commands to generate the reports you want to publish. For more information, see Using the Command-Line Interface.
  5. Set the HTML properties for MOM Reporting on the Web Console server to store the generated reports in the Reports directory on the local computer. The MOM Reporting virtual directory points to the Reports directory. For more information, see Setting Options for Saving HTML Reports.
  6. Set the following required permissions for the scheduler service you will use to run the batch file you created:
    • Write permission for the Reports directory on the local computer.
    • Permission to run the batch file you created.
  7. Use Windows Task Scheduler, as explained in Scheduling Report Generation, to run the batch file at scheduled times.

Related Topics


Ensuring Reports Have the Data You Need

Before you generate a report, you may need to change some configuration settings to provide the report with the required data. For example, you must enable Windows 2000 auditing for Security reports to receive the required auditing data.

The Management Pack Module Configuration Guide (Management Pack Module Configuration Guide.pdf, located on the Microsoft Operations Manager 2000 product CD) provides configuration instructions for specific reports. This document is provided in the setup kit, and is copied to the MOM Administrator Console or MOM Reporting computer during installation, typically in the Program Files\Microsoft Operations Manager 2000\OnePoint\Doc directory.

Configuration information is also provided in the KnowledgeBase for each Management Pack module. If specific configuration steps are required for associated reports, the steps are provided in the KnowledgeBase and in the Management Pack Module Configuration Guide.

If you have multiple configuration groups (multiple databases), you may also need to select the data source for the database from which you want to view data. For more information, see Selecting a Data Source.


Making Reports Available in the MOM Administrator Console and Web Console

MOM Reporting allows you to publish reports (saved as HTML) and make them available through the MOM Administrator Consoles and the Web Console. You can also configure Microsoft Operations Manager 2000 (MOM) to automatically generate and publish reports to HTML files or to a printer. For more information, see Configuring Automatically Published Reports.

MOM provides flexible components that allow you to setup your configuration groups in many ways. The MOM setup program creates directories and sets several configuration values to support HTML report generation and publication. To make reports available in the MOM Administrator Console and the Web Console, you should understand these settings. For more information about these default settings, see Report Publishing.

To make reports available in the MOM Administrator Console and the Web Console:

  1. Make sure the Web Console server, MOM Reporting, and DAS are installed on the same computer. If the DAS is not installed on the Web Console server, use Internet Services Manager to change the authentication method on the MOM and MOM Reporting virtual directories to Basic Authentication.
  2. Set the Web Console server virtual directory locations in the database by completing the following steps:
    1. Expand Microsoft Operations Manager (default) in the left pane of the MOM Administrator Console.
    2. Expand Configuration in the left pane.
    3. Click Global Settings in the left pane.
    4. Click Web Addresses in the right pane.
    5. Click Action on the menu bar.
    6. Click Properties on the Action menu.
    7. Specify the computer name and virtual directory for the Web Console server (computer/OnePointOperations) and MOM Reporting (computer/Reporting).
    8. Click OK.
  3. Add the users who should be able to view the reports to the OnePointOp MOM Reporting group. This group enables users to view the data in the database.
  4. Publish the desired reports to the Web Console server. For more information, see Publishing HTML Reports.

Note

  • You can automate the process of generating and publishing reports. For more information, see:
    • Automating Report Generation
    • Configuring Automatically Published Reports

Related Topics


Opening MOM Reporting

After you install MOM Reporting, you can start the tool from the Microsoft Operations Manager 2000 program group. You can also start MOM Reporting from within the Monitor snap-in. For more information, see Opening MOM Reporting through the MOM Administrator Console.

To open MOM Reporting:

  1. Click Start.
  2. Click Programs on the Start menu.
  3. Click Microsoft Operations Manager on the Programs menu.
  4. Click MOM Reporting on the Microsoft Operations Manager menu.

If you have not selected a data source, MOM Reporting displays a message window that prompts you to select a data source. Before you can view a report, you need to select a data source.

Note

  • The data source must be configured for integrated security. In addition, your user account must be a member of the OnePointOp MOM Reporting group. This group provides Read access to all the data used by MOM Reporting.

Opening MOM Reporting through the MOM Administrator Console

You can also start MOM Reporting from within the Monitor snap-in.

To open MOM Reporting from within the Monitor:

  1. Click Monitor or any other Monitor item in the left pane.
  2. Click Action on the menu bar.
  3. Click View Reports on the Action menu.
    • If MOM Reporting is installed on the local computer and reports are published on the Web, you will be prompted to select which reports you want to view. To open MOM Reporting, select the reports on the local computer.

Related Topics


Publishing HTML Reports

By default, any reports you save in HTML format are stored in subdirectories of the Program Files\Microsoft Operations Manager 2000\Event\Reports folder on the local computer. The navigation file, Default.htm, that allows you to access the reports you save in HTML format is also stored in this folder. You can use the Default.htm file to quickly view a report on the local computer without launching MOM Reporting. You can also change where these files are stored. For more information, see Setting Options for Saving HTML Reports.

You can also make HTML-formatted reports available through the Web Console and the MOM Administrator Console. Simply save the reports in HTML format to the Reports folder on the computer with both the Web Console server and MOM Reporting installed. For more information, see Making Reports Available in the MOM Administrator Console and Web Console.

To publish HTML reports:

  1. Set the options for saving HTML reports to identify the correct location to save the generated reports. The folder you specify should have the default MOM Reporting navigation and style files. By default, the setup program installs these files in the Program Files\Microsoft Operations Manager 2000\Event\Reports folder. If you specify the Reports folder on the computer with both the Web Console server and MOM Reporting installed, the published reports will be available through the Web Console and the MOM Administrator Console.
    • If you are publishing HTML reports to view outside the Web Console or MOM Administrator Console, complete the following steps:
      1. Grant Read permissions for the appropriate users on the folder where you will publish the reports.
      2. If the computer has Microsoft IIS installed, you can create a virtual directory for the folder where the Default.htm file and the other report files are stored. For more information about creating a virtual directory, see the IIS documentation.
      3. If the computer does not have IIS installed, you can create a share for the folder where the Default.htm file and the other report files are stored.
  2. Save the desired reports in HTML format. For more information, see Automating Report Generation or Viewing or Printing Multiple Reports.
  3. Tell the users how to access the Default.htm file for the reports you saved as HTML. For more information, see Viewing or Printing Published Web Reports

Related Topics


Scheduling Report Generation

You can configure Microsoft Operations Manager to schedule report batch files to run at regular times you select.

  • From the Start menu, select Programs, Microsoft Operations Manager and then MOM Reporting.
  • Open the Tools menu.
  • Select Command Line Wizard.
  • Follow the steps in the Wizard to generate the batch file.
  • On the last screen, note the location and name of the batch file being generated and select Launch Task Scheduler to schedule the batch file. Click Finish.
  • The Scheduled Tasks folder opens. Double-click Add scheduled task.
  • In the Scheduled Task Wizard, click Next, and then click Browse.
  • Enter the name of the report batch file. Click OK.
  • Follow the steps in the Schedule Task Wizard to complete the scheduling of the report batch file.
Note You can edit the batch file to include additional command line arguments for each report generation command. For details on available command line parameters, refer to Using the Command Line Interface.

Related Topics


Selecting a Data Source

The reports display the information from the selected data source. The data source indicates from which database the data is used to generate the reports. Therefore, you must select a data source before viewing, printing, or saving the reports.

Note

  • The data source must be configured for integrated security. In addition, your user account must be a member of the OnePointOp MOM Reporting group. This group provides Read access to all the data used by MOM Reporting.

To select a data source for MOM Reporting:

  1. Click File on the menu bar of MOM Reporting.
  2. Click Select MOM Reporting Data Source on the File menu.
  3. Select the data source from the displayed list.
  4. Click Select.
  5. Click OK on the confirmation message window.

Related Topics


Setting Options for Saving HTML Reports

When you install MOM Reporting, the installation program creates folders in which to store reports saved as HTML files. The installation program also installs default template and style files in these directories.

The HTML Properties window of MOM Reporting allows you to specify where the reports are saved as HTML files and where the default template file is located. You can change the location where reports are saved. If you change the location to store the files on another computer with MOM Reporting installed, you should also change the template location to point to the template file on that computer. In addition, ensure you have Write permissions for the appropriate folders on that computer.

To set the HTML options:

  1. Click File on the menu bar.
  2. Click HTML Properties on the File menu.
  3. Specify the desired values, and then click OK. For more information about a field, see HTML Properties Window.

Related Topics


Using the Command-Line Interface

MOM Reporting provides a command-line interface. With this interface, you can automate the report generation process. For example, you can create a batch file that contains the commands to generate the reports you want. Then you can use Windows Task Scheduler, as explained in Scheduling Report Generation, to run that batch file at scheduled times. For more information about automating the report generation process, see Automating Report Generation.

To generate multiple reports from a batch file, prefix each command in the file with the START /WAIT command. For more information about the START /WAIT command, see the MS-DOS Help.

Note

  • Command-line length is limited to 237 characters. If you generate a batch file with a command line of more than 237 characters, MOM Reporting will not create the report. If you must use very long command lines, Access.exe allows this using the following syntax:
    • %ACCESS.EXE% %EEAREPT.MDB% /nostartup /x macPrintBatch /cmd %Report name and options%
    • %Access.exe% : path name of Microsoft Access executable.
    • %eearept.mdb% : path name of eearept.mdb
    • %Report name and options%: The part of commandline in batchfile followed by /PRINTBATCH. For example: Application Log Summary /DATERANGE:LASTWEEK /OUTPUT:H /DESCRIPTION:Y

MOM Reporting provides the EEAREPT command for generating reports.

Syntax

EEAREPT /PRINTBATCH report [/OUTPUT:{P|H[=folder]}]
  [/DATERANGE|DR}:dates] [/HOURS:SS-EE [,SS-EE]*]
  [/DAYS:n] [/SERVERS|S}:'serverA' [,'serverB']] [/DATASOURCE|DS}:DSN=dsn]
  [/DESCRIPTION|DESC}:{Y|N}] [/FOREST|F}:'fname'] [/DOMAINS|D}:'domnameA' [,'domnameB']]
  [/USERS_INCLUDE|UI}:'user1' [,'user2']] [/USERS_EXCLUDE|UE}:'user1' [,'user2']] [/TOP:<number> [ PERCENT] ]
  [/IP_ADDRESS_LIST|IAL}:'label1=ipAddress1'[,'label2=ipAddress2'] ] [/{ARCHIVE|AR}:{Y|N}] [/{CHART_TYPE|CT}:{1|2|3}]

Options

The options are defined as follows:

/PRINTBATCH
Directs MOM Reporting to generate the specified report.
report
Specifies the name of the report to generate.
/ARCHIVE or /AR
Archives previously generated HTML reports. The default value for this switch is N. If this switch is not specified, then default value is Not Archive.
/OUTPUT:{P|H[=folder]} or /O:{P|H[=folder]}
Specifies the type of output for the specified report:
P | Prints the report on the default printer.
H | Generates the report as HTML files in the specified folder.
/DATERANGE:dates or /DR:dates
Specifies the dates for which to generate the specified report. The dates variable can be set to one of the following values:
S=yyyy-mm-dd hh:mm E=yyyy-mm-dd hh:mm
Specifies the start and end date and time for the report.
THISWEEK
Includes data from Sunday through Saturday of the current week.
LASTWEEK
Includes data from Sunday through Saturday of the previous week.
YESTERDAY
Includes data from the previous day.
TODAY
Includes data from the current day.
THISMONTH
Includes data from the first through last day of this month.
LASTMONTH
Includes data from the first through last day of the previous month.

Note

  • If no other variables are used with the /DATERANGE option the default values of S=1970-01-01 and E=[today's date] are used.

/HOURS:SS-EE [,SS-EE]*]
Specifies the range of hours to include in the specified report. If used with the /DATERANGE option, the report will include this time range for each day specified by the /DATERANGE option:
SS | Specifies the starting hour for the report.
EE | Specifies the ending hour for the report.
If only one number is specified, then the report is generated for that hour only. For example /HOURS:2 generates a report with data during the hour 2:00 to 2:59.
/DAYS:n
Specifies the number of days of data to include in the specified report. This option is evaluated along with the start or end date specified with the /DATERANGE option. For example, this value specifies the number of days included in the report after the specified start date, or before the specified end date. If both a start and end date are specified, this option has no effect. If the /DATERANGE option is not specified, this option directs Microsoft Operations Manager 2000 to generate a report for the number of previous days specified. The n variable can be from 1 to 999.
/SERVERS:'serverA'[,'serverB'] or /S:'serverA'[,'serverB']
Specifies the names of the servers to include in the specified report. Separate multiple server names with a comma, and enclose server names in single quotation marks.
/DATASOURCE:DSN=dsn or /DS:DSN=dsn
Specifies the connection information for the database. The variable format is defined as follows:

DSN=dsn

For example, specify the following value to use the OnePoint DSN to connect to the database:

/DATASOURCE:DSN=OnePoint

If a database is not specified the last connected database is used.

/DESCRIPTION:{Y|N} or /DESC:{Y|N}
Specifies whether the description of the report is included in the generated report.
/FOREST:'fname' or /F:'fname'
Specifies the name of a forest to include in the specified report. You may also specify a forest by using the name of a domain belonging to that forest. Enclose forest or domain name in single quotation marks. This option applies to the following reports:
  • AD Domain Controllers by Site
  • AD Extinct Attributes
  • AD Extinct Classes
  • AD Replication Topology by Domain Controller
  • AD Replication Topology by Site.
/DOMAINS:'domnameA' [,'domnameB'] or /D:'domnameA' [,'domnameB']
Specifies the names of the domains to include in the specified report. Separate multiple domain names with a comma, and enclose user names in single quotation marks. This option applies to the following reports:
  • AD Domain Controllers by Domain
  • AD Operations Masters by Computer
  • AD Operations Masters by Role
  • AD Operations Masters Best Practices
/USERS_INCLUDE:'user1' [,'user2'] or /UI:'user1' [,'user2']
Specifies the names of the users to include in the specified report. Separate multiple user names with a comma, and enclose user names in single quotation marks. This option applies to the Remote Access Connections by User report:
/USERS_EXCLUDE:'user1' [,'user2'] or /UE:'user1' [,'user2']
Specifies the names of the users to exclude from the specified report. Separate multiple user names with a comma, and enclose user names in single quotation marks. This option applies to the reports listed in the /USERS_INCLUDE option above.
/TOP:<number> [PERCENT]
Applicable only for Top_CPU_Utilization, Top_Disk_Utilization and Top_Memory_Utilization reports. Limits the number of servers to be shown in the report. Servers with maximum measured value are shown.
  • <n> = Maximum number of servers to be shown in the report
  • <n> PERCENT = Percentage of servers to be shown in the report.
/IP_ADDRESS_LIST:'label1=ipAddress1'[,'label2=ipAddress2'] or /IAL:'label1=ipAddress1'[,'label2=ipAddress2']
Applicable only for:
  • IIS Events by Selected Client IP Address Summary report
  • IIS Events by Selected Client IP Address report
/CHART_TYPE:{1|2|3} or /CT:{1|2|3}
Specifies the chart type. Applicable only to graph reports.
  • Line
  • Bar
  • Bar (3D)

Example 1

To print the complete User Account Changes report that includes all user account changes, enter:

EEAREPT /PRINTBATCH User Account Changes /OUTPUT:P

Example 2

To save the complete User Account Changes report in HTML format in the default folder for HTML reports, enter:

EEAREPT /PRINTBATCH User Account Changes /OUTPUT:H

Example 3

To print the User Account Changes report for all user account changes that occurred in 1997, enter:

EEAREPT /PRINTBATCH User Account Changes /OUTPUT:P /DATERANGE:S=1997-01-01 E=1998-01-01

Example 4

To print the User Account Changes report for all user account changes that occurred in February, 1998, enter:

EEAREPT /PRINTBATCH User Account Changes /OUTPUT:P /DATERANGE:S=1998-02-01 /DAYS:28

Example 5

To print the User Account Changes report for all user account changes that occurred during the 60 days before and including March 1, 1998, enter:

EEAREPT /PRINTBATCH User Account Changes /OUTPUT:P /DATERANGE:E=1998-03-02 /DAYS:60

Example 6

To print two User Account Changes reports from a batch file, create and run a batch file that includes the following commands:

START /WAIT EEAREPT /PRINTBATCH Logon Violations by Time /OUTPUT:P /DATERANGE:S=1998-02-01 /DAYS:28 START /WAIT EEAREPT /PRINTBATCH User Account Changes /OUTPUT:P /DATERANGE:E=1998-03-02 /DAYS:60

Example 7

To print a top_xxx_utilization report using /TOP option:

START /WAIT EEAREPT /PRINTBATCH Top CPU Utilization /OUTPUT:P /DATERANGE:YESTERDAY /TOP:25 PERCENT

Example 8

Printing IIS Events by Selected Client IP Address Summary using /IP_ADDRESS_LIST option:

START /WAIT EEAREPT.exe /PRINTBATCH IIS Events by Selected Client IP Address Summary /OUTPUT:H /DESCRIPTION:Y /IP_ADDRESS_LIST:'machine1=157.54.2.72','machine2=157.60.253.97'

Related Topics


Troubleshooting in MOM Reporting

If your report is not being generated, check these troubleshooting tips:

No computer matches report category:
For instance, no Exchange servers are being monitored by MOM for Exchange reports, or no domain controllers are being monitored for Active Directory reports.

Additional configuration needed:
Some reporting rules require additional configuration for data collection. These include some Active Directory reports, Exchange reports, IIS reports and disk performance and capacity planning reports. Refer to Management Pack Module Configuration Guide.pdf, located on the Microsoft Operations Manager 2000 product CD, for detailed configuration steps.

Rules are not enabled:
By default, rules for some reports are disabled. These include WTS reports, IIS operations reports, and Active Directory auditing reports.

To generate these reports, enable the corresponding reporting data collection rules.

Sampling interval of rule is too large:
For some reports, the sampling interval for the performance counter may be too large to collect meaningful data on short-duration activity. Examples of such reports are SQL Server replication performance analysis reports and IIS FTP / NNTP service connection performance analysis reports.

To collect data for these reports that is meaningful in your environment, reduce the sampling interval for the corresponding performance processing rules.

Auditing not enabled:
Some auditing reports are not enabled because the data collected for these reports can be extensive. For example, DAS auditing is disabled by default and must be manually enabled before reports can be generated. Check Management Pack Module Configuration Guide.pdf for configuration steps to enable these reports.

Failure to generate scheduled reports
If you scheduled reports and these reports are not generated, look for error event 1024 in the Windows NT event log from Reporting source. This indicates that scheduled report generation failed to generate the report and lists the reason for the failure.

To schedule the report batch file, provide the username and password of a user to the Windows task scheduler. Make sure the user for report generation is a member of the OnePoinOp Reporting local user group on the computer where the reports are scheduled.

Secondary Axis Data Not Displayed
If you do not see the secondary axis in the following reports:

  • IIS Disk Performance Analysis;
  • IIS Memory Performance Analysis;
  • IIS Network Performance Analysis; or
  • Memory Performance Analysis;

The secondary axis will not be displayed in the reports if the data for the secondary axis counters is not available.

Disk Capacity Planning Not Displayed
If you do not see the report for disk capacity planning or if you do not see data for Windows 2000 computers in this report, you may need to explicitly enable the corresponding performance counter logical disk - % free space. To enable, use diskperf -y. Please note that this performance counter is enabled by default on Windows NT 4.0 computers.


Using the Command-Line Wizard

MOM Reporting provides a command-line interface. This interface allows you to automate the report generation process. For example, you can create a batch file that contains the commands to generate the reports you want. Then, you can use the Windows Task Scheduler, as explained in Scheduling Report Generation, to run that batch file at scheduled times. For more information, see Automating Report Generation.

MOM Reporting also provides a command-line wizard that allows you to create a batch file that contains a command to generate specific reports. You can use the wizard to create the batch file and see what options are required to generate a specific report. You can also run the wizard several times, saving each command to a separate batch file, and then combine the commands into one batch file.

To generate multiple reports from a batch file, prefix each command in the file with the START /WAIT command. For more information about the START /WAIT command, see the MS-DOS help.

To use the command-line wizard to create a batch file:

  1. Click Tools on the menu bar.
  2. Click Report Command Line Wizard on the Tools menu.
  3. Follow the instructions until you have finished creating the batch file to generate the reports you need.

Note

  • To generate the desired reports, you must run or schedule the batch file you created.

Note

  • You can also archive previously generated HTML reports when using batch files to generate reports when using the Command Line Wizard. On the Select Report Output Type screen, select Archive Previous Report(s).

Related Topics


Viewing or Printing a Report

The reports display the information from the selected data source. Therefore, you must select a data source before viewing, printing, or saving the reports. Then, you can view or print a report, as well as save a report in HTML format.

Note

  • Before selecting any reports, select a default printer on the workstation on which you run MOM Reporting.
  • This tool uses the Short date style and Time style specified in the Regional and Language Options application in Control Panel. For more information, see Understanding Dates and Times.
  • You should use a screen resolution of 800×600 or larger.

To view or print a report:

  1. Select a data source. For more information, see Selecting a Data Source.
  2. Select the report you want in the left pane of MOM Reporting.
  3. Specify the report criteria in the right pane of MOM Reporting. The criteria for most reports are defined as follows:
    4. Date range
    Specifies the dates on which the entries included in the report were logged:
    All dates
    Includes all entries that match the remaining criteria specified.
    Selected
    Includes entries that match the remaining criteria specified only if those entries were logged during the specified dates.
    Chart options
    Specifies how the graphs are drawn in the reports that provide graphs.
    Chart Type
    Specifies the type of graph to produce. For more information about the different types of graphs, see Understanding Graphs.
    Use smooth lines
    Specifies whether the graphed lines are smoothed to reduce extreme values.
    Y-axis range
    Specifies the minimum and maximum values for the Y-axis of the graph.
    Select servers to include in the report
    Specifies the servers from which the entries are included in the selected report.
    All
    Includes in the report entries from all the servers listed in the Server list box.
    Selected
    Includes in the report entries from the servers selected in the Server list box.
  4. Click the desired action button:
    • To view the selected report, click View.
    • To print the selected report, click Print.
    • To save the selected report in HTML format, click File on the menu bar, then click Save as HTML on the File menu.
  5. If you are viewing the report, press the ESC key to return to the main window.

Related Topics


Viewing or Printing Multiple Reports

The reports display the information from the selected data source. Therefore, you must select a data source before viewing, printing, or saving the reports. Then, you can view or print a report, as well as save a report in HTML format.

Notes

  • Before selecting any reports, select a default printer on the workstation on which you run MOM Reporting.
  • When generating multiple reports, MOM Reporting uses the criteria last specified for each report. Therefore, before generating multiple reports, set the desired criteria for each report. For more information about the criteria, see Viewing or Printing a Report.
  • This tool uses the Short date style and Time style specified in the Regional and Language Options application in Control Panel. For more information, see Understanding Dates and Times.
  • You should use a screen resolution of 800×600 or larger.

To view or print multiple reports:

  1. Select a data source. For more information, see Selecting a Data Source.
  2. Specify the report criteria in the right pane of MOM Reporting for each report that you want to view or print. To view the criteria for a report, select that report in the left pane of MOM Reporting.
  3. Click File on the menu bar.
  4. Click Print or View Multiple Reports on the File menu.
  5. Select the desired reports on the Print Report Set window.
  6. Click the button for the desired action:
    • To view the selected reports, click View.
    • To print the selected reports, click Print.
    • To save the selected reports in HTML format, click Save as HTML.
  7. If you are viewing the reports, MOM Reporting opens a window for each selected report. To view a report, select the desired window from the Window menu. To close a report you are viewing, press the ESC key.

Related Topics


Viewing or Printing Published Web Reports

You can view and print reports saved as HTML. These reports may be available through the Web Console and the MOM Administrator Console, or they may be published in another location. For example, you can save reports in a folder, create a share for that folder, and then allow other users to view the reports saved in that folder. For more information, see Publishing HTML Reports.

To view and print a published Web report:

  1. Make sure Microsoft Internet Explorer is configured so you can view report pages. For more information, see Configuring Internet Explorer for Viewing Published Web Reports.
    • If you are using the MOM Administrator Console, complete the following steps:
      1. Click Microsoft Operations Manager (default) in the left pane.
      2. Click reports ARE on the Web in the right pane.
    • If you are using Internet Explorer to view reports outside the MOM Administrator Console or the Web Console, open the Default.htm file in the directory where the reports are saved.
  2. Click the desired report.
    • If you want to print the entire report, right-click the report, and then click Print.
    • If you want to print only the displayed page of the report, complete the following steps:
      1. Click File on the Internet Explorer menu bar.
      2. Click Print on the File menu.
      3. Select the desired print options, and then click OK.

Related Topics


Displaying a View

Views allow you to see database information about monitored computers. For information about creating a view, see Creating a View.

To display a view:

  1. Expand Microsoft Operations Manager (default) in the left pane.
  2. Expand Monitor in the left pane.
  3. Expand lower-level folders as necessary.
  4. Click the view you want to display. Microsoft Operations Manager 2000 displays views in the right pane.

Related Topics


Modifying View Properties

You can change the properties of a view. To modify the properties of a private or public view, you must be the creator of the view, or your user account must be a member of the Configuration Administrators (OnePointOp ConfgAdms) Windows NT user group.

To modify the properties of a view:

  1. Expand Microsoft Operations Manager (default) in the left pane.
  2. Expand Monitor in the left pane.
    • If you want to modify a private view, click My Views.
    • If you want to modify a public view, click Public Views.
  3. Click the view you want to modify.
  4. Click Action on the menu bar.
  5. Click Properties on the Action menu.
  6. Follow the instructions until you finish modifying the view. For more information about the fields on a window, click Help.

Related Topics


Viewing Pages of Items

The results pane can contain many pages of items. A view shows one page containing a specified number of items. For information about setting the page size for views, see Modifying View Properties and Setting Default Properties for New Views.

To see different pages of items:

  1. Expand Microsoft Operations Manager (default) in the left pane.
  2. Expand Monitor in the left pane.
  3. Expand lower-level folders as necessary.
  4. Click the desired view.
  5. Click View on the menu bar.
  6. Click First Page, Next Page, or Previous Page on the View menu.

Related Topics


Creating a View

A view displays specific information from the database. You can create the following types of views:

  • Views that are accessible only within this MOM Administrator Console
  • Private views that can be accessed only by their creator from any MOM Administrator Console or Web Console within this configuration group
  • Public views that can be accessed by anyone from any MOM Administrator Console or Web Console within this configuration group

To create a view:

  1. Expand Microsoft Operations Manager (default) in the left pane.
  2. Click Monitor in the left pane.
    • If you want to create a view accessible only in this MOM Administrator Console, continue with step 6.
    • If you want to create a private view, click My Views in the left pane.
    • If you want to create a public view, click Public Views in the left pane.
  3. Click Action on the menu bar.
  4. Click New on the Action menu.
  5. Click one of the following view types:
    6. Computer Group View | Displays information about computers in a computer group, such as all computers running Microsoft SQL Server.
Computer View | Displays information about specified computers in the configuration group.
Alert View | Displays alerts that meet specified criteria from computers in the configuration group.
Event View | Displays events that meet specified criteria from computers in the configuration group.
Computer Performance View | Displays the number of counters sampled for specified computers in the configuration group.
Performance Data View | Displays sampled numeric data that meets specified criteria from computers in the configuration group.
Attribute View | Displays computer attributes that meet specified criteria.
  6. Follow the instructions until you finish creating a view. For more information about the fields on a window, click Help.
  7. In the left pane, click the view you just created.

Related Topics


Copying a View

You can copy and paste views into the Monitor, the My Views and Public Views folders, or folders you have created. You can create a new view by copying and pasting an existing view and then modifying the pasted view. You can copy and paste a view within the current Monitor snap-in or into a Monitor snap-in for another configuration group.

To copy a view:

  1. Expand Microsoft Operations Manager (default) in the left pane.
  2. Expand Monitor in the left pane.
  3. Expand lower-level folders as necessary.
  4. Click the view you want to copy.
  5. Click Action on the menu bar.
  6. Click Copy on the Action menu.
  7. Click one of the following items in the left pane:
    • Monitor
    • My Views
    • Public Views
    • Folder you have created
  8. Click Action on the menu bar.
  9. Click Paste on the Action menu.
    • If you want to rename the pasted view, complete the following steps:
      1. Click the pasted view in the left pane.
      2. Click Action on the menu bar.
      3. Click Rename on the Action menu.
      4. Type a new name for the copied view.

Pasting a view into the My Views folder creates a private view accessible only by the person pasting the view. Private views are accessible using any MOM Administrator Console or Web Console in the configuration group. Pasting a view into the Public Views folder creates a view accessible by anyone using this or other MOM Administrator Consoles or Web Consoles in the configuration group.

Related Topics


Deleting a View

If you no longer require a custom view, you can delete it from the left pane. You cannot delete default views.

To delete a custom view:

  1. Expand Microsoft Operations Manager (default) in the left pane.
  2. Expand Monitor in the left pane.
  3. Expand lower-level folders as necessary.
  4. Click the view you want to delete.
  5. Click Action on the menu bar.
  6. Click Delete on the Action menu.
  7. Click Yes to confirm the deletion.

Related Topics


Refreshing the Right Pane

You can refresh the right pane to provide updated information from the database.

To refresh the right pane:

  1. Expand Microsoft Operations Manager (default) in the left pane.
  2. Expand the Monitor, Rules, or Configuration snap-in node in the left pane.
  3. In the left pane, click the view or node you want to refresh.
  4. Click Action on the menu bar.
  5. Click Refresh on the Action menu.

To refresh the Today window statistics in the right pane of the Console window:

  1. Click Microsoft Operations Manager (default) in the left pane.
  2. Press F5.

Related Topics


Setting Autorefresh for a View

You can specify the autorefresh rate for a single view. To specify the default autorefresh rate for all new views, see Setting Default Properties for New Views.

Note

  • You cannot set autorefresh for event views. For information about refreshing event views, see Refreshing the Right Pane.

To set autorefresh for a single view:

  1. Expand Monitor in the left pane.
  2. Click the view for which you want to specify the autorefresh rate.
  3. Click Action on the menu bar.
  4. Click Properties on the Action menu.
  5. Click the General tab.
  6. Select the Autorefresh view check box.
  7. Type a value in the every __ seconds field, and then click OK.

Related Topics


Setting Default Properties for New Views

You can set default properties, including autorefresh and page size, for all new views. New views that you create after setting the default properties will automatically use the default settings.

To set default properties for all new views:

  1. Expand Microsoft Operations Manager (default) in the left pane.
  2. Click Monitor in the left pane.
  3. Click Action on the menu bar.
  4. Click Set Defaults for New Views on the Action menu.
  5. Specify the default settings to be used by new views, and then click OK.

Related Topics


Active Directory Reports

Active Directory reports include the following categories of information:

Active Directory Operatons
These reports summarize Active Directory operations and identify computer or service availability problems.
Active Directory Discovery
These reports summarize the domain topology.
Active Directory Health Monitoring and Operational Recovery
These reports monitor network computer memory, disk space, and processor usage for health and capacity planning purposes.
Active Directory Replication Monitoring
These reports provide information about Active Directory replication, such as collisions and failures.

Active Directory Report Changes for MOM SP1

The following reports have been added in MOM SP1:

  • AD Replication Monitoring – Provides SLA data for replication latency between specific domain controllers (Depends on data collected from domain controllers in the ‘Active Directory Replication Latency Data Collection’ computer group).
  • AD Client Side Events – Displays all events from the AD Client Side Monitoring pack.
  • AD Client Side Response Time – Provides perf data collected by the Client Side Monitoring pack.
  • AD Authentication Performance – Provides perf data (NTML Authentications, KDC AS Requests, KDC TGS Requests, Kerberos Authentications).
  • AD General Health - Provides perf data (CPU Time, TCP Connections Established, Server Sessions, Up Time, Max Up Time).
  • AD LDAP Performance – Provides perf data (Client Sessions, Searches/sec, Writes/sec, UDP Ops/sec).
  • AD LSASS Performance – Provides perf data (Handles, Private Bytes, LSASS % Processor Time (not normalized), % CPU Time (normalized).
  • AD Domain Changes – Events relevant to changes in the domain.
  • AD Duplicate Accounts – Indicates accounts that are identified as duplicates by AD (usually due to a duplicate SPN).
  • AD Machine Account Authentication Failures – Provides machine account authentication failure events.
  • AD Machine Account Authentication Failures By Repeat Count – Same as AD Machine Account Authentication Failures, but ordered by repeat count.
  • AD SAM Account Changes – Events relevant to SAM Account changes in the domain.

The followng report has been modified in MOM SP1:

  • AD Time Service – Format changed to consolidate events that are the same.

The followng report has been removed from MOM SP1:

  • AD Replication Latency - Deleted.

All Active Directory discovery reports now query AD directly instead of doing a pass-through via SQL.


Active Directory Domain Controller Availability

This report summarizes the availability of Active Directory domain controllers. The columns of this report are defined as follows:

Computer Name
Provides the name of each computer specified in the report criteria.
Uptime Sampling Date Range
Provides the date range from the first time Microsoft Operations Manager 2000 recorded an uptime event. The ending date is the date specified in the report criteria.
Availability
Identifies the percentage of time the domain controller was available during the time specified in the report criteria.


Active Directory Services Availability

This report summarizes the percentage of time each Active Directory service was available during the specified period of time. If you do not specify a period of time, MOM Reporting calculates the percentage of time each service was available since the first service availability event was received. The report includes the following services:

  • Kerberos Key Distribution Center
  • Security Accounts Manager
  • Net Logon

The columns of this report are defined as follows:

Server
Provides the name of each server specified in the report criteria.
Service
Provides the name of each service on the servers identified in the Server column.
Days/Hours of Availability
Identifies the amount of time the service identified in the Service column was available during the time specified in the report criteria.
Availability
Identifies the percentage of time the service was available during the time specified in the report criteria.


DNS Server Availability

This report summarizes the availability of DNS servers. The columns of this report are defined as follows:

Computer Name
Provides the name of each computer specified in the report criteria.
Uptime Sampling Date Range
Provides the date range from the first time Microsoft Operations Manager 2000 recorded an uptime event. The ending date is the date specified in the report criteria.
Availability
Identifies the percentage of time the DNS server was available during the time specified in the report criteria.


DNS Service Availability

This report summarizes the percentage of time the DNS Server service was available during the specified period of time. If you do not specify a period of time, MOM Reporting calculates the percentage of time each service was available since the first service availability event was received. The columns of this report are defined as follows:

Server
Provides the name of each DNS server specified in the report criteria.
Days/Hours of Availability
Identifies the amount of time the service identified in the Service column was available during the time specified in the report criteria.
Availability
Identifies the percentage of time the service was available during the time specified in the report criteria.


Active Directory Domain Controllers

This report summarizes information about the Active Directory domain controllers. MOM Reporting provides this report sorted in several ways:

  • Domain Controllers by Domain
  • Domain Controllers by Site

This report runs in a Windows 2000 environment only. The columns of this report are defined as follows:

Domain
Specifies the DNS name of the domain.
Domain Controller
Specifies the DNS name of the domain controller.
IP Address
Specifies the IP address of the domain controller.
Site
Specifies the name of the site to which the domain controller belongs.

Note

  • Reports will not reflect configuration changes until Active Directory is replicated. The length of the delay depends on the replication interval.


Active Directory Operations Master Best Practices

This report summarizes the best practices of Active Directory Operations Masters. This report runs in a Windows 2000 environment only. The columns of this report are defined as follows:

Domain
Specifies the DNS name of the domain on which the Operations Master resides.
Operations Masters Information
Specifies whether the following best practices are employed:
  • The Domain Naming Master resides on a global catalog server.
  • The PCD Emulator and RID Masters reside on the same physical domain controller.
  • The Infrastructure Master is not located on a global catalog server.
Practice Followed?
Specifies Yes or No for each best practice, depending upon whether or not the domain followed that practice.

Note

  • Reports will not reflect configuration changes until Active Directory is replicated. The length of the delay depends on the replication interval.


Active Directory Operations Masters

This report summarizes the Operations Masters and Global Catalogs for each domain. There are five Operations Masters:

  • Domain Naming Master
  • Infrastructure Master
  • PDC Master
  • RID Master
  • Schema Master

MOM Reporting provides this information sorted in several ways:

  • Operations Masters by Computer
  • Operations Masters by Role

This report runs in a Windows 2000 environment only. The columns of this report are defined as follows:

Domain
Specifies the DNS name of the domain.
Role
Specifies the Global Catalog or the name of the Operations Master on the specified domain.
Role Description
Specifies the description of the role named in the Role column.
Role Holder
Specifies the DNS name of the computer that holds the Operations Master role or Global Catalog.

Note

  • Reports will not reflect configuration changes until Active Directory is replicated. The length of the delay depends on the replication interval.


Active Directory Replication Topology By Domain Controller

This report summarizes the Active Directory replication topology sorted by domain controller. This report runs in a Windows 2000 environment only. The columns of this report are defined as follows:

Domain
Specifies the DNS name of the domain to which the domain controller belongs.
Domain Controller
Specifies the DNS name of the domain controller.
Connection Object
Specifies the DNS name of the replication partner of the domain controller.
Is DC a Bridgehead Server?
Specifies whether the domain controller serves as the replication link between sites.
Connection Mechanism
If the domain controller is a bridgehead server, specifies whether the connection is IP or SMTP.

Note

  • Reports will not reflect configuration changes until Active Directory is replicated. The length of the delay depends on the replication interval.


Active Directory Replication Topology By Site

This report summarizes the Active Directory replication topology sorted by site. This report runs in a Windows 2000 environment only. The columns of this report are defined as follows:

Forest
Provides the name of the forest specified in the report criteria.
Site
Provides the name of the site from which changes are being replicated.
Connected Site
Provides the name of the site receiving the changes.
Site Link Name
Provides the name of the link connecting the two sites.
Link Type
Specifies whether the sites are linked by IP or SMTP.
Link Cost
Provides the cost of the site link as determined by the network administrator.
Replication Interval
Specifies in minutes how often domain controllers replicate the Active Directory database.
Local Bridgehead
Specifies the name of the local bridgehead server.
Remote Bridgehead
Specifies the name of the remote bridgehead server.

Note

  • Reports will not reflect configuration changes until Active Directory is replicated. The length of the delay depends on the replication interval.


Active Directory Trust Web

This report summarizes the trust relationships of Active Directory domains. This report runs in a Windows 2000 environment only. The columns of this report are defined as follows:

Domain
Specifies the DNS name of the domain.
Trusted Domain
Specifies the DNS name of the domain involved in the trust.
Direction
Specifies the direction of the trust: trusted, trusting, or two-way.
Is Transitive?
Specifies whether the trust relationship in the report criteria extends to other domains with which the trusted domain has trust relationships.

Note

  • Reports will not reflect configuration changes until Active Directory is replicated. The length of the delay depends on the replication interval.


Active Directory Domain Controller Disk Space

This report summarizes log file size and other disk space information for the specified domain controller. The columns of this report are defined as follows:

Domain
Provides the name of the domain.
Computer
Specifies the name of the domain controller.
Time of Collection
Specifies the time the disk space data was collected.
Disk Space Information
Specifies the following information as applicable:
  • Log File Path
  • Log File Size
  • Log File Drive Free Space
  • Active Directory Database Path
  • Active Directory Database Size
  • Active Directory Database Drive Free Space


Active Directory Domain Controller Memory Capacity Planning

MOM Reporting provides this information sorted in several ways:

  • Memory Capacity Planning by Day (24-hour period)
  • Memory Capacity Planning by Peak Hours (7:00 A.M. to 7:00 P.M.)

This report provides a graph of the memory capacity for each specified domain controller during the specified time period. The graph indicates the minimum, maximum, and average daily usage based on the Memory/Pages Per Second performance counter. This report provides one graph for each specified domain controller.


Active Directory Domain Controller Processor Capacity Planning

MOM Reporting provides this information sorted in several ways:

  • Processor Capacity Planning by Day (24-hour period)
  • Processor Capacity Planning by Peak Hours (7:00 A.M. to 7:00 P.M.)

This report provides a graph of the processor capacity for each specified Active Directory domain controller during the specified time period. The graph indicates the minimum, maximum, and average daily usage based on the Processor/% Processor Time performance counter. This report provides one graph for each specified domain controller.


Active Directory Global Catalog Search Time

This report graphs the time it takes to search the global catalog. The report provides one graph for each domain controller. The graph is based on the MCSActiveDirectory-Global Catalog Search Time performance counter.


Active Directory Operations Masters Connection Time

This report provides a graph of the ping time and bind time to Operations Masters from a specified domain controller. There is one graph per domain controller. The graph displays the following ActiveDirectory performance counters:

  • MCSActiveDirectory-MCSActiveDirectory - Domain Naming Last Bind (seconds)
  • MCSActiveDirectory-Op Master PDC Last Bind (Seconds)
  • MCSActiveDirectory-Op Master Schema Last Bind (Seconds)
  • MCSActiveDirectory-Op Master Infrastructure Last Ping (Seconds)
  • MCSActiveDirectory-Op Master RID Last Ping (Seconds)
  • MCSActiveDirectory-Op Master Infrastructure Last Bind (Seconds)
  • MCSActiveDirectory-Op Master RID Last Bind (Seconds)
  • MCSActiveDirectory-Op Master Domain Naming Last Ping (Seconds)
  • MCSActiveDirectory-Op Master PDC Last Ping (Seconds)
  • MCSActiveDirectory-Op Master Schema Last Ping (Seconds)


Active Directory Response Time

This report graphs the responsiveness of Active Directory from selected domain controllers. The report provides one graph for each domain controller. The graph displays the following ActiveDirectory performance counters:

  • MCSActiveDirectory-Active Directory Average Bind (Seconds)
  • MCSActiveDirectory-Active Directory Last Bind (Seconds)


Active Directory Response Time By Peak Hours

This report provides a graph of the response times for each specified domain controller during the specified time period, displayed by peak hours. The graph indicates the daily minimum, maximum, and average response times, based from 7 A.M. to 7 P.M. The report is based on the MCSActiveDirectory - Active Directory Last Bind performance counter. This report provides one graph for each domain controller.


DNS Server Memory Capacity Planning

MOM Reporting provides this information sorted in several ways:

  • Memory Capacity Planning by Day (24-hour period)
  • Memory Capacity Planning by Peak Hours (7:00 A.M. to 7:00 P.M.)

This report provides a graph of the memory capacity for each specified DNS server during the specified time period. The graph indicates the minimum, maximum, and average daily usage based on the Memory/Pages Per Second performance counter. This report provides one graph for each specified DNS server.


DNS Server Processor Capacity Planning

MOM Reporting provides this report sorted in several ways:

  • Processor Capacity Planning by Day (24-hour period)
  • Processor Capacity Planning by Peak Hours (7:00 A.M. to 7:00 P.M.)

This report provides a graph of the processor capacity for each specified DNS server during the specified time period. The graph indicates the minimum, maximum, and average daily usage based on the Processor/% Processor Time performance counter. This report provides one graph for each specified DNS server.


Active Directory Inbound Replication Bandwidth Usage

This report summarizes the total amount of inbound replication bandwidth used by replication by server to each partner. The report displays one graph for each domain controller. The graph displays the following performance counters:

  • DRA Inbound Bytes Total (Seconds)
  • DRA Inbound Bytes Compressed (Between Sites/Before Compression (Seconds)
  • DRA Inbound Bytes Not Compressed (Within Site) (Seconds)
  • DRA Inbound Bytes Compressed (Between Sites/After Compression) (Seconds)


Active Directory Outbound Replication Bandwidth Usage

This report summarizes the total amount of outbound replication bandwidth used by replication by server to each partner. The report displays one graph for each domain controller. The graph displays the following performance counters:

  • DRA Outbound Bytes Total (Seconds)
  • DRA Outbound Bytes Compressed (Between Sites/Before Compression (Seconds)
  • DRA Outbound Bytes Not Compressed (Within Site) (Seconds)
  • DRA Outbound Bytes Compressed (Between Sites/After Compression) (Seconds)


Active Directory Replication Collisions

This report summarizes replication collision events and provides information from the event. The report includes the following events from the directory service event log:

  • 1233—Object replaced by object with same version number but different timestamp
  • 1546—Conflict while replicating schema object
  • 1547—Conflict while replicating in schema object

The columns of this report are defined as follows:

Time Logged
Specifies the date and time the collision was logged.
Server
Provides the name of server specified in the report criteria.
Event Type
Specifies the status of the event: Success or Failure.
Event Number
Specifies an identification number for the collision event.
Description
Specifies a description of the collision event.


Active Directory Replication Failures

This report summarizes information about replication failures using event log information. The report includes the following events from the directory service event log:

  • 1014—Replication topology update task terminated abnormally
  • 1075—DRA failed while assembling a replication update request message for another site
  • 1077—Replication error: Couldn't allocate memory
  • 1084—DRA couldn't update object
  • 1096—Directory replication agent (DRA) received a badly formatted update-replica message during intersite replication
  • 1098—DRA received invalid update-replica message
  • 1100—DRA received invalid update-replica message
  • 1222—Certificate for intersite replication rejected
  • 1223—Certificate for intersite replication was rejected
  • 1274—Directory service failed to replicate partition from remote server
  • 1308—Successive replication attempts failed
  • 1425—Directory service was unable to force a replication cycle with the RID FSMO computer
  • 1455—Directory service failed to find server to replicate off changes
  • 1457—Failed replication of local changes
  • 1531—DRA encountered failure receiving message during intersite replication
  • 1532—Failure sending message during intersite replication

The columns of this report are defined as follows:

Time Logged
Specifies the date and time the replication failure was logged.
Server
Provides the name of server on which the failure occurred.
Event Type
Specifies the status of the event: Success or Failure.
Event Number
Specifies an identification number for the replication failure.
Description
Specifies a description of the replication failure.


Active Directory Replication Latency

This report graphs the replication latency for the specified domain controller during the specified time period, displayed by 24-hour periods. The graph indicates the minimum, maximum, and average replication latency based on the MCSActiveDirectory-Replication Latency performance counter. This report provides one graph for each specified domain controller.


Exchange Server Reports

Updated descriptions of Exchange Server reports are in the Microsoft Operations Manager 2000 Application Management Pack Installation and Configuration Guide, located on the product CD.


Active Client Logons by Day

This report provides a graph of the active client logons for each specified server during the specified time period. The graph indicates the minimum, maximum, and average active client logons based on the MSExchangeIS Public/Active Client Logons performance counter. This report provides one graph for each specified server.


Average Time for Delivery by Day

This report provides a graph of the time for delivery for each specified server during the specified time period. The graph indicates the minimum, maximum, and average time for delivery based on the MSExchangeIS Public/Average Time for Delivery performance counter. This report provides one graph for each specified server.


Average Time for Local Delivery by Day

This report provides a graph of the time for local delivery for each specified server during the specified time period. The graph indicates the minimum, maximum, and average time for local delivery based on the MSExchangeIS Public/Average Time for Local Delivery performance counter. This report provides one graph for each specified server.


Client Logons by Day

This report provides a graph of the client logons for each specified server during the specified time period. The graph indicates the minimum, maximum, and average active client logons based on the MSExchangeIS Public/Client Logons performance counter. This report provides one graph for each specified server.


Message Recipients Delivered Per Minute by Day

This report provides a graph of the message recipients delivered per minute for each specified server during the specified time period. The graph indicates the minimum, maximum, and average number of message recipients delivered per minute based on the MSExchangeIS Public/Message Recipients Delivered/min performance counter. This report provides one graph for each specified server.


Messages Sent Per Minute by Day

This report provides a graph of the messages sent per minute for each specified server during the specified time period. The graph indicates the minimum, maximum, and average number of messages sent per minute based on the MSExchangeIS Public/Messages Sent/min performance counter. This report provides one graph for each specified server.


MTA Messages Per Second by Day

This report provides a graph of the MTA messages per second for each specified server during the specified time period. The graph indicates the minimum, maximum, and average number of MTA messages per second based on the MSExchangeMTA/Messages/Sec performance counter. This report provides one graph for each specified server.


MTA Work Queue Length by Day

This report provides a graph of the MTA work queue length for each specified server during the specified time period. The graph indicates the minimum, maximum, and average MTA work queue length based on the MSExchangeMTA/Work Queue Length performance counter. This report provides one graph for each specified server.


PCMTA File Contentions Per Hour by Day

This report provides a graph of the interactions between Exchange and MSMail for each specified server during the specified time period. The graph indicates the minimum, maximum, and average number of interactions based on the MSExchangePCMTA/File Contentions/hr performance counter. This report provides one graph for each specified server.


PCMTA LAN-WAN Messages Moved Per Hour by Day

This report provides a graph of the MSMail messages moved for each specified server during the specified time period. The graph indicates the minimum, maximum, and average number of messages moved based on the MsExchangePCMTA/LAN/WAN Message Moved/hr performance counter. This report provides one graph for each specified server.


Pending Replication Synchronizations by Day

This report provides a graph of the pending replication synchronizations for each specified server during the specified time period. The graph indicates the minimum, maximum, and average pending replication synchronizations based on the MSExchangeDS/Pending Replication Synchronizations performance counter. This report provides one graph for each specified server.


Remaining Replication Updates by Day

This report provides a graph of the remaining replication updates for each specified server during the specified time period. The graph indicates the minimum, maximum, and average remaining replication updates based on the MSExchangeDS/Remaining Replication Updates performance counter. This report provides one graph for each specified server.


Highest Growth Mailboxes

This report summarizes the Exchange mailboxes with the most growth during the specified period of time. Two days of data must be available for the report to display growth statistics. The columns of this report are defined as follows:

Mailbox
Specifies the name of the Exchange mailbox.
Server
Specifies the name of the server on which the mailbox identified in the Mailbox column is located.
Initial Message Count
Specifies the number of e-mails in the mailbox identified in the Mailbox column on the starting date specified in the report criteria.
Final Message Count
Specifies the number of e-mails in the mailbox identified in the Mailbox column on the ending date specified in the report criteria.
Initial Size (MB)
Specifies the size, in megabytes, of the mailbox identified in the Mailbox column on the starting date specified in the report criteria.
Final Size (MB)
Specifies the size, in megabytes, of the mailbox identified in the Mailbox column on the ending date specified in the report criteria.
Growth (MB)
Specifies the amount of growth, in megabytes, of the mailbox identified in the Mailbox column between the dates specified in the report criteria.


Highest Growth Public Folders

This report summarizes the Exchange public folders with the most growth during the specified period of time. Two days of data must be available for the report to display growth statistics. The columns of this report are defined as follows:

Folder
Specifies the name of the Exchange public folder.
Server
Specifies the name of the server on which the public folder identified in the Folder column is located.
Initial Message Count
Specifies the number of e-mails in the public folder identified in the Mailbox column on the starting date specified in the report criteria.
Final Message Count
Specifies the number of e-mails in the public folder identified in the Mailbox column on the ending date specified in the report criteria.
Initial Size (MB)
Specifies the size, in megabytes, of the public folder identified in the Mailbox column on the starting date specified in the report criteria.
Final Size (MB)
Specifies the size, in megabytes, of the public folder identified in the Mailbox column on the ending date specified in the report criteria.
Growth (MB)
Specifies the amount of growth, in megabytes, of the public folder identified in the Mailbox column between the dates specified in the report criteria.


Top 100 Mailboxes

This report provides a list of the top 100 mailboxes during a specified period of time. MOM Reporting provides this report sorted in several ways:

  • Top 100 Mailboxes by Message Count
  • Top 100 Mailboxes by Size

The columns of this report are defined as follows:

Mailbox
Specifies the name of the Exchange mailbox.
Server
Specifies the name of the server on which the mailbox identified in the Mailbox column is located.
Size (MB)
Specifies the size, in megabytes, of the mailbox identified in the Mailbox column.
Message Count
Specifies the number of e-mails in the mailbox identified in the Mailbox column.


Top 100 Public Folders

This report provides a list of the top 100 Exchange public folders during a specified period of time. MOM Reporting provides this report sorted in several ways:

  • Top 100 Public Folders by Message Count
  • Top 100 Public Folders by Size

The columns of this report are defined as follows:

Folder
Specifies the name of the Exchange public folder.
Server
Specifies the name of the server on which the public folder identified in the Folder column is located.
Size (MB)
Specifies the size, in megabytes, of the public folder identified in the Folder column.
Message Count
Specifies the number of e-mails in the public folder identified in the Folder column.


Internet Mail by Day

This report provides a graph of Internet mail usage for each specified server during the specified time period. The graph indicates the number of inbound and outbound SMTP events. These numbers are based on the following events from the application log:

  • 2000—A new TCP/IP SMTP connection has been received from host
  • 2003—A new TCP/IP SMTP connection has been made to the host

This report provides one graph for each specified server.


Internet News by Day

This report provides a graph of inbound newsgroup messages for each specified server during the specified time period. The graph indicates the number of inbound SMTP events. These numbers are based on the following events from the application log:

  • 11606—News article was pulled to this server and successfully posted to the following newsgroups
  • 11609—News article was pulled to this server and successfully posted to the following newsgroups

This report provides one graph for each specified server.


CC Mail Interface Activity

This report provides a graph of the interactions between Exchange and CC Mail for the specified server during the specified time period. Performance counter data is averaged by the hour. The graph displays the following performance counters:

  • MSExchangeCCMC / Microsoft Exchange MTS-IN (Scale=1)
  • MSExchangeCCMC / Microsoft Exchange MTS-OUT (Scale=1)


IMC Queue Lengths

This report provides a graph of the interactions between Exchange and Internet Mail Connector for the specified server during the specified time period. Performance counter data is averaged by the hour. The graph displays the following performance counters:

  • MSExchangeIMC / Queued MTS-IN (Scale=1)
  • MSExchangeIMC / Queued MTS-OUT (Scale=1)
  • MSExchangeIMC / Queued Outbound (Scale=1)
  • MSExchangeIMC / Queued Inbound (Scale=1)


Queue Sizes

This report provides a graph of several queue length performance counters for the specified server during the specified time period. Performance counter data is averaged by the hour. The graph displays the following queue length performance counters:

  • MSExchangeIS Public / Receive Queue Size (Scale=1)
  • MSExchangeIS Public / Replication Receive Queue Size (Scale=1)
  • MSExchangeIS Public / Send Queue Size (Scale=1)


Top 100 Exchange Recipients

This report provides a list of the top 100 Exchange recipients during a specified period of time, as reported in the Exchange Message Transfer Agent (MTA) log. Exchange recipients are mailboxes on this server receiving non-SMTP e-mails. MOM Reporting provides this report sorted in several ways:

  • Top 100 Exchange Recipients by Message Count
  • Top 100 Exchange Recipients by Size

The columns of this report are defined as follows:

Recipient
Specifies the mailbox that has received non-SMTP e-mail.
Server
Specifies the server where the MTA log is located.
Received (MB)
Specifies the total size, in megabytes, of the e-mails received by the mailbox identified in the Recipient column.
Message Count
Specifies the number of e-mails received by the mailbox identified in the Recipient column.


Top 100 Exchange Senders

This report provides a list of the top 100 Exchange senders during a specified period of time, as reported in the Exchange Message Transfer Agent (MTA) log. Exchange senders are mailboxes on this Exchange server that have sent non-SMTP e-mail. MOM Reporting provides this report sorted in several ways:

  • Top 100 Exchange Senders by Message Count
  • Top 100 Exchange Senders by Size

The columns of this report are defined as follows:

Sender
Specifies the Exchange mailbox where the e-mail originated.
Server
Specifies the server where the MTA log is located.
Sent (MB)
Specifies the size, in megabytes, of all e-mail sent by the mailbox identified in the Sender column.
Message Count
Specifies the number of e-mails sent by the mailbox identified in the Sender column.


Top 100 SMTP In Recipients

This report provides a list of the top 100 SMTP In recipients during a specified period of time, as reported in the Exchange Message Transfer Agent (MTA) log. SMTP In recipients are Exchange mailboxes that receive SMTP e-mail from the Internet. MOM Reporting provides this report sorted in several ways:

  • Top 100 SMTP In Recipients by Message Count
  • Top 100 SMTP In Recipients by Size

The columns of this report are defined as follows:

Recipient
Specifies the mailbox or public folder receiving the SMTP e-mail.
Server
Specifies the server where the MTA log is located.
Received (MB)
Specifies the size, in megabytes, of the SMTP e-mail received by the mailbox or public folder identified in the Recipient column.
Message Count
Specifies the number of SMTP e-mails received by the mailbox or public folder identified in the Recipient column.


Top 100 SMTP In Senders

This report provides a list of the top 100 SMTP In senders during a specified period of time, as reported in the Exchange Message Transfer Agent (MTA) log. SMTP In senders are Internet domains from which Exchange users receive SMTP e-mail. MOM Reporting provides this report sorted in several ways:

  • Top 100 SMTP In Senders by Message Count
  • Top 100 SMTP In Senders by Size

The columns of this report are defined as follows:

Sender
Identifies the domain portion of the Internet address from which the SMTP e-mail originated.
Server
Specifies the server where the MTA log is located.
Sent (MB)
Specifies the size, in megabytes, of the SMTP e-mail sent by the Internet domain identified in the Sender column.
Message Count
Specifies the number of SMTP e-mails sent by the Internet domain identified in the Sender column.


Top 100 SMTP Out Recipients

This report provides a list of the top 100 SMTP Out recipients during a specified period of time, as reported in the Exchange Message Transfer Agent (MTA) log. SMTP Out recipients are identified by the domain of the Internet address to which e-mail is sent from Exchange. MOM Reporting provides this report sorted in several ways:

  • Top 100 SMTP Out Recipients by Message Count
  • Top 100 SMTP Out Recipients by Size

The columns of this report are defined as follows:

Recipient
Specifies the domain name portion of the Internet address that has been sent SMTP e-mail from Exchange.
Server
Specifies the server where the MTA log is located.
Received (MB)
Specifies the size, in megabytes, of the SMTP e-mail sent to the Internet domain identified in the Recipient column.
Message Count
Specifies the number of SMTP e-mails sent to the Internet domain identified in the Recipient column.


Top 100 SMTP Out Senders

This report provides a list of the top 100 SMTP Out senders during a specified period of time, as reported in the Exchange Message Transfer Agent (MTA) log. SMTP Out senders are Exchange mailboxes that have sent e-mail to an Internet address. MOM Reporting provides this report sorted in several ways:

  • Top 100 SMTP Out Senders by Message Count
  • Top 100 SMTP Out Senders by Size

The columns of this report are defined as follows:

Sender
Specifies the Exchange mailbox that has sent SMTP e-mail. External domain names may appear as senders in this report if your Exchange server is forwarding external mail.
Server
Specifies the server where the MTA log is located.
Sent (MB)
Specifies the total size, in megabytes, of the SMTP e-mail sent by the mailbox identified in the Sender column.
Message Count
Specifies the number of SMTP e-mails sent by the mailbox identified in the Sender column.


Internet Information Services Reports

Internet Information Services reports include the following categories of information:

IIS Operations
These reports provide lists of common Internet Information Services operation-related events. The data for the IIS Events by Selected Client IP Address and IIS Events by Selected Client IP Address Summary reports, which can be extensive, is not collected by default. In many environments, the network and database overhead does not justify the data collection. See the Knowledge Base for the Internet Information Services Management Pack module for configuration information.
IIS Performance Analysis (Microsoft Operations Manager 2000 only)
These reports summarize IIS performance counters and help you analyze your IIS memory, network, disk, and connection performance.


IIS Access Summary

This report provides a summary of the access events occurring on the specified IIS Servers. You can select to view all the access events or only the unsuccessful access events. The report includes access events from the IIS log files. The columns of this report are defined as follows:

Server
Specifies the name of the IIS system that logged the event.
IP Address
Specifies the IP address that accessed the IIS Server.
Event Text
Specifies the text of the IIS event.
Event Count
Specifies the number of access events logged by the specified server.


IIS Events by Selected Client IP Address

This report provides a list of HTTP and FTP events generated from the specified IP addresses. The report includes all events from the IIS log files. The report is sorted by IP Address.

The columns of this report are defined as follows:

Label (IP Address)
Specifies the IP Address that accessed the IIS Server, with the label associated with it.
Server
Specifies the name of the IIS system that logged the event.
Date
Specifies the date and time the event was generated.
Target
Specifies the webpage that was the target for the client request.
Operation
Specifies the operation requested by the client.
Status
Specifies the status of the operation requested.


IIS Events by Selected Client IP Address Summary

This report provides a summary of HTTP and FTP events generated from the specified IP addresses. The report includes all events from the IIS log files. The report is sorted by IP Address.

The columns of this report are defined as follows:

Label
Specifies the label associated with the IP Address.
IP Address
Specifies the IP address that accessed the IIS Server.
Date
Specifies the date and time the event was generated.
Access Count
Specifies the number of access from the address identified in the IP Address column.


IIS Disk Performance Analysis

This report provides a graph of several IIS disk performance counters for the specified server during the specified time period. Performance counter data is averaged by the hour. The graph displays the following disk performance counters:

  • NBT Connection / Bytes Total Per Second (IIS 4.0; Scale=KB)
  • PhysicalDisk / % Disk Time (Scale=1)
  • Processor / % Total Processor Time (Scale=1)

Counters [Processor-% Processor Time (Scale = 1)] and [PhysicalDisk-% Disk Time (Scale = 1)] are plotted on primary y-axis. Counter [NBT Connection-Bytes Total/sec (Scale = MB)] is plotted on secondary y-axis.


IIS Error Rate Performance Analysis

This report provides a graph of several IIS error rate performance counters for the specified server during the specified time period. Error rate performance counter data is averaged by the hour. The graph displays the following performance counters:

  • Web Service / Not Found Errors Per Second (Scale=1)
  • Active Server Pages / Errors Per Second (Scale=1)


IIS FTP Service Connection Performance Analysis

This report provides a graph of several FTP service performance counters for the specified server during the specified time interval for all FTP service connection instances. Data for FTP service connection performance is sampled at 15-minute intervals and averaged by the hour. If FTP connections are short-lived, data about those connections may not get collected to view in this report.

If you need to view data for short-lived FTP service connections, you must reduce the sampling interval for the following performance counters. To modify the sampling interval, in the console tree, expand Rules, expand Processing Rule Groups, expand Microsoft Internet Information Services (IIS), expand IIS, expand Reporting Rules for IIS, right-click Performance Processing Rules, click Sample Performance Data, select the applicable data provider, click Modify, and then reduce the sampling interval as needed. Repeat this procedure for each of the following counters.

Reducing the sampling interval has a performance impact so you should evaluate this change in light of your specific monitoring requirements.

The report graph displays the following performance counters.

  • FTP Service / Current Anonymous Users (Scale=1)
  • FTP Service / Current Connections (Scale=1)
  • FTP Service / Current NonAnonymous Users (Scale=1)


IIS Memory Performance Analysis

This report provides a graph of several memory performance counters for the specified server during the specified time period. Memory performance counter data is averaged by the hour. The graph displays the following memory performance counters:

  • Memory / Available Bytes (Scale=MB)
  • Memory / Page Faults Per Second (Scale=1/10)
  • Memory / Page Reads Per Second (Scale=1)
  • Internet Information Services Global / Cache Hits % (IIS 5.0; Scale=1)
  • Internet Information Services Global / Cache Flushes (IIS 5.0; Scale=1)
  • Internet Information Services Global / File Cache Hits % (IIS 4.0; Scale=1/10)
  • Internet Information Services Global / File Cache Flushes (IIS 4.0; Scale=1/10)

Counters [Memory-Available Bytes (Scale = MB)], [Memory-Page Faults/sec (Scale = 1/10)], [Memory-Page Reads/sec (Scale = 1)], and [IIS Global-Cache Hits % (Scale = 1)] are plotted on primary y-axis. Counter [IIS Global-Cache Flushes (Scale = 1/10)] is plotted on secondary y-axis.


IIS Network Performance Analysis

This report provides a graph of several IIS network performance counters for the specified server during the specified time period. Network performance counter data is averaged by the hour. The graph displays the following network performance counters:

  • NBT Connection / Bytes Total Per Second (Scale=KB)
  • Web Service / Maximum Connections (Scale=1)
  • Web Service / Total Connection Attempts, all instances (Scale=1)

Counters NBT Connection-Bytes Total/sec and Web Service-Maximum Connections are plotted on primary y-axis, and counter Web Service-Total Connection Attempts is plotted on seconday y-axis.

This report helps you determine whether the network, disk or processor is acting as a bottleneck for your server. You should determine the bottleneck by determining which resource is near saturation.

If NBT connection: Bytes total/sec is close to the bandwidth of your network adapter and the other two performance counters are moderate, the network connection may be a bottleneck.

If the % Disk time performance counter is at saturation and other two counters are moderate, the disk may be a bottleneck for your server.


IIS NNTP Server Connection Performance Analysis

This report provides a graph of several performance counters for the specified server during the specified time period for all NNTP Server connection instances. Performance counter data is averaged by the hour. The graph displays the following NNTP Server connection performance counters:

  • NNTP Service / Current Anonymous Users (Scale=1)
  • NNTP Service / Current Connections (Scale=1)
  • NNTP Service / Current NonAnonymous Users (Scale=1)


IIS Web Service Connection Performance Analysis

This report provides a graph of several performance counters for the specified server during the specified time period. Performance counter data is averaged by the hour. The graph displays the following Web Service connection performance counters:

  • Web Service / Current Anonymous Users, Instance _Total (Scale=1)
  • Web Service / Current Connections, Instance _Total (Scale=1)
  • Web Service / Current NonAnonymous Users, Instance _Total (Scale=1)


Microsoft Operations Manager 2000

Microsoft Operations Manager 2000 Reports

These reports summarize Microsoft Operations Manager 2000 events, operations and information.


Alert Logging Latency

This report presents logging latency for alerts logged in the specified time period. Alert logging latency is the delay between the time an alert is raised by a computer and the time it is logged to the Microsoft Operations Manager 2000 (MOM) database. The report lists average, maximum, and minimum for alert logging latencies per computer, starting with the highest average value.

The columns of this report are defined as follows:

Computer
Specifies the name of the computer with MOM agent for which alert logging latency is specified.
Avg (seconds)
Specifies average value for alert logging latency.
Min (seconds)
Specifies minimum value for alert logging latency.
Max (seconds)
Specifies maximum value for alert logging latency.


Alert Resolution Times

This report provides the average delay in resolving alerts. The report lists average time spent by alerts in different resolution states during the specified time period. Resolution delays are categorized by alert severity and resolution state.

The columns of this report are defined as follows:

Alert Severity
Specifies the alert severity level: Service Unavailable, Security Breach, Critical Error, Error, Warning, Information, Success
Resolution State
Specifies the resolution state of the alert.
Avg Time (in minutes)
Specifies the average time spent by alert of given severity in the specified resolution state.

For each severity level, total number of new and resolved alerts during the specified time period are also included in the report.


Alerts By Severity

This report provides a graph of alerts raised during the specified time period categorized by alert severity level. The graph plots number of alerts raised per hour for each severity level.


Configuration Changes

This report summarizes the changes made to processing rules or the configuration group. Microsoft Operations Manager 2000 (MOM) logs these changes in the database. MOM Reporting provides this report sorted in several ways:

  • Configuration Changes by Table
  • Configuration Changes by Time
  • Configuration Changes by User

The columns of this report are defined as follows:

Table
Specifies the table modified in the database.
Time Logged
Specifies the date and time the change was logged.
User
Specifies the name of the user who made the change.
Action
Specifies the change that was made, such as Insert, Update, or Delete.
Interface
Specifies the MOM API that was called to make the change. Following each entry in this report, the report lists the parameters associated with the API call.

These reports are only generated when you have enabled Data Access Server (DAS) auditing. DAS auditing is CPU-intensive and stores a considerable amount of data in the database. By default, auditing is disabled. You can enable auditing in the Configuration properties dialog box.

Related Topics


Event Count by Agent by Day

This report provides a list of the number of events handled by Microsoft Operations Manager. The report is sorted by agent and date. The columns of this report are defined as follows:

Agent
Specifies the agent that generated the events.
Date
Specifies the date the event count represents.
Number of Events
Specifies the number of events handled by the agent identified in the Agent column for the day specified in the Date column.


Event Logging Latency

This report presents logging latency for events logged in the specified time period. Event logging latency is the delay between the time an event is generated by a computer and the time it is logged to MOM database. The report lists average, maximum and minimum for event logging latencies per computer, starting with the highest average value.

The columns of this report are defined as follows:

Computer
Specifies the name of the computer with MOM agent for which event logging latency is specified.
Avg (seconds)
Specifies average value for event logging latency.
Min (seconds)
Specifies minimum value for event logging latency.
Max (seconds)
Specifies maximum value for event logging latency.

For each severity level, total number of new and resolved alerts during the specified time period are also included in the report.


Install and Uninstall Approvals

This report summarizes the pending agent installation and removal actions that were logged during a specified period of time. The columns of this report are defined as follows:

Time Logged
Specifies the time the pending agent installation or removal action was logged.
Computer
Specifies the name of the computer involved in the pending agent installation or removal action.
Action
Identifies the type of installation or removal action pending.
Approved By
Specifies the name of the user who approved the pending action.

These reports are only generated when you have enabled Data Access Server (DAS) auditing. DAS auditing is CPU-intensive and stores a considerable amount of data in the database. By default, auditing is disabled. You can enable auditing in the Configuration properties dialog box.

Related Topics


Management Pack Licenses Required

This report summarizes total number of Base Application Management Pack Licenses required. The report lists all scanned computers that require Base Application Management Pack licenses. All computers that have agents installed are listed before computers that are scanned but have no agents installed. The columns of this report are defined as follows:

Computer
Provides the name of each computer that the Agent Manager detects.
Application Management Packs Required
Specifies the Application Management Packs required to monitor the detected computer.
Number of Processors
Specifies the number of processors present in the computer listed in the Computer column.
Agent Installed?
Indicates whether an agent is installed on the detected computer.

The total number of Base and Application Management Pack licenses required is given at the end of the list of computers. The number of Base Management Pack licenses required is made up from the total number of processors present in the machines that have the Microsoft Operations Manager 2000 (MOM) agent installed. The number of Application Management Pack licenses required is made up from the number of processors that require Application Management Pack and have the MOM agent installed.


Most Common Alerts

This report provides a list of the most common alerts. Use this report to identify alerts that occur too frequently, or alerts for which automated responses may be appropriate. MOM Reporting provides this report sorted in several ways:

  • Most Common Alerts by Computer Group
  • Most Common Alerts by Processing Rule Group
  • Most Common Alerts by Alert Count

The report displays the most frequent alerts in each group, in descending order of frequency. The columns of this report are defined as follows:

Computer Group
Specifies the computer group from which this alert came. This column is available only in the Most Common Alerts by Computer Group report.
Processing Rule Group
Specifies the processing rule group associated with this alert.
Data Provider
Specifies the data provider for this alert.
Alert Name
Specifies the name of the alert.
Alert Count
Specifies the number of times the alert identified in the Alert Name column occurred during the time period specified in the report criteria.
Activity
Specifies the percentage that this alert occurred compared to the total number of alerts.
Automation Script
Specifies the script that was run, if any, in response to this alert.


Most Common Events

This report provides a list of the most common events. The report lists the top 25 percent of these events, based on the event count. The report is sorted by the event count, with the event that occurred most often listed first.

The columns of this report are defined as follows:

Source
Specifies the source of the event.
Log
Specifies the log in which the event was recorded, such as System, Security, or Application.
Event Type
Specifies the status of the logged event as determined by the application that generated the event log entry, such as Error, Warning, Information, Failure, or Success.
Event #
Specifies the number of the event.
Event Count
Specifies the number of times the event identified in the Source and Event # columns occurred during the time period specified in the report criteria.
Activity
Specifies the percentage that this event occurred compared to the total number of events.
Sample Text
Specifies a sample text string from the event text field.


Total Monitored Computers

This report provides a list of all computers scanned in this configuration group, the type of computer, and whether an agent is installed.

The columns of this report are defined as follows:

Domain
Specifies the domain of the computer listed in the Computer column.
Type
Specifies whether the computer listed in the Computer column is a Server or Workstation.
Computer
Specifies the name of the scanned computer.
Is Monitored?
Specifies whether an agent is installed on the computer listed in the Computer column.
Windows Version
Specifies the version of Windows operating system installed on the computer listed in the Computer column.
Service Pack
Specifies the version of the service pack installed on the computer listed in the Computer column.
Hotfixes List
Specifies the list of hotfixes installed on the computer listed in the Computer column.


Remote Access Service Reports

These reports summarize RAS connection events.

Note

  • Reports are sorted by user account name, with the most recent event listed first.


Remote Access Connections by User

This report provides a list of remote connections. The report includes RAS connection events (20048—Windows 2000; 20050—Windows NT) from the System event log with the Remote Access source. The report is sorted by user account name, with the most recent event listed first.

The columns of this report are defined as follows:

User Account
Specifies the name of the user account that logged on to the remote access server.
Server
Specifies the name of the remote access server to which the connection was made.
Port
Specifies the port on the remote access server used for the connection.
Bps
Specifies the transmission rate, in bytes per second, for the connection.
Sent
Specifies the number of bytes sent.
Recv
Specifies the number of bytes received.
Connected
Specifies the date and time the user account identified in the User Account column requested the connection.
Disconnected
Specifies the date and time the user account identified in the User Account column ended the connection. If this column is blank, the user did not end the connection within the date and time range specified in the report criteria. For a logon and logoff to be paired, the logon ID (session) must be identical.
Time Connected
Specifies the amount of time connected, calculated as the difference between the times in the Connected and Disconnected columns.
Logoff
Specifies the reason for the end of the connection.


SQL Server Reports

Updated descriptions of SQL Server reports are in the Microsoft Operations Manager 2000 Application Management Pack Installation and Configuration Guide, located on the product CD.


SQL Server User Connections Capacity Planning

This report provides a graph of the daily SQL Server user connections for the specified server during the specified time period, displayed by day or by peak hours. The graph indicates the minimum, maximum, and average user connections capacity based on the SQL Server / General Statistics - User Connections performance counter for SQL Server 7.0. This report provides one graph for each specified server.


SQL Server Backup Device Capacity Planning

This report is available only for SQL Server 7.0. It provides a graph of the daily usage of the SQL Server backup device. The graph indicates the minimum, maximum, and average backup device capacity based on the Backup Device / Device Throughput Bytes Per Second performance counter. This report provides one graph for each specified server.


SQL Server Critical Events

This report lists critical events (Event Type = 'Error') for source MSSQLServer, that have occurred on the specified server in the specified time period. This report is sorted alphabetically by server and by event time. The columns of this report are defined as follows:

Server | Specifies the name of the server on which the event occurred.
Time | Specifies the time the event occurred.
User | Specifies the user account that generated the event.
Category | Specifies the category of the event.
Event # | Specifies the event number.
Message | Specifies the message associated with the event.


SQL Server Critical Events Trend by Day

This report provides a daily graph of all critical events (Event Type = 'Error') for source MSSQLServer, that have occurred on the specified server in the specified time period.


SQL Server Distribution Replication Performance Analysis

This report is available only for SQL Server 2000. It provides a graph of several SQL Server distribution replication performance counters for the specified server during the specified time period. Performance counter data is averaged by the hour. The graph displays the following replication performance counters:

  • SQLServer:Replication Dist. / Dist:Delivered Commands Per Second (Scale=1/100)
  • SQLServer:Replication Dist. / Dist:Delivered Transactions Per Second (Scale=1/100)
  • SQLServer:Replication Dist. / Dist:Delivery Latency (Scale=1/100)


SQL Server Lock Performance Analysis

This report is available only for SQL Server 2000. It provides graphs of SQL Server lock performance counters for specified servers during the specified time period. Performance counter data is averaged by the hour. The graph displays the following lock performance counters:

  • SQLServer:Locks / Number of Deadlocks Per Second (Scale=1)
  • SQLServer:Locks / Lock Requests Per Second (Scale=1/100)
  • SQLServer:Locks / Lock Waits Per Second (Scale=1/10)

The graph displays the following instance for each server/performance counter combination:

  • Database
  • Extend
  • Key
  • Page
  • Rid
  • Table


SQL Server Log Performance Analysis

This report provides a graph of SQL Server 2000 transaction log performance counters for the specified server during the specified time period, where the database instance is not Total, master, msdb, model, Northwind, or pubs. Performance counter data is averaged by the hour. This report provides one graph for each database instance.

For a SQL Server 2000 database, the graph displays the following log performance counters:

  • SQLServer:Databases / Log Flushes Per Second (Scale=1/100)
  • SQLServer:Databases / Log Flush Wait Time (Scale=1/100)
  • SQLServer:Databases / Log Flush Waits Per Second (Scale=1/1000)


SQL Server Logreader Replication Performance Analysis

This report is available only for SQL Server 2000. It provides a graph of several SQL Server logreader replication performance counters for the specified server during the specified time period. Performance counter data is averaged by the hour. The graph displays the following logreader replication performance counters:

  • SQLServer:Replication Logreader / Logreader:Delivered Commands Per Second (Scale=1\100)
  • SQLServer:Replication Logreader / Logreader:Delivered Transactions Per Second (Scale=1\100)
  • SQLServer:Replication Logreader / Logreader:Delivery Latency (Scale=1\1000)


SQL Server Memory Performance Analysis

This report provides a graph of several SQL Server memory performance counters for the specified server during the specified time period. Performance counter data is averaged by the hour. The graph displays the following memory performance counters:

  • Process:Page Faults Per Second (sqlservr) (Scale=1/10)
  • Process:Private Bytes (sqlservr) (Scale=MB)
  • SQLServer:Memory Manager / Total Server Memory (SQL Server 7.0; Scale=KB)
  • SQLServer:Buffer Manager / Buffer Cache Hit Ratio (SQL Server 7.0; Scale=1)
  • SQLServer:Buffer Manager / Free Buffers (SQL Server 7.0; Scale=1/10)
  • SQLServer:Buffer Manager / Lazy Writes Per Second (SQL Server 7.0; Scale=1/10)
  • SQLServer:Buffer Manager / Readahead Pages Per Second (SQL Server 7.0; Scale=1/10)
  • SQLServer / Cache Hit Ratio (SQL Server 6.5; Scale=1)
  • SQLServer:Cache / Number of Free Buffers (SQL Server 6.5; Scale=1/10)
  • SQLServer:I/O / Lazy Writes Per Second (SQL Server 6.5; Scale=1/10)
  • SQLServer:RA / Pages Fetched into Cache per Second (SQL Server 6.5; Scale=1/10)


SQL Server Merge Replication Performance Analysis

This report is available only for SQL Server 2000. It provides a graph of several SQL Server merge replication performance counters for the specified server during the specified time period. Performance counter data is averaged by the hour. The graph displays the following merge replication performance counters:

  • SQLServer:Replication Merge / Conflicts Per Second (Scale=1\100)
  • SQLServer:Replication Merge / Downloaded Changes Per Second (Scale=1\100)
  • SQLServer:Replication Merge / Uploaded Changes Per Second (Scale=1\100)


SQL Server Overall Replication Performance Analysis

This report provides a graph of several SQL Server overall replication performance counters for the specified server during the specified time period. Performance counter data is averaged by the hour. The graph displays the following replication performance counters:

  • SQLServer:Databases / Replication Pending Xacts (SQL Server; Scale=1\100)
  • SQLServer:Databases / Replication Transaction Rate (SQL Server; Scale=1\100)
  • SQLServer Replication Published DB / Replicated Transactions Per Second


SQL Server Snapshot Replication Performance Analysis

This report is available only for SQL Server 2000. It provides a graph of several SQL Server snapshot replication counters for the specified server during the specified time period. Performance counter data is averaged by the hour. The graph displays the following snapshot replication performance counters:

  • SQLServer:Replication Snapshot / Snapshot:Delivered Commands Per Second (Scale=1\100)
  • SQLServer:Replication Snapshot / Snapshot:Delivered Transactions Per Second (Scale=1\100)


Windows 2000 Reports

Windows 2000 reports include the following categories of information:

Windows 2000 Capacity Planning
These reports summarize the Windows 2000 server resource usage and help you plan for current and future capacity needs.
Windows 2000 Operations
These reports summarize the Windows 2000 network operations, such as connections and spooled print jobs.
Windows 2000 Performance Analysis
These reports graph Windows 2000 performance counters and help you analyze CPU, disk, and memory performance.


Disk Queue Length

MOM Reporting provides this report sorted in several ways:

  • Disk Queue Length by Day (24-hour period)
  • Disk Queue Length by Peak Hours (7:00 A.M. to 7:00 P.M.)

This report provides a graph of the disk queue length for each specified server during the specified time period. The graph indicates the minimum, maximum, and average daily usage based on the PhysicalDisk / Average Disk Queue Length performance counter. This report provides one graph for each specified server.


Disk Space Capacity Planning

This report provides a graph of the disk space capacity for each specified server during the specified time period. The graph indicates the minimum, maximum, and average daily usage based on the LogicalDisk / % Free Space performance counter. This report provides one graph for each specified server.


Memory Capacity Planning

MOM Reporting provides this report sorted in several ways:

  • Memory Capacity Planning by Day (24-hour period)
  • Memory Capacity Planning by Peak Hours (7:00 A.M. to 7:00 P.M.)

This report provides a graph of the memory capacity for each specified server during the specified time period. The graph indicates the minimum, maximum, and average daily usage based on the Memory / Pages Per Second performance counter. This report provides one graph for each specified server.


Processor Capacity Planning

MOM Reporting provides this report sorted in several ways:

  • Processor Capacity Planning by Day (24-hour period)
  • Processor Capacity Planning by Peak Hours (7:00 A.M. to 7:00 P.M.)

This report provides a graph of the processor capacity for each specified server during the specified time period. The graph indicates minimum, maximum, and average daily usage. For Windows NT computers, the performance counter is System / % Total Processor Time. For Windows 2000 computers, the performance counter is Processor / Processor Time Instance_Total. This report provides one graph for each specified server.


Server Capacity Planning

MOM Reporting provides this report sorted in several ways:

  • Server Capacity Planning by Day (24-hour period)
  • Server Capacity Planning by Peak Hours (7:00 A.M. to 7:00 P.M.)

This report provides a graph of the server capacity for each specified server during the specified time period. The graph indicates the minimum, maximum, and average daily usage based on the Server + Redirector / Bytes Total Per Second performance counter. This report provides one graph for each specified server.


Application Log Summary

This report provides a summary count of the events from the Application event log. The report is sorted by the system that logged the event, as well as the event type and number.

The columns of this report are defined as follows:

Server
Specifies the name of the system that logged the event.
Event Type
Specifies the status of the event: Information, Warning, or Error.
Event #
Specifies the number of the event.
Source
Specifies the source of the event.
Sample Text
Specifies the text of the event.
Count
Specifies the number of events that match the values displayed in the corresponding row of this report.


Application Log Trend by Day

This report provides a graph of the application log trend for each specified server during the specified time period. The graph indicates the number of unfiltered events generated from the application log. This report provides one graph for each specified server.


Computer Availability

This report summarizes the percentage of time each computer was available during the specified period of time. MOM Reporting provides this report sorted in several ways:

  • Computer Availability by Computer Group
  • Computer Availability by Server

The columns of this report are defined as follows:

Computer Group
Provides the name of the computer group specified in the report criteria. This column is available only in the Computer Availability by Computer Group report.
Computer Name
Provides the name of each computer specified in the report criteria.
Uptime Sampling Date Range
Provides the date range from the first time Microsoft Operations Manager 2000 recorded an uptime event. The ending date is the date specified in the report criteria. This column is available only in the Computer Availability by Server report.
Availability
Identifies the percentage of time the computer was available during the time specified in the report criteria.


Logon Failure Events

This report provides a list of the logon failure events. The report includes the following events from the Security event log:

  • 529—Unknown user name or bad password
  • 530—Account logon time restriction violation
  • 531—Account currently disabled
  • 532—The specified user account has expired
  • 533—User not allowed to log on at this computer
  • 534—The user has not been granted the requested logon type at this machine
  • 535—The password for the specified account has expired
  • 536—The NetLogon component is not active
  • 537—An unexpected error occurred during logon
  • 539—Account locked out
  • 548—Domain security ID inconsistent

The columns of this report are defined as follows:

User Account
Specifies the name of the user account that had the logon failure.
Event Time
Specifies the time of the logon failure.
Server
Specifies the name of the server where the logon failure occurred.
Event #
Specifies the event number.
Reason For Failure
Specifies the reason for failure.


Network Connections to Other Computers

This report provides a list of network connections to other computers. The report includes the following events from the Security event log with the Kerberos or NtLmSsplogon process:

  • 540—Successful Logon
  • 540—Successful Logoff

The report is sorted by user account name and logon event, with the most recent logon event listed first. The columns of this report are defined as follows:

User Account
Specifies the name of the user account that requested the connection.
Logon
Specifies the date and time the user account identified in the User Account column requested the connection.
Logoff
Specifies the date and time the user account identified in the User Account column ended the connection. If this column is blank, the user did not end the connection within the date and time range specified in the report criteria. For a logon and logoff to be paired, the logon ID (session) must be identical.
Elapsed Time
Specifies the difference between the logon and logoff times in the Logon and Logoff columns.
Logged On
Specifies the name of the system connecting to a network share.
Connected To
Specifies the name of the system to which the connection was made.


PDC-BDC Full Synchronizations by Server

This report provides a summary of full synchronizations from the PDC to the BDC during the time specified. The report includes the full synchronization events (5713) from the System event log with the NetLogon source. The report is sorted by PDC Name, and by the BDC Name and Date.

The columns of this report are defined as follows:

PDC Name
Specifies the name of the PDC that made the synchronization.
BDC Name
Specifies the name of the BDC to which the PDC identified in the PDC columns synchronized.
Date
Specifies the date and time the synchronization took place.
Number of Objects
Specifies the number of objects included in the synchronization.


PDC-BDC Partial Synchronizations by Server

This report provides a summary of partial synchronizations from the PDC to the BDC during the time specified. The report includes the partial synchronization events (5715) from the System event log with the NetLogon source. The report is sorted by PDC Name, as well as by the BDC Name and Date.

The columns of this report are defined as follows:

PDC Name
Specifies the name of the PDC that made the synchronization.
BDC Name
Specifies the name of the BDC to which the PDC identified in the PDC columns synchronized.
Date
Specifies the date and time the synchronization took place.
Replicated Database
Specifies the name of the database replicated.
Number of Objects
Specifies the number of objects included in the synchronization.


Security Log Summary

This report provides a summary count of the events from the Security event log. The report is sorted by the system that logged the event, and the event type and number.

The columns of this report are defined as follows:

Server
Specifies the name of the system that logged the event.
Event Type
Specifies the status of the event: Success or Failure.
Event #
Specifies the number of the event.
Category
Specifies the category of the event.
Sample Text
Specifies the text of the event.
Count
Specifies the number of events that match the values displayed in the corresponding row of this report.


Security Log Trend by Day

This report provides a graph of the security log trend for each specified server during a specified time period. The graph indicates the number of unfiltered events generated from the security log. This report provides one graph for each specified server.


Service Availability

This report summarizes the percentage of time each service was available during the specified period of time. If you do not specify a period of time, MOM Reporting calculates the percentage of time each service was available since the first service availability event was received. MOM Reporting provides this report sorted in several ways:

  • Service Availability by Computer Group
  • Service Availability by Server
  • Service Availability by Service

The columns of this report are defined as follows:

Computer Group
Provides the name of the computer group specified in the report criteria.
Server
Provides the name of each server specified in the report criteria.
Service
Provides the name of each service on the servers identified in the Server column.
Days/Hours Available
Identifies the amount of time the service identified in the Service column was available during the time specified in the report criteria.
Availability
Identifies the percentage of time the service was available during the time specified in the report criteria.


Server Restarts by Day

This report provides a summary of server restarts for the servers, dates, and times specified. The report includes the 512 - Windows NT is starting up events from the Security event log: The report is sorted by server.

The columns of this report are defined as follows:

Server
Specifies the server that restarted.
Date
Specifies the date the server restarted.
Number of Restarts
Specifies number of times the server identified by the Server column restarted on the date identified by the Date column.


Spooled Jobs

This report provides a list of spooled print jobs. MOM Reporting provides this report sorted in several ways:

  • spooled jobs by page count
  • spooled jobs by printer
  • spooled jobs by user

The report includes the print job events from the System event log. The columns of this report are defined as follows:

Pages
Specifies the number of printed pages for a print job.
Server
Specifies the name of the print server on which the print job was spooled.
User Account
Specifies the name of the user account that initiated the print job. The system or domain name of the user account is not available for spooled print jobs.
Date
Specifies the date and time the event was logged.
Doc ID
Specifies the identification number, also known as the order of request, for the print job.
Printer
Specifies the name of the printer to which the print job was spooled.
Size
Specifies the size, in bytes, of the print job.
Doc Title
Specifies the title of the file being printed.


System Clean Shutdown Events

This report provides a list of the system clean shutdown events. The report includes the 6006—The Event log service was stopped events from the System event log.

The columns of this report are defined as follows:

Server
Specifies the name of the server that shut down.
Event Time
Specifies the time the server shut down.


System Dirty Shutdown Events

This report provides a list of the system dirty shutdown events. The report includes the 6008—The previous system shutdown was unexpected events from the System event log.

The columns of this report are defined as follows:

Server
Specifies the name of the server that shut down.
Event Time
Specifies the time the server shut down.
Event Text
Specifies text of the shutdown event.


System Log Summary

This report provides a summary count of the events from the System event log. The report is sorted by the system that logged the event, as well as the event type and number.

The columns of this report are defined as follows:

Server
Specifies the name of system that logged the event.
Event Type
Specifies the status of the event: Information, Warning, or Error.
Event #
Specifies the number of the event.
Source
Specifies the source of the event.
Sample Text
Specifies the text of the event.
Count
Specifies the number of events that match the values displayed in the corresponding row of this report.


System Log Trend by Day

This report provides a graph of the system log trend for each specified server during the specified time period. The graph indicates the number of unfiltered events generated from the system log. This report provides one graph for each specified server.


System Shutdown Events

This report provides a list of the system shutdown events. The report includes the following events from the System event log:

  • 6006—The Event log service was stopped
  • 6008—The previous system shutdown was unexpected

The columns of this report are defined as follows:

Server
Specifies the name of the server that shut down.
Event Time
Specifies the time the server shut down.
Event #
Specifies the event number of the shutdown event.
Event Name
Specifies the name of the shutdown event.
Event Text
Specifies text of the shutdown event.


User Account Changes

This report provides a list of all User Account Management events logged during the specified time period. The list is grouped by server where the event is generated and sorted by time. The report includes the following events from the Security event log:

  • 624—User account created
  • 627—Change password attempt
  • 628—User account password set
  • 630—User account deleted
  • 642—User account changed, including user account enabled/disabled changes

The columns of this report are defined as follows:

Server
Specifies the name of the server where the user account was changed.
Event Time
Specifies the time when the event was generated.
Target User Account
Specifies the user account which was changed.
Event #
Specifies the event number.
Event Description
Specifies brief description of the change applied.
Change Applied By
Specifies the user account that applied the change

Data in some columns will not be available if event parameters are not getting stored for the events. To get data in all columns, confirm that event parameters are getting stored by the rules collecting user account change events.


CPU Performance Analysis

This report provides a graph of several CPU performance counters for the specified server during the specified time period. Performance counter data is averaged by the hour. The graph displays the following memory performance counters:

  • Processor / % Processor Time (Windows 2000; Scale=1)
  • Processor / % User Time (Windows 2000; Scale=1)
  • Processor / % Privileged Time (Windows 2000; Scale=1)
  • System / % Total Processor Time (Windows NT; Scale=1)
  • System / % Total User Time (Windows NT; Scale=1)
  • System / % Total Privileged Time (Windows NT; Scale=1)
  • System / Context Switches Per Second (Scale=1/1000)
  • System / Processor Queue Length (Scale=10/1)


Disk Performance Analysis

This report provides a graph of several disk performance counters for the specified server during the specified time period. Performance counter data is averaged by the hour. The graph displays the following disk performance counters:

  • PhysicalDisk / Average Disk Queue Length (Scale=100/1)
  • PhysicalDisk / Average Disk Seconds Per Transfer (Scale=1000/1)
  • PhysicalDisk / Disk Reads Per Second (Scale=1)
  • PhysicalDisk / Disk Writes Per Second (Scale=1)
  • PhysicalDisk / Disk Bytes Per Second (Scale=1/10000)


Memory Performance Analysis

This report provides a graph of several memory performance counters for the specified server during the specified time period. Performance counter data is averaged by the hour. The graph displays the following memory performance counters:

  • Memory / Available Bytes (Scale=MB)
  • Memory / Committed Bytes (Scale=MB)
  • Memory / Pages Per Second (Scale=1)
  • Memory / Page Reads Per Second (Scale=1)
  • Memory / Page Writes Per Second (Scale=1)
  • Process / Page File Bytes (Scale=MB)

Counters [Memory-Available Bytes (Scale = MB)],[Memory-Committed Bytes (Scale = MB)],and [Process-Page File Bytes-_Total (Scale = MB)] are plotted on primary y-axis and counters. [Memory-Pages/sec (Scale = 1)],[Memory-Page Reads/sec (Scale = 1)],and [Memory-Page Writes/sec (Scale = 1)] are plotted on secondary y-axis.


Server Performance Analysis

This report provides a graph of several server performance counters for the specified server during the specified time period. Performance counter data is averaged by the hour. The graph displays the following server performance counters:

  • Server / Bytes Total Per Second (Scale=KB)
  • Server / Files Open (Scale=1)
  • Server / Server Sessions (Scale=1)


Top CPU Utilization

This report lists servers with highest average CPU utilization during the specified time period. CPU utilization is measured by counter Processor: %Processor Time. The list is ordered by average value for counter, starting with the highest value.

Top n or n % servers are listed in the report based on the selection criteria. By default, the top five percent of the highest CPU utilized servers are presented.

The columns of this report are defined as follows:

Server
Specifies the name of the server for which CPU utilization is presented.
Avg (% Processor Time)
Specifies average value for counter Processor: %Processor Time.
Min (% Processor Time)
Specifies minimum value for counter Processor: %Processor Time.
Max (% Processor Time)
Specifies maximum value for counter Processor: %Processor Time.


Top Disk Utilization

This report lists servers with the highest average disk utilization during the specified time period. Disk utilization is measured by percent non-idle disk time calculated as (100 - PhysicalDisk: %Idle Time). The list is ordered by values in column Avg (100-%Idle Time), starting with the highest value.

Top n or n % servers are listed in the report based on the selection criteria. By default, the top five percent of the highest disk utilized servers are presented.

The columns of this report are defined as follows:

Server
Specifies the name of the server for which disk utilization is presented.
Avg (100-%Idle Time)
Specifies average value for % non-idle disk time (100- PhysicalDisk: %Idle Time).
Min (100-%Idle Time)
Specifies minimum value for % non-idle disk time (100- PhysicalDisk: %Idle Time).
Max (100-%Idle Time)
Specifies maximum value for % non-idle disk time (100- PhysicalDisk: %Idle Time).


Top Memory Utilization

This report lists servers with the highest average memory utilization during the specified time period. Memory utilization is measured by counter Memory: Page Reads/sec. The list is ordered by average value for counter, starting with the highest value.

Top n or n % servers are listed in the report based on the selection criteria. By default, the top five percent of highest memory utilized servers are presented.

The columns of this report are defined as follows:

Server
Specifies the name of the server for which disk utilization is presented.
Avg (Page Reads/sec)
Specifies average value for counter Memory: Page Reads/sec.
Min (Page Reads/sec)
Specifies minimum value for counter Memory: Page Reads/sec.
Max (Page Reads/sec)
Specifies maximum value for counter Memory: Page Reads/sec.


Windows Terminal Server Reports

Windows Terminal Server (WTS) reports provide information about WTS memory and processor usage and service availability.


Windows Terminal Server Total Sessions

This report provides a graph of the Windows Terminal Server session performance counters for the specified server during the specified time period. Reports are based on the Terminal Services-Active Sessions and Terminal Services-Inactive Sessions performance counters for Windows 2000 servers. For Windows NT, counters used are System-Active Sessions and System-Inactive Sessions.


Windows Terminal Server Memory Usage

This report provides a graph of several Windows Terminal Server performance counters for the specified server during the specified time period. For Microsoft Windows 2000, the performance object is Terminal Services Session. For Microsoft Windows NT, the performance object is Session. The graph displays the following performance counters:

  • Total Bytes (Scale=.01)
  • Input Bytes (Scale=.01)
  • Output Bytes (Scale=.01)
  • Page File Bytes (Scale=.000001)
  • Pool Nonpaged Bytes (Scale=.00001)
  • Pool Paged Bytes (Scale=.00001)


Windows Terminal Server Processor Usage

This report provides a graph of the processor capacity for each specified Windows Terminal Server server during the specified time period. The graph indicates the minimum, maximum, and average daily usage based on the Process / % Processor Time performance counter. The instance is termsrv. This report provides one graph for each specified server.


Windows Terminal Server Service Availability

This report summarizes the percentage of time the Terminal Services service was available during the specified period of time. If you do not specify a period of time, MOM Reporting calculates the percentage of time the service was available since the first service availability event was received. The columns of this report are defined as follows:

Server
Provides the name of each server specified in the report criteria.
Days/Hours of Availability
Identifies the amount of time the Terminal Services service was available during the time specified in the report criteria.
Availability
Identifies the percentage of time the Terminal Services service was available during the time specified in the report criteria.


Company Knowledge Base Window

Allows you to view and modify the company-specific knowledge base. The fields are defined as follows:

Enter any company knowledge ...
Specifies the text of the company knowledge base comment.
Alert resolution history
Specifies the history of changes to alert fields and customer comments accumulated during alert resolution. This field is available only in the Monitor snap-in.


Connect to Configuration Group Window

Allows you to specify a configuration group to manage with the snap-in. The fields are defined as follows:

Default configuration group for this computer
Specifies that the snap-in manages the configuration group with a database on the local computer.
Another computer ___
Specifies that the snap-in manages the configuration group with a database on the specified computer.
Monitor
Specifies that the Web Console displays a view of the Monitor snap-in. This field is available only for the Console snap-in.
Rules
Specifies that the Web Console displays a view of the Rules snap-in. This field is available only for the Console snap-in.
Configuration
Specifies that the Web Console displays a view of the Configuration snap-in. This field is available only for the Console snap-in.


Copyrights & Acknowledgements Window

Allows you to view information in for the product license. The fields are defined as follows:

This product is licensed to
Specifies the customer name, customer number, product serial number, and license expiration date.
Additional information
Specifies supplementary product information.
Acknowledgements
Specifies third-party support and credits.


HTML Properties Window

The HTML Properties window of MOM Reporting allows you to specify options for saving reports as HTML files. These options specify where MOM Reporting saves the HTML files, as well as the file to use as the template for the saved reports. When you install MOM Reporting, these options are set to the appropriate default values for MOM Reporting on the local computer. For more information about publishing HTML reports, see Publishing HTML Reports.

Specify the desired values, and then click OK. The fields on this window are defined as follows:

HTML output root directory
Specifies the directory in which the saved reports are stored, such as C:\Program Files\Microsoft Operations Manager 2000\Event\Reports. MOM Reporting creates a folder in the specified directory for each report that is saved in HTML format. MOM Reporting then saves each report as an HTML file in the appropriate folder.
HTML template file
Specifies the location of the template file used for each report saved as HTML. This field must be a fully qualified HTML file name, such as C:\Program Files\Microsoft Operations Manager 2000\Event\Reports\MCSrept.html. The default template file ensures correct navigation and styles are provided in each report. You can customize the template file to meet your specific needs.

Related Topics


Print Report Set Window

The Print Report Set window of MOM Reporting allows you to view, print, and save multiple reports. Select the desired reports, and then click the button for the desired action. For more information, see Viewing or Printing Multiple Reports.


Agent Managers Window

Allows you to view the status of agents on all Agent Manager computers in the current configuration group. The status bar displays the number of Agent Managers and their status, such as running or stopped. The fields are defined as follows:

Agent Status
Specifies the status of the agent on the Agent Manager computer, such as Running or Stopped.
Computer
Specifies the name of the computer on which the Agent Manager is located.
Domain
Specifies the domain in which the Agent Manager is located.
Ignore Status
Specifies whether the Monitor and Consolidator ignore data from the agent, regardless of agent status or loss of contact.


Agents Window

Allows you to view the status of all agents in the current configuration group. The status bar displays the number of agents and their status, such as running or stopped. The fields are defined as follows:

Agent Status
Specifies the status of the agent, such as Running or Stopped.
Computer
Specifies the computer on which the agent is installed.
Domain
Specifies the domain in which the agent is located.
Last Contact
Specifies the time of the last contact between the agent and the Consolidator.
Ignore Status
Specifies whether the Monitor and Consolidator ignore data from the agent, regardless of agent status or loss of contact.
Agent Manager
Specifies the Agent Manager that manages this agent.
Managed Type
Specifies the role of the Agent Manager with this agent. This column displays choices made if the agent was manually installed. This column can display one of the following descriptions:

  • Agent Manager manages this agent
  • Agent Manager does not manage this agent
  • Agent Manager manages this agent but cannot upgrade it


Alert Properties, Detected Condition Tab

Allows you to view detailed information for an alert. The fields are defined as follows:

Severity
Specifies the severity of the alert, such as Warning or Security Breach.
Computer
Specifies the computer on which the alert occurred.
Source
Specifies the user-defined name identifying the source of the alert. If no name is defined, this field defaults to the event source name.
Raised
Specifies the date and time when the alert occurred. All times are in the time zone of the local computer.
Name
Specifies the name of the processing rule that generated the alert.
Repeat Count
Specifies the number of identical alerts that this instance represents.
Description
Specifies the description of the alert. This column uses the text that Windows provides in the event description.
GUID
Specifies a globally unique identifier for the alert. You can use this GUID to locate a specific alert.
View Rule
Displays the processing rule that generated the alert.


Alert Properties, Events Tab

Allows you to view the events that created the alert. The fields are defined as follows:

Type
Specifies the event type, such as Warning or Error.
Time
Specifies the time the event occurred. The time is specified in the time zone of the local computer.
Computer
Specifies the computer on which the event occurred.
Provider Type
Specifies the type of event provider that generated the event, such as Windows event log.
Provider Name
Specifies the name of the event provider, such as Application or Security.
Source
Specifies the application that logged the event, such as OnePointService or MSSQL Server.
Event ID
Specifies the Windows event number.
Description
Specifies the description of the event.

To view the properties of an event, select an event, and then click Properties.


Alert Properties, History Tab

Allows you to view changes made to alert fields and comments entered about the alert. The fields are defined as follows:

Resolution history
Specifies the history of changes to alert fields, such as changes in the owner, resolution state, or custom fields.


Alert Properties, Knowledge Base Tab

Allows you to view and edit the knowledge base for the processing rule that generated the alert. The fields are defined as follows:

Microsoft Knowledge Base
Specifies knowledge base information for the processing rule that generated the alert. This field is available only if Microsoft Operations Manager 2000 provides knowledge base information for the processing rule.
Company Knowledge Base
Specifies saved comments and information about the processing rule that generated the alert. You can enter company-specific comments in this field.

To edit the company knowledge base, click Edit.


Alert Properties, State Tab

Allows you to specify custom alert fields and alert properties. The fields are defined as follows:

Resolution state
Specifies the status of the resolution process of the alert, such as New or Resolved. The resolution state indicates whether the resolution process has begun.
Owner
Specifies the person responsible for tracking and resolving the alert.
Comment (append to resolution history)
Specifies a user comment appended to the resolution history.
CustomField1 through CustomField5
Specifies the values of user-defined alert fields.

Custom fields can have custom names. For more information, see Configuring Custom Fields for Alerts.


Alert View Window

Allows you to display alerts that meet criteria you specify. The default alert views are the All Open Alerts Window and the All Service Level Exceptions Window. Each row in the right pane displays data for a single alert. The default columns in an alert view are defined as follows:

Severity
Specifies the severity of the alert, such as Service Unavailable or Success.
Time
Specifies the date and time that the alert was raised. The time is shown in the time zone of local computer.
Computer
Specifies the computer on which an agent generated the alert.
Resolution State
Specifies the status of the resolution process of the alert, such as New or Resolved. The resolution state indicates whether the resolution process has begun.
Time in State
Specifies the amount of time the alert has been in the current resolution state.
Owner
Specifies the person responsible for tracking and resolving the alert.
Source
Specifies the user-defined name identifying the source of the alert. If no name is defined, this field defaults to the event source name.
Name
Specifies the name of the processing rule that generated the alert.
Description
Specifies the description of the alert. This column uses the text that Windows provides in the event description.

To add columns to the right pane, click View on the menu bar, and then click Columns on the View menu. You can add the following columns:

Agent Directory
Specifies the folder where the Microsoft Operations Manager 2000 agent software is installed on the computer on which the alert was generated.
CustomFieldx
Specifies the values of user-defined alert fields.
Domain
Specifies the domain to which the computer belongs.
GUID
Specifies the globally unique identifier for the alert.
Repeat Count
Specifies the number of duplicate identical alerts that this instance represents.


Alert View Properties, Criteria Tab

Allows you to change the criteria that define an alert view. The fields are defined as follows:

Which alerts do you want to view?
Specifies criteria for alerts you want to include in the alert view.
View description (click an underlined value to edit it)
Specifies the values of the criteria for alerts to include in the alert view.


Alert View Properties, General Tab

Allows you specify general alert view properties. The fields are defined as follows:

View name
Specifies the name of the alert view.
Description
Specifies descriptive text for the alert view.
Autorefresh view every ___ seconds
Specifies whether to automatically refresh the data in the alert view and, if so, how often.
Page size ___ items
Specifies the number of alerts to display per page.


Alert View Properties, View Type Tab

Allows you to select a custom or predefined alert view type. The fields are defined as follows:

Which type of alert view do you want to create?
Specifies the type of alert view to create. You can select a view that uses predefined criteria, or you can define custom criteria by selecting the Alerts that satisfy specified criteria alert view type.
View description
Provides a description of the alert view selected. This field is read-only.


All Agents Window

Allows you to view summary information for all computers containing Microsoft Operations Manager 2000 (MOM) agents in the configuration group. Each row in the right pane displays information for an individual computer. Computers are sorted by alert severity and computer name. The fields are defined as follows:

Severity
Specifies the most severe unresolved alert for the computer.
Computer
Specifies the name of the computer.
Description
Specifies the description of the computer.
Last Contact
Specifies the last time the agent on the computer contacted a Consolidator.
New Alerts
Specifies the number of alerts with a resolution state of New.
Service Unavailable
Specifies the number of unresolved alerts with a severity of Service Unavailable.
Critical Error
Specifies the number of unresolved alerts with a severity of Critical Error.
Error
Specifies the number of unresolved alerts with a severity of Error.
Warning
Specifies the number of unresolved alerts with a severity of Warning.

To add columns to the right pane, click View on the menu bar, and then click Columns on the View menu. You can add the following columns:

Agent Directory
Specifies the folder where the MOM agent software is installed on the computer.
Agent Installed
Specifies whether an agent is installed on the computer.
Custom Data1
Specifies a user-defined, user-populated column.
Custom Data2
Specifies a user-defined, user-populated column.
Domain
Specifies the domain to which the computer belongs.
GUID
Specifies the globally unique identifier for the computer.
Information
Specifies the number of unresolved alerts with an alert severity of Information.
Security Breach
Specifies the number of unresolved alerts with an alert severity of Security Breach.
Success
Specifies the number of unresolved alerts with an alert severity of Success.
Type
Specifies the type of the computer, such as server, workstation, primary domain controller (PDC), or backup domain controller (BDC).


All Computers Window

Allows you to view summary information for all computers in the configuration group. Each row in the right pane displays information for an individual computer. Computers are sorted by alert severity and computer name. The fields are defined as follows:

Severity
Specifies the most severe unresolved alert for the computer.
Computer
Specifies the name of the computer.
Description
Specifies the description of the computer.
Last Contact
Specifies the last time the agent on the computer contacted a Consolidator.
New Alerts
Specifies the number of alerts with a resolution state of New.
Service Unavailable
Specifies the number of unresolved alerts with a severity of Service Unavailable.
Critical Error
Specifies the number of unresolved alerts with a severity of Critical Error.
Error
Specifies the number of unresolved alerts with a severity of Error.
Warning
Specifies the number of unresolved alerts with a severity of Warning.

To add columns to the right pane, click View on the menu bar, and then click Columns on the View menu. You can add the following columns:

Agent Directory
Specifies the folder where the Microsoft Operations Manager 2000 agent software is installed on the computer.
Agent Installed
Specifies whether an agent is installed on the computer.
Custom Data1
Specifies a user-defined, user-populated column.
Custom Data2
Specifies a user-defined, user-populated column.
Domain
Specifies the domain to which the computer belongs.
GUID
Specifies the globally unique identifier for the computer.
Information
Specifies the number of unresolved alerts with an alert severity of Information.
Security Breach
Specifies the number of unresolved alerts with an alert severity of Security Breach.
Success
Specifies the number of unresolved alerts with an alert severity of Success.
Type
Specifies the type of the computer, such as server, workstation, primary domain controller (PDC), or backup domain controller (BDC).


All Computer Groups Window

Allows you to view summary information for all computer groups in the current configuration group. Each row in the right pane displays information for an individual computer group. The fields are defined as follows:

Severity
Specifies the most severe unresolved alert for all computers in the computer group.
Computer Group
Specifies the name of the computer group.
Members
Specifies the number of computers that belong to the computer group.


All Open Alerts Window

Allows you to view summary information for all alerts in the current configuration group with a resolution state other than Resolved. Each row in the right pane displays information for a single alert. Alerts are sorted by the time that they occurred, with the most recent alert first. The fields are defined as follows:

Severity
Specifies the severity of the alert, such as Service Unavailable or Success.
Time
Specifies the date and time the alert was generated.
Computer
Specifies the computer on which the alert was generated.
Resolution State
Specifies the status of the resolution process of the alert, such as New or Resolved. The resolution state indicates whether the resolution process has begun.
Owner
Specifies the person responsible for tracking and resolving the alert.
Source
Specifies the user-defined name identifying the source of the alert. If no name is defined, this field defaults to the event source name.
Name
Specifies the name of the processing rule that generated the alert.
Description
Specifies the description of the alert.

To add columns to the right pane, click View on the menu bar, and then click Columns on the View menu. You can add the following columns:

Agent Directory
Specifies the folder where the Microsoft Operations Manager 2000 agent software is installed on the computer on which the alert was generated.
CustomFieldX
Specifies the values of user-defined alert fields.
Domain
Specifies the domain to which the computer belongs.
GUID
Specifies the globally unique identifier for the alert.
Repeat Count
Specifies the number of duplicate alerts that this instance represents.
Time in State
Specifies the amount of time the alert has been in the current resolution state.


All Other Events Window

Allows you to view summary information for events from all providers, except for the Windows Event Log provider, in the current configuration group. Each row in the right pane displays data for a single event. Events are sorted by occurrence, with the most recent event first. The fields are defined as follows:

Type
Specifies the type of the event, such as Error, Warning, or Information.
Time
Specifies the date and time at which the event occurred. The time is shown in the time zone of the local computer.
Computer
Specifies the computer on which the event occurred.
Provider Type
Specifies the type of event provider that generated the event.
Provider Name
Specifies the name of the event provider, such as Application, Internally Generated Event or Security.
Source
Specifies the application that logged the event, such as the Microsoft Operations Manager 2000 Agent.
Event ID
Specifies the Windows event number.
Description
Specifies the description of the event.

To add columns to the right pane, click View on the menu bar, and then click Columns on the View menu. You can add the following columns:

Agent
Specifies the agent that detected the event.
Agent Directory
Specifies the folder where the Microsoft Operations Manager 2000 agent software is installed on the computer on which the event was generated.
Agent Domain
Specifies the domain to which the agent computer belongs.
Category
Specifies the text string that describes the event.
Consolidated
Specifies whether this event represents a number of consolidated events and, if so, the number of consolidated events this instance of the event represents.
Domain
Specifies the domain to which the computer belongs.
Generated Alerts
Specifies whether the event generated an alert and, if so, how many alerts the event generated.
GUID
Specifies the globally unique identifier for the event.
User
Specifies the name of the Windows account that generated the event.


All Performance Window

Allows you to view the number of performance measurements taken for each computer in the configuration group. The fields are defined as follows:

Computer
Specifies the name of the computer.
Counters
Specifies the number of performance measurements taken for the computer.

To add columns to the right pane, click View on the menu bar, and then click Columns on the View menu. You can add the following columns:

Domain
Specifies the domain to which the computer belongs.


All Service Level Exceptions Window

Allows you to view alerts that have remained in a resolution state longer than the time specified by the Service Level Agreement. This view does not include Information or Success alerts. The fields are defined as follows:

Severity
Specifies the severity of the alert, such as Security Breach.
Time
Specifies the date and time that the alert occurred.
Computer
Specifies the name of the computer on which the alert occurred.
Resolution State
Specifies the status of the resolution process of the alert, such as New or Resolved. The resolution state indicates whether the resolution process has begun.
Time in State
Specifies the amount of time the alert has been in the current resolution state.
Owner
Specifies the person responsible for tracking and resolving the alert.
Source
Specifies the user-defined name identifying the source of the alert. If no name is defined, this field defaults to the event source name.
Name
Specifies the name of the processing rule that generated the alert.
Description
Specifies the description of the alert. This column uses the text that Windows provides in the event description.

To add columns to the right pane, click View on the menu bar, and then click Columns on the View menu. You can add the following columns:

Agent Directory
Specifies the folder where the Microsoft Operations Manager 2000 agent software is installed on the computer on which the alert was generated.
CustomFieldX
Specifies the values of user-defined alert fields.
Domain
Specifies the domain to which the computer belongs.
GUID
Specifies the globally unique identifier for the alert.
Repeat Count
Specifies the number of duplicate alerts that this instance represents.


All Windows Events Window

Allows you to view summary information for Windows events in the current configuration group. Each row in the right pane displays data for a single event. Events are sorted by occurrence, with the most recent event first. The fields are defined as follows:

Type
Specifies the type of the event, such as Error, Warning, or Information.
Time
Specifies the date and time at which the event occurred. The time is shown in the time zone of the local computer.
Computer
Specifies the computer on which the event occurred.
Provider Type
Specifies the type of event provider that generated the event, such as a Windows event log.
Provider Name
Specifies the name of the event provider, such as Application or Security.
Source
Specifies the application that logged the event, such as OnePointService or MSSQL Server.
Event ID
Specifies the Windows event number.
Description
Specifies the description of the event.

To add columns to the right pane, click View on the menu bar, and then click Columns on the View menu. You can add the following columns:

Agent
Specifies the agent that detected the event.
Agent Directory
Specifies the folder where the Microsoft Operations Manager 2000 agent software is installed on the computer on which the event was generated.
Agent Domain
Specifies the domain to which the agent computer belongs.
Category
Specifies the Windows text string that describes the event.
Consolidated
Specifies whether this event represents a number of consolidated events and, if so, the number of consolidated events this instance of the event represents.
Domain
Specifies the domain to which the computer belongs.
Generated Alerts
Specifies whether the event generated an alert and, if so, how many alerts the event generated.
GUID
Specifies the globally unique identifier for the event.
User
Specifies the name of the Windows account that generated the event.


Attribute Value Properties, Details Tab

Allows you to view the details of an attribute. The fields are defined as follows:

Computer
Specifies the domain and name of the computer on which the attribute was collected.
Name
Specifies the name of the attribute.
Description
Specifies the description of the attribute.
Type
Specifies the type, such as string or integer, of the attribute collected.
Value
Specifies the value of the attribute collected.
Time collected
Specifies the date and time when the attribute was collected.


Attribute View Window

Allows you to view attributes collected on computers in the current configuration group. The fields in an attribute view are defined as follows:

Name
Specifies the name of the attribute.
Time
Specifies the date and time when the attribute was collected. The time is shown in the time zone of the local computer.
Computer
Specifies the name of the computer on which the attribute was collected.
Domain
Specifies the domain to which the computer belongs.
Value
Specifies the value of the attribute collected.
Type
Specifies the type, such as string or integer, of the attribute collected.

To add columns to the right pane, click View on the menu bar, and then click Columns on the View menu. You can add the following columns:

Agent Directory
Specifies the folder where the Microsoft Operations Manager 2000 agent software is installed on the computer where the attribute was collected.
GUID
Specifies the globally unique identifier for the attribute.


Attribute View Properties, Criteria Tab

Allows you to change the criteria for an attribute view. The fields are defined as follows:

Which computer attributes do you want to view?
Specifies criteria for computer attributes you want to include in the attribute view.
View description (click an underlined value to edit it)
Specifies the values of the criteria for computer attributes to include in the attribute view.


Attribute View Properties, General Tab

Allows you specify general attribute view properties. The fields are defined as follows:

View name
Specifies the name of the attribute view.
Description
Specifies descriptive text for the attribute view.
Autorefresh view every ___ seconds
Specifies whether to automatically refresh the data in the attribute view and, if so, how often.


Attribute View Properties, View Type Tab

Allows you to select a computer attribute view type. The fields are defined as follows:

Which type of computer attribute view do you want to create?
Specifies the type of alert view to create.
View description
Provides a description of the alert view selected. This field is read-only.


Columns Window

Allows you to add, remove, and rearrange columns in the right pane of the console window. The fields are defined as follows:

Available columns
Specifies the columns you can add to right pane of the console window.
Displayed columns
Specifies the columns currently displayed in the right pane of the console window. The right pane of the console window displays columns in the order listed.

To add a column to the right pane of the console window, select the column in the Available columns field, and then click Add.

To remove a column from the right pane of the console window, select the column in the Displayed columns field, and then click Remove.

To move a column up in the order to be displayed, select the column in the Displayed columns field, and then click Move Up.

To move a column down in the order to be displayed, select the column in the Displayed columns field, and then click Move Down.

To reset the columns displayed to the default setting, click Reset.


Computer Group View Properties, Criteria Tab

Allows you to change the criteria for a computer group view. The fields are defined as follows:

Which computer groups do you want to view?
Specifies criteria for computer groups you want to include in the computer group view.
View description (click an underlined value to edit it)
Specifies the values of the criteria for computers to include in the computer group view.


Computer Group View Properties, General Tab

Allows you specify general computer group view properties. The fields are defined as follows:

View name
Specifies the name of the computer group view.
Description
Specifies descriptive text for the computer group view.
Autorefresh view every ___ seconds
Specifies whether to automatically refresh the data in the computer group view and, if so, how often.


Computer Group View Properties, View Type Tab

Allows you to select a custom or predefined computer group view type. The fields are defined as follows:

Which type of computer group view do you want to create?
Specifies the type of computer group view to create. You can select a view that uses predefined criteria, or you can define custom criteria by selecting the Computer groups that satisfy specified criteria computer group view type.
View description
Provides a description of the computer group view selected. This field is read-only.


Computer Group View Window

Allows you to view computer groups that meet specified criteria. The default computer group view is the All Computer Groups Window. Each row in the right pane displays data for a single computer group. The fields in a computer group view are defined as follows:

Severity
Specifies the most severe unresolved alert for the computer group.
Computer Group
Specifies the name of the computer group.
Members
Specifies the number of computers in the computer group.


Computer Performance View Window

Allows you to view the number of performance measurements taken for specified computers in the configuration group. The default computer performance view is the All Performance Window. The fields in a computer performance view are defined as follows:

Computer
Specifies the name of the computer.
Counters
Specifies the number of performance measurements taken for the computer.

To add columns to the right pane, click View on the menu bar, and then click Columns on the View menu. You can add the following columns:

Domain
Specifies the domain to which the computer belongs.


Computer Performance View Properties, Criteria Tab

Allows you to specify the criteria for an computer performance view. The fields are defined as follows:

Which computers do you want to view?
Specifies criteria for computers you want to include in the computer performance view.
View description (click an underlined value to edit it)
Specifies the values of the criteria for computers to include in the computer performance view.


Computer Performance View Properties, General Tab

Allows you specify general computer performance view properties. The fields are defined as follows:

View name
Specifies the name of the computer performance view.
Description
Specifies descriptive text for the computer performance view.
Autorefresh view every ___ seconds
Specifies whether to automatically refresh the data in the computer performance view and, if so, how often.


Computer Properties, Computer Detail Tab

Allows you to view properties for a computer. The fields are defined as follows:

Domain
Specifies the domain to which the computer belongs.
Name
Specifies the name of the computer
Type
Specifies the computer type, such as server, workstation, primary domain controller (PDC), or backup domain controller (BDC).
Description
Specifies the description of the computer.
Last heartbeat
Specifies the last time the agent contacted a Consolidator. The time is shown in the time zone of the local computer.
Custom data 1
Specifies a user-defined, user-populated field.
Custom data 2
Specifies a user-defined, user-populated field.
Alerts
Specifies the current number of new and unresolved alerts, by severity.


Computer Properties, Computer Groups Tab

Allows you to view the computer groups to which this computer belongs. The fields are defined as follows:

Name
Specifies the name of the computer group.
Description
Specifies the description the computer group.


Computer Properties, Processing Rules Tab

Allows you to view the processing rules associated with this computer.


Computer View Properties, Criteria Tab

Allows you to change the criteria for an computer view. The fields are defined as follows:

Which computers do you want to view?
Specifies criteria for computers you want to include in the computer view.
View description (click an underlined value to edit it)
Specifies the values of the criteria for computers to include in the computer view.


Computer View Properties, General Tab

Allows you specify general computer view properties. The fields are defined as follows:

View name
Specifies the name of the computer view.
Description
Specifies descriptive text for the computer view.
Autorefresh view every ___ seconds
Specifies whether to automatically refresh the data in the computer view and, if so, how often.


Computer View Properties, View Type Tab

Allows you to select a custom or predefined computer view type. The fields are defined as follows:

Which type of computer view do you want to create?
Specifies the type of computer view to create. You can select a view that uses predefined criteria, or you can define custom criteria by selecting the Computers that satisfy specified criteria computer view type.
View description
Provides a description of the computer view selected. This field is read-only.


Computer View Window

Allows you to view information about computers in the configuration group. The default computer views are the All Computers Window and the All Agents Window. Each row in the right pane displays information for a single computer. The fields in a computer view are defined as follows:

Severity
Specifies the most severe unresolved alert for the computer.
Computer
Specifies the name of the computer.
Description
Specifies the description of the computer.
Last Contact
Specifies the last time the agent on the computer contacted a Consolidator.
New Alerts
Specifies the number of alerts with a resolution state of New.
Service Unavailable
Specifies the number of unresolved alerts with a severity of Service Unavailable.
Critical Error
Specifies the number of unresolved alerts with a severity of Critical Error.
Error
Specifies the number of unresolved alerts with a severity of Error.
Warning
Specifies the number of unresolved alerts with a severity of Warning.

To add columns to the right pane, click View on the menu bar, and then click Columns on the View menu. You can add the following columns:

Agent Directory
Specifies the folder where the Microsoft Operations Manager 2000 agent software is installed on the computer.
Agent Installed
Specifies whether an agent is installed on the computer.
Custom Data1
Specifies a user-defined, user-populated column.
Custom Data2
Specifies a user-defined, user-populated column.
Domain
Specifies the domain to which the computer belongs.
GUID
Specifies the globally unique identifier for the computer.
Information
Specifies the number of unresolved alerts with an alert severity of Information.
Security Breach
Specifies the number of unresolved alerts with an alert severity of Security Breach.
Success
Specifies the number of unresolved alerts with the alert severity of Success.
Type
Specifies the type of the computer, such as Server, Workstation, Primary Domain Controller (PDC), or Backup Domain Controller (BDC).


Consolidators Window

Allows you to view all Consolidators in the current configuration group. The status bar displays the number of Consolidators and their status, such as running or stopped. The fields are defined as follows:

Agent Status
Specifies the status of the agent on the Consolidator computer, such as Running or Stopped.
Computer
Specifies the name of the computer on which the Consolidator is located.
Domain
Specifies the domain in which the Consolidator is located.
Ignore Status
Specifies whether the Monitor and Consolidator ignore data from the agent, regardless of agent status or loss of contact.


Custom Task Properties Window

Allows you to modify a custom task. The fields are defined as follows:

Name
Specifies the name of the custom task.
Description
Specifies the description of the custom task.
Command
Specifies the command to be executed by the custom task.


Custom Task Window

Allows you to can modify, and delete tasks that send information collected by Microsoft Operations Manager 2000 to a third-party application. The fields are defined as follows:

Task available to
Specifies Microsoft Operations Manager 2000 users who can use this task.
Task available for
Specifies the type of information the task is available for, such as events or alerts.
Current available tasks
Specifies existing custom tasks.

To add a task, click Add.

To modify a task, select the task in the Current available tasks field, and then click Modify.

To delete a task, select the task in the Current available tasks field, and then click Delete.


Defaults for New Views Window

Allows you to specify default settings for new views. When you create a new view, settings for that view will default to these settings. You can override these default settings when you create the new view. The fields are defined as follows:

Autorefresh view every ___ seconds
Specifies whether to automatically refresh the data in the view and, if so, how often. This field does not apply to event views.
Page size ___ items
Specifies the number of items to display per page.

Related Topics


Event Properties, Advanced Tab

Allows you to view the message .dll information and binary data associated with an event. The fields are defined as follows:

Bytes
Specifies to display event data in byte format. This field is available only if there is event data to display.
Words
Specifies to display event data in word format (4-byte blocks). This field is available only if there is event data to display.
Name
Specifies the name of the message .dll file associated with the event.
Language
Specifies the language of the message .dll file associated with the event.
Version
Specifies the version number of the message .dll file associated with the event.


Event Properties, Alerts Tab

Allows you to view alerts generated from this event. The fields are defined as follows:

Severity
Specifies the severity of the alert, such as Critical Error or Security Breach.
Resolution State
Specifies the status of the resolution process of the alert, such as New or Resolved. The resolution state indicates whether the resolution process has begun.
Owner
Specifies the person responsible for resolving the alert.
Source
Specifies the user-defined name identifying the source of the alert. If no name is defined, this field defaults to the event source name.
Description
Specifies the Windows event description.
Time
Specifies the time and date when the alert occurred. The time and date are displayed in the time zone of the local computer.


Event Properties, Event Detail Tab

Allows you to view detailed event properties. The fields are defined as follows:

Computer
Specifies the computer on which the event occurred.
Date
Specifies the date on which the event occurred. The date is shown in the time zone of the local computer.
Time
Specifies the time when the event occurred. The time is shown in the time zone of the local computer.
Source
Specifies the application that logged the event, such as OnePointService or MSSQL Server.
Event ID
Specifies the Windows event number.
Description
Specifies the description of the event.
GUID
Specifies a globally unique identifier for the event. You can use this GUID to locate a specific event.


Event Properties, More Detail Tab

Allows you to view more detailed event properties. The fields are defined as follows:

Type
Specifies the event type, such as Error, Warning, or Information.
Category
Specifies the category of the event defined by the provider.
User
Specifies the name of the Windows account logged onto the computer that triggered the event.
Agent
Specifies the name of the computer running the Microsoft Operations Manager 2000 agent that captured the event.
Type
Specifies the type of event provider that generated the event, such as a Windows event log.
Name
Specifies the name of the event provider, such as Security or Application.
Consolidated ___ events
Specifies the number of identical events that this instance of the event represents. This field is available for consolidated events only.
From ___ to ___
Specifies the time period in which the events were consolidated.


Event Properties, Parameters Tab

Allows you to view substitution parameters from Windows events or parsed named parameters from WMI events. The fields are defined as follows:

Position
Specifies the position of the event parameter in the event message.
Name
Specifies the name of the event parameter.
Value
Specifies the value of the event parameter.


Event View Window

Allows you to view events that meet specified criteria. The default event view is the All Windows Events Window. Event views do not refresh automatically. To refresh the data in an event view, see Refreshing the Right Pane.

Each row in the right pane displays data for a single event. The columns in an event view are defined as follows:

Type
Specifies the Windows event type, such as error, warning, or information.
Time
Specifies the date and time at when the event occurred. The time is shown in the time zone of local computer.
Computer
Specifies the name of the computer on which the event occurred.
Provider Type
Specifies the type of event provider that generated the event, such as a Windows event log.
Provider Name
Specifies the name of the event provider, such as Application or Security.
Source
Specifies the application that logged the event, such as OnePointService or MSSQL Server.
Event ID
Specifies the Windows event number.
Description
Specifies the description of the event.

To add columns to the right pane, click View on the menu bar, and then click Columns on the View menu. You can add the following columns:

Agent
Specifies the agent that detected the event.
Agent Directory
Specifies the folder where the Microsoft Operations Manager 2000 agent software is installed on the computer on which the event was generated.
Agent Domain
Specifies the domain to which the agent belongs.
Category
Specifies the Windows text string that describes the event.
Consolidated
Specifies whether this event represents a number of identical events consolidated by a consolidation processing rule and, if so, the number of consolidated events this event represents.
Domain
Specifies the domain to which the computer belongs.
Generated Alerts
Specifies whether the event generated an alert and, if so, how many alerts the event generated.
GUID
Specifies the globally unique identifier for the event.
User
Specifies the name of the Windows account logged onto the computer that generated the event.


Event View Properties, Criteria Tab

Allows you to change the criteria for an event view. The fields are defined as follows:

Which events do you want to view?
Specifies criteria for events you want to include in the event view.
View description (click an underlined value to edit it)
Specifies the values of the criteria for events to include in the event view.


Event View Properties, General Tab

Allows you specify general event view properties. The fields are defined as follows:

View name
Specifies the name of the event view.
Description
Specifies descriptive text for the event view.
Autorefresh view every ___ seconds
Disabled for event views. For more information about refreshing event views, see Refreshing the Right Pane.
Page size ___ items
Specifies the number of event to display per page.


Event View Properties, View Type Tab

Allows you to select a custom or predefined event view type. The fields are defined as follows:

Which type of event view do you want to create?
Specifies the type of event view to create. You can select a view that uses predefined criteria, or you can define custom criteria by selecting the Events that satisfy specified criteria event view type.
View description
Provides a description of the event view selected. This field is read-only.


My Views Window

Provides a storage location for private views. Private views are accessible only by the user who created them. The user who created private views can access them from any MOM Administrator Console or Web Console. You can create private views within this folder or move views into it. Moving a view into the My Views folder makes it a private view accessible through any MOM Administrator Console or Web Console in the configuration group.

Related Topics


Performance Data View Properties, Criteria Tab

Allows you to change the criteria for a performance data view. The fields are defined as follows:

Which performance data do you want to view?
Specifies criteria for performance data you want to include in the performance data view.
View description (click an underlined value to edit it)
Specifies the values of the criteria for performance data to include in the performance data view.


Performance Data View Properties, General Tab

Allows you specify general performance data view properties. The fields are defined as follows:

View name
Specifies the name of the performance data view.
Description
Specifies descriptive text for the performance data view.
Autorefresh view every ___ seconds
Specifies whether to automatically refresh the data in the performance data view and, if so, how often.


Performance Data View Properties, Graph Tab

Specifies to display performance data collected in the specified time period in performance data graphs. The fields are defined as follows:

Within the time range
Specifies the start and stop dates and times for the data to include in the performance data graph.
After
Specifies the start date and time for performance data to include in the performance data graph.
Before
Specifies the end date and time for performance data to include in the performance data graph.
In the last
Specifies to include performance data collected over the past specified number of days, hours, or minutes.
Display performance graph as default view
Specifies that the performance graph data is saved to the database and the performance graph view is set as the default view.
Display all counter graphs as default
Specifies that the counter graph data is saved to the database and all counter graphs display by default when you select to view the data in graph mode.


Performance Data View Properties, View Type Tab

Allows you to select a custom or predefined performance data view type.The fields are defined as follows:

Which type of performance data view do you want to create?
Specifies the type of performance data view to create. You can select a view that uses predefined criteria, or you can define custom criteria by selecting the Performance data that satisfy specified criteria performance data view type.
View description
Provides a description of the performance data view selected. This field is read-only.


Performance Data View Window

Allows you to view numeric data, which you can display graphically. The default columns in a performance data view are defined as follows:

Computer
Specifies the computer on which the performance data was collected.
Object
Specifies the performance object, which is an item that represents a process, a section of shared memory, or a physical device.
Counter
Specifies the performance object counter used to report performance values.
Instance
Specifies the performance counter instance used to report performance values.
Time
Specifies the date and time when the performance data was collected. The time is shown in the time zone of the local computer.
Value
Specifies the numeric value of the counter.
Graph
Specifies whether the values for the selected performance data are graphed.

You can add the following columns to your display:

Domain
Specifies the domain to which the computer belongs.
Scale
Specifies the scaling factor for graphing performance data.


Public Views Window

Provides a storage location for public views. Public views are accessible by anyone accessing the configuration group database from a MOM Administrator Console or Web Console. Management Pack modules provide many public views. You can create views within the Public Views folders, or you can create views and copy them into these folders. Moving a view into the Public Views folder publishes the view for other users to access through any MOM Administrator Console or Web Console in the configuration group.

Related Topics


Temporary Views Window

Provides a temporary storage location for dynamic views. Microsoft Operations Manager 2000 (MOM) creates these views when you select and view specific information. For example, if you search for an alert, MOM displays the search window in the Temporary Views folder. MOM automatically deletes a temporary view when you close it. Temporary views do not require user interaction.

Name
Specifies the name of the dynamic view that MOM creates.


Agent Manager Properties, Managed Computer Rules Tab

Allows you to view, create, and modify the Managed Computer rules associated with an Agent Manager. The Managed Computer rules define the Managed Computers list of an Agent Manager. Before Microsoft Operations Manager 2000 will install an agent on a computer, the computer must be included in the Managed Computers list of an Agent Manager and the computer must match a computer grouping rule. The columns are defined as follows:

Domain
Specifies the domain to which the computer must belong for the computer to match the Managed Computer rule.
Computer
Specifies the criteria for the computer to match the Managed Computer rule.
Type
Specifies the type of computer that matches the Managed Computer rule. Examples are workstation, server, primary domain controller (PDC), or backup domain controller (BDC).
Include
Specifies whether this Managed Computer rule is an include rule (Yes) or an exclude rule (No). To be included in the Managed Computers list of an Agent Manager, the computer must match an include rule, and not match an exclude rule.

To create a new Managed Computer rule, click Add.

To modify an existing Managed Computer rule, select a rule, and then click Modify.


Agent Manager Properties, Managed Computers Tab

Allows you to view and change the settings for computers in the Managed Computers list. The columns are defined as follows:

Computer
Specifies the name of the computer in the Managed Computers list.
Domain
Specifies the domain to which the computer belongs.
Agent Installed
Specifies whether an agent is installed on the computer.

To change the settings for a computer in the Managed Computers list, select the computer, and then click Settings.

To exclude a computer from the Managed Computers list, select the computer, and then click Exclude.

To uninstall an agent from a computer in the Managed Computers list, select the computer, and then click Uninstall Now.


Agent Managers Window

Allows you to view and modify the properties of the Agent Managers in the configuration group. The columns are defined as follows:

Domain
Specifies the domain in which the Agent Manager computer is located.
Name
Specifies the name of the computer on which the Agent Manager is installed.
Account
Specifies the service account used by the Agent Manager.
Agent Installs
Specifies whether the Agent Manager automatically installs agents or requires approval before installing agents.
Scan Time
Specifies the time of day when the Agent Manager scans computers to install and uninstall agents.
Scan Frequency
Specifies how often (in days) the Agent Manager scans computers to install and uninstall agents.
Status
Specifies the activity status of the Agent Manager.

To modify the properties of an Agent Manager, complete the following steps:

  1. Select an Agent Manager in the right pane.
  2. Click Action on the menu bar.
  3. Click Properties on the Action menu.


Agent Managers Properties, Agent Installation Tab

Allows you to specify how agents are installed or uninstalled. The fields are defined as follows:

Automatically install agents on managed computers as required
Specifies that the Agent Manager automatically installs agents on computers as necessary. This field is available only if you uncheck the Use global settings field.
Add agent to Pending Installations list as required
Specifies that the Agent Manager will add a pending action to the Pending Installations list and wait for confirmation before installing or uninstalling agents. For more information about confirming agent installation or uninstallation, see Handling Pending Installations. This field is available only if you uncheck the Use global settings field.
Wait ___ hours before uninstalling unneeded agents
Specifies the time delay before the Agent Manager uninstalls an agent that is no longer needed. This field is available only if you uncheck the Use global settings field.
Use global settings
Specifies whether this Agent Manager uses the settings for Agent Managers configured in the Global Settings window. This field is available only in individual Agent Manager Properties windows.
Show reboot warning
Specifies whether a reboot warning should appear during the agent installation process. A reboot may be necessary if a system file that needs to be upgraded is busy.


Agent Managers Properties, Agent Service Account Tab

Allows you to specify the service account for the agents that the Agent Manager installs. The fields are defined as follows:

Local system
Specifies that the agent will log on with the system account rather than a user account. This field is available only if you uncheck the Use global settings field.
Another service account
Specifies the user account with which the agent will log on. This field is available only if you uncheck the Use global settings field.
User name
Specifies the service account user name.
Password
Specifies the service account password.
Use global settings
Specifies whether this Agent Manager uses the settings for Agent Managers configured in the Global Settings window. This field is available only in individual Agent Manager Properties windows.


Agent Managers Properties, Managed Computer Scan Tab

Allows you to specify when and how often the Agent Manager scans computers in the Managed Computers list. The fields are defined as follows:

Time
Specifies the time of day that the Agent Manager scans computers in the Managed Computers list. This field is available only if you clear the Use global settings field.
every ___ day
Specifies how often, in days, the Agent Manager scans computers in the Managed Computers list. This field is available only if you clear the Use global settings field.
Use global settings
Specifies whether this Agent Manager uses the settings for Agent Managers configured in the Global Settings window. This field is available only in individual Agent Manager Properties windows.

To scan computers in the Managed Computers list immediately, click Scan managed computers now.


Agents Properties, Buffering Tab

Allows you to specify how long the agent buffers events, alerts, and performance data before sending them to the Consolidator. The fields are defined as follows:

Send events and performance data after ___ msec
Specifies how often to send all the collected event and performance data to the Consolidator. In the Agent Properties window, this field is available only when the Use Global Settings check box is clear.
Buffer all alerts and central responses like events
Specifies that alerts and responses that are to be carried out on the Consolidator computer are buffered for the same length of time as events. In the Agent Properties window, this field is available only when the Use Global Settings check box is clear.
Send alerts and items requiring central response immediately
Specifies that alerts and items requiring central response are not buffered. In the Agent Properties window, this field is available only when the Use Global Settings check box is clear.
Use global settings
Specifies whether this agent uses the settings for agents configured in the Global Settings window. This check box is available only when you configure individual agents in the Agent Properties window.


Agents Properties, Collect Event Information Tab

Allows you to specify whether the binary data associated with each event should be collected and stored in the database. The field is defined as follows:

Collect event binary data
The default state of this check box is clear. Collecting the binary data for each event can significantly enlarge the database. If you would like to collect the binary data for diagnostic purposes select the check box.


Agents Properties, Communication Failure Handling Tab

Allows you to specify how often the agent tries to communicate with the Consolidator if a communication failure occurs. The fields are defined as follows:

Retry ___ times with ___ msec between retries
Specifies the number of initial attempts and the number of milliseconds between attempts. In the Agent Properties window, this field is available only when the Use Global Settings check box is clear.
then retry ___ times with ___ msec between retries
Specifies the number of tries and milliseconds between attempts if the initial attempts fail. In the Agent Properties window, this field is available only when the Use Global Settings check box is clear.
then retry until success with ___ msec between retries
Specifies the rate at which the agent attempts to contact the Consolidator if previous attempts fail. In the Agent Properties window, this field is available only when the Use Global Settings check box is clear.
Use global settings
Specifies whether this agent uses the settings for agents configured in the Global Settings window. This field is available only in individual Agent Properties windows.


Agents Properties, Communications Tab

Allows you to specify the settings for communication between the agent and the Consolidator. The fields are defined as follows:

Packet size ___ KB
Specifies the size of each packet sent across the network. Microsoft Operations Manager 2000 product packets consist of collected data and may span multiple TCP/IP packets. In the Agent Properties window, this field is available only when the Use Global Settings check box is clear.
Packets per session ___
Specifies the number of packets an agent can send before it must disconnect from the Consolidator and then reconnect. In the Agent Properties window, this field is available only when the Use Global Settings check box is clear.
Use unencrypted communication port
Specifies to use unencrypted communications. Unencrypted communications may slightly reduce CPU overhead, but will use more network bandwidth, if encryption is not required in your enterprise network. You can view the specified port for unencrypted communications on the Global Settings Communications tab. You can change the communications type for all agents or for individual agents, but all agents must use the same port number for that type of communications. In the Agent Properties window, this field is available only when the Use Global Settings check box is clear.
Use encrypted communication port
Specifies to use encrypted communications, and is the default setting. You can view the specified port for encrypted communications on the Global Settings Communications tab. You can change the communications type for all agents or for individual agents, but all agents must use the same port number for that type of communications. In the Agent Properties window, this field is available only when the Use Global Settings check box is clear.
Use global settings
Specifies whether this agent uses the settings for agents configured in the Global Settings window. This check box is available only when you configure individual agents in the Agent Properties window.


Agents Properties, Response Handling Tab

Allows you to specify the number of script, e-mail, or paging responses that can run simultaneously. The field is defined as follows:

Simultaneous responses allowed
Specifies the number of responses that can run at one time. In the Agent Properties window, this field is available only if you clear the Use global settings check box.
Use global settings
Specifies whether this agent uses the settings for agents configured in the Global Settings window. This check box is available only in individual Agent Properties windows.


Agents Properties, Service Availability Tab

Allows you to specify how often the agent checks and reports changes in the status of Windows services. Service Availability reports use this information. The fields are defined as follows:

Enable service availability checking and reporting
Specifies whether to enable service checking and reporting. In the Agent Properties window, this check box is available only if you clear the Use global settings check box.
Check for service availability every ___ seconds
Specifies how often the agent checks for the availability of Windowsservices. In the Global Agent Settings window, this field is available only if you select the Enable service availability checking and reporting check box. In the Agent Properties window, this field is available only if you clear the Use global settings check box and select the Enable service availability checking and reporting check box.
Report service availability every ___ seconds
Specifies how often the agent reports the availability of Windows services. In the Global Agent Settings window, this field is available only if you select the Enable service availability checking and reporting check box. In the Agent Properties window, this field is available only if you clear the Use global settings check box and select the Enable service availability checking and reporting check box.
Use global settings
Specifies whether this agent uses the settings for agents configured in the Global Settings window. This field is available only in individual Agent Properties windows.


Agents Properties, Temporary Storage Tab

Allows you to specify temporary agent storage parameters. The agent uses temporary storage to ensure that data is delivered in case of service interruptions such as loss of electrical power. The fields are defined as follows:

Data directory
Specifies the directory the agent uses for temporary storage. In the Agent Properties window, this field is available only if the Use global settings field is clear.
Maximum disk space ___ KB
Specifies the disk storage space available to the agent. In the Agent Properties window, this field is available only if the Use global settings field is clear.
Use global settings
Specifies whether this agent uses the settings for agents configured in the Global Settings window. This field is available only in individual Agent Properties windows.


Consolidators Properties, Alert Forwarding Tab

Allows you to specify the name of the configuration group to which this Consolidator will forward all alerts. The fields are defined as follows:

Forward all alerts to configuration group
Enables this Consolidator to forward all alerts.
Specify the database computer name
Allows you to specify the name of the database computer in the configuration group to which the Consolidator will forward all alerts.

Note

  • For more information about alert forwarding, see Understanding Alert Forwarding. For more information about configuring alert forwarding, see the Microsoft Operations Manager 2000 Installation Guide and the Microsoft Operations Manager 2000 Operations Guide.


Consolidators Properties, Response Handling Tab

Allows you to specify the number of script, e-mail, or paging responses that can run simultaneously. The field is defined as follows:

Simultaneous responses allowed
Specifies the number of responses that can run at one time.


Consolidators Properties, Rule Change Polling Tab

Allows you to specify how often Consolidators check the database for changes in rules. The field is defined as follows:

Check for rule changes every ___ min
Specifies the time interval in minutes between polls.


Consolidators Properties, Temporary Storage Tab

Allows you to specify the settings for temporary storage of Consolidator data. The fields are defined as follows:

Data directory
Specifies the directory the Consolidator uses for temporary storage.
Maximum disk space ___ KB
Specifies the disk storage space available to the Consolidator. Since the Consolidator performs an agent function as well, the Consolidator computer must have enough space to accommodate both the agent and Consolidator temporary storage space requirements.


Database Grooming Edit Window

Allows you to specify the criteria for database grooming. The fields are defined as follows:

Groom data older than
Specifies how long to keep a record. You can specify how long to keep a record in hours, days, and minutes.
Count
Specifies the number of records to groom at one time. Microsoft Operations Manager 2000 will groom this many records at a time until there are no records older than the period specified in the Groom data older than field.
Criteria
Specifies the attribute name and value that the record must match to be groomed by this grooming rule. This field is read-only.


Global Settings Properties, Alert Resolution States Tab

Allows you to view, add, delete, and modify the parameters for alert resolution states. The resolution state indicates whether the resolution process has begun. The columns are defined as follows:

Resolution State
Specifies the name of a resolution state.
ID
Specifies the identification number for the resolution state.
Service Level Agreement
Specifies the maximum time an alert is expected to stay in a resolution state. Default times are as follows:
  • New, 10 minutes
  • Acknowledged, 20 minutes
  • Level 1: Assigned to helpdesk or local support, four hours
  • Level 2: Assigned to subject matter expert, two days
  • Level 3: Requires scheduled maintenance, seven days
  • Level 4: Assigned to external group or vendor, 30 days
  • Resolved, No default

To add a resolution state, click Add.

To delete a resolution state, click Delete.

To modify a resolution state, select a resolution state, and then click Modify.


Global Settings Properties, Auditing Tab

Allows you to turn DAS auditing on and off. The field is defined as follows:

Audit changes made through the DAS on...
Specifies whether to audit changes made through a specific DAS.


Global Settings Properties, Communications Tab

Allows you to specify the TCP/IP port that agents use to communicate with the Consolidator. These fields are defined as follows:

Unencrypted communication port number
Specifies the TCP/IP port that agents use for unencrypted communication with the Consolidator. Possible values for the port number are 1 through 65,535. If you change this value, you must rescan all agents, stop and restart the OnePoint service on all agents, and then stop and restart the OnePoint service on all Consolidators. Unencrypted communication can slightly reduce CPU overhead, but will use more network bandwidth, if encryption is not necessary in your enterprise network. You can change the communications type for all agents or for individual agents, but all agents must use the same port number for that type of communications.
Encrypted port number
Specifies the TCP/IP port that agents use for encrypted communication with the Consolidator. Encrypted communication is the default. You can choose the communication type for global agents or for individual agents. You can change the communications type for all agents or for individual agents, but all agents must use the same port number for that type of communications. Possible values for the port number are 1 through 65,535. If you change this value, you must rescan all agents, stop and restart the OnePoint service on all agents, and then stop and restart the OnePoint service on all Consolidators.


Global Settings Properties, Components Tab

Provides access to the Global Agent Manager Settings windows, the Global Consolidator Settings window, and the Global Agents Settings window.

To access the Global Agent Manager Settings window, click Agent Managers.

To access the Global Consolidator Settings window, click Consolidators.

To access the Global Agent Settings window, click Agents.


Global Settings Properties, Custom Alert Fields Tab

Allows you to specify configuration-wide custom alert fields. You can populate these fields when you create an alert with a processing rule. The fields are defined as follows:

Custom fields 1 - 5
Specifies the names of custom fields.


Global Settings Properties, Database Grooming Tab

Allows you to view the record types that will be deleted from the database and edit grooming criteria. The fields are defined as follows:

Records to delete
Specifies the type of record to delete from the database.
Older than
Specifies how long to keep the type of record. Microsoft Operations Manager 2000 will delete from the database records older than the value specified in this field.

To modify database grooming, select one of the types of records to delete, and then click Edit.


Global Settings Properties, E-mail Server Tab

Allows you to specify settings for e-mail to notification groups. The Consolidator will use these settings when sending e-mail notifications. The fields are defined as follows:

Transport
Specifies the e-mail transport provider.
Exchange server
Specifies the name of the Exchange server. This field is available only if you select Microsoft Exchange in the Transport field.
Mailbox
Specifies the name of the Exchange mailbox the Consolidator will use to send e-mail notifications. This field is available only if you select Microsoft Exchange in the Transport field.
Server name
Specifies the name of the SMTP server. You can specify the DNS name or the host name of the computer. This field is available only if you select SMTP in the Transport field.
Returned address
Specifies the Internet return address for the message sender. This field is available only if you select SMTP in the Transport field.
SMTP Port
Specifies the TCP port number that the SMTP server uses. This field is available only if you select SMTP in the Transport field.


Global Settings Properties, Notification Command Format Tab

Allows you to specify the default command to use for command-based notification responses. The command will launch a third-party paging application that uses a modem to notify operators. The field is defined as follows:

Default command
Allows you to specify the default command to use for command-based notification responses.

To change the default command, click the arrow to display a list of alert and event variables.


Global Settings Properties, Web Addresses Tab

Allows you to specify the URLs for the Web console server and published reports. The fields are defined as follows:

Web Console Address
Allows you to specify the URL for the Web console server. Changing this setting does not alter the URL used to access the Web console in a Web browser. Instead, this URL is used in default e-mail and paging responses. For example, to use the default Web console installation on a computer called IISSERVER, type http://IISSERVER/WebConsole. Type http:// to ensure that all Microsoft Operations Manager 2000 functions work correctly. You can specify the DNS name or the host name of the computer.
Reports Address
Allows you to specify the URL for HTML reports. Specify this URL if you want to access HTML reports from the Today window or from the toolbar. Type http:// to ensure that all functions work correctly. You can specify the DNS name or the host name of the computer.

Related Topics


Global Settings Window

Allows you to view and access types of properties you can configure for the entire configuration group. The field is defined as follows:

Global Setting Type
Specifies items that can be configured.

To open the properties tab for a global property type, complete the following steps:

  1. Select a global setting type in the right pane.
  2. Click Action on the menu bar.
  3. Click Properties on the Action menu.


Managed Computers List Entry Properties, Computers Tab

Allows you to specify the domain and computer names that will match the Managed Computers Rule. The fields are defined as follows:

Domain name
Specifies the domain to which the computer must belong for the computer to match the Managed Computer Rule.
Computer name ___ ___
Specifies the pattern-matching expression that the computer name must match for the computer to match the Managed Computer Rule.

Note The MOM Agent Manager does not discover computers based on their IP address or their fully qualified domain name.

Related Topics


Managed Computers List Entry Properties, Include Tab

Specifies whether the Computer Rule is an include rule or an exclude rule. The fields are defined as follows:

Include
Specifies that the Computer Rule is an include Computer Rule.
Exclude
Specifies that the Computer Rule is an exclude Computer Rule.


Managed Computers List Entry Properties, Types Tab

Specifies the types of computers to include or exclude from the Managed Computers list. The columns are defined as follows:

Primary Domain Controllers
Specifies whether to include primary domain controllers (PDCs) in the Managed Computers list.
Backup Domain Controllers
Specifies whether to include backup domain controllers (BDCs) in the Managed Computers list.
Windows NT Member Servers
Specifies whether to include Windows NT Member Servers in the Managed Computers list. A PDC or BDC is not considered a Windows NT Member Server.
Workstations
Specifies whether to include Windows NT Workstations in the Managed Computers list.


Pending Installations Window

Allows you to view, approve, cancel, and process pending actions from the Agent Manager. The columns are defined as follows:

Approved
Specifies whether the pending action has been approved.
Domain
Specifies the domain to which the computer pending an action belongs.
Name
Specifies the name of the computer pending an action.
Pending Status
Specifies whether the pending action is to install or uninstall an agent.
Agent Manager
Specifies the name of the Agent Manager computer.


Resolution State Edit Window

Allows you to create a new or modify an existing alert resolution state. The fields are defined as follows:

Name
Specifies the name of the alert resolution state.
ID
Specifies the numeric value for the alert resolution state.
Alerts should remain in this resolution state no longer than ___ ___
Specifies the Service Level Agreement time in minutes, hours, or days.


Advanced Criteria Window

Allows you to create advanced criteria to search for alert or event data. The fields are defined as follows:

Field
Specifies the name of an alert or event property.
Condition
Specifies a criterion to identify the event or alert property.
Value
Specifies a value that satisfies the expression.
Define more criteria
Allows you to specify additional criteria.

To remove a criteria, select the criteria, and then click Remove.

To add a criteria, complete the Define more criteria field, and then click Add to List.


Alert Processing Rules Window

Allows you to view, create, edit, and delete alert processing rules for a processing rule group. These fields are defined as follows:

Name
Specifies the name of the rule.
Enabled
Specifies whether the rule is currently enabled.
Alert Source
Specifies the user-defined alert source name. If no name is defined, this field defaults to the event source name.
Severity
Specifies the alert severity, such as Service Unavailable or Error.
Response
Specifies whether a rule match generates a response, and if so, what response.

To create an alert processing rule, complete the following steps:

  1. Expand the processing rule group to which you want to add the alert processing rule.
  2. Select Alert Processing Rules in the left pane.
  3. Click Action on the menu bar.
  4. Click New on the Action menu.
  5. Click Alert Processing Rule on the New Menu.

To edit a processing rule, complete the following steps:

  1. Select a processing rule in the right pane.
  2. Click Action on the menu bar.
  3. Click Properties on the Action menu.

To delete a processing rule, complete the following steps:

  1. Select a processing rule in the right pane.
  2. Click Action on the menu bar.
  3. Click Delete on the Action menu.


Application Log Provider Properties, Application Log Provider Tab

Allows you to specify the name and log type for an application log. The fields are defined as follows:

Provider name
Specifies the user-defined provider name for the application log.
Provider log type
Specifies the type of application log, such as Microsoft SQL Server trace file.


Application Log Provider Properties, Directories Tab

Allows you to specify characteristics of the logs you want to monitor. The fields are defined as follows:

Format
Specifies the format of log file the provider monitors, such as IIS Standard or SQL Trace.
Directory
Specifies the location of the application log file.
Pattern
Specifies the names of the log files to monitor.

To add a file to monitor, click Add.

To remove a file from the list of files to monitor, select the file, and then click Remove.

To edit a file being monitored, select a file, and then click Edit.


Browse Window

Allows you to select computers listed in the Microsoft Operations Manager 2000 database. If you select a computer in this window, the computer specification exactly matches that computer.


Command Wizard Window

Allows you to specify the command to execute on a match to the processing rule. The fields are defined as follows:

Command
Specifies the command to execute.
Initial directory
Specifies the working directory in which to run the specified command. If this field is blank, the initial directory is the product directory, typically Program Files\Microsoft Operations Manager 2000\OnePoint.
Locally on the agent computer
Specifies to execute the command on the agent computer.
Centrally on the Consolidator computer
Specifies to execute the command on the Consolidator computer.


Computer Attributes Window

Allows you to view, create, edit, and delete computer attributes. The fields are defined as follows:

Name
Specifies the name of the attribute.
Type
Specifies the type of the attribute, such as string or integer.
Enabled
Specifies whether the attribute is currently enabled.
Description
Specifies the description of the attribute.

To create an attribute, complete the following steps:

  1. Select Computer Attributes in the left pane.
  2. Click Action on the menu bar.
  3. Click New on the Action menu.
  4. Click Computer Attribute on the New Menu.

To edit an attribute, complete the following steps:

  1. Select an attribute in the right pane.
  2. Click Action on the menu bar.
  3. Click Properties on the Action menu.

To delete an attribute, complete the following steps:

  1. Select an attribute in the right pane.
  2. Click Action on the menu bar.
  3. Click Delete on the Action menu.


Computer Groups Window

Allows you to view, create, and edit computer groups. Computer groups help define on which computers Microsoft Operations Manager 2000 installs agents. The columns are defined as follows:

Name
Specifies the name of the computer group.
Enabled
Specifies whether the computer group is enabled.
Domain spec
Specifies the text-pattern matching expression for the domain and computer names included in the computer group.
Expression
Specifies a Boolean expression for which a computer must return True to be included in the computer group.

To create a computer group, complete the following steps:

  1. Select Computer Group in the left pane.
  2. Click Action on the menu bar.
  3. Click Create Computer Group on the Action menu.

To edit a computer group, complete the following steps:

  1. Select a computer group.
  2. Click Action on the menu bar.
  3. Click Properties on the Action menu.

Related Topics


Computer Group Properties, Computers Tab

Allows you to specify which computers, by domain and computer name, to include in the computer group. The fields are defined as follows:

All computers
Specifies whether to include all computers in the computer group.
Only computers whose name matches
Specifies whether to include in the computer group computers that match the expressions defined in the Domain name and Computer name fields, below.
Domain name
Identifies a domain that matches the specified text pattern matching expression.
Computer name
Identifies computer names that match the specified text pattern matching expression.

Related Topics


Computer Group Properties, Computer Types Tab

Allows you to specify computer types to include in the computer group. The fields are defined as follows:

Primary Domain Controllers
Specifies whether to include primary primary domain controllers (PDCs) in the computer group.
Backup Domain Controllers
Specifies whether to include backup domain controllers (BDCs) in the computer group.
Windows Member Servers
Specifies whether to include Windows Member Servers in the computer group. A PDC or BDC is not considered a Windows Member Server.
Windows Workstations
Specifies whether to include Windows Workstations in the computer group.


Computer Group Properties, Excluded Computers Tab

Allows you to specify, by domain and computer name, which computers to always exclude in the computer group. If a computer matches the specification in this window, Microsoft Operations Manager 2000 always excludes it from the computer group, regardless of other specifications. The fields are defined as follows:

Domain
Identifies domain names that match the specified text pattern matching expression.
Computer
Identifies computer names that match the specified text pattern matching expression.
Add
Allows you to add computers to the specification.
Remove
Allows you to remove computers from the specification.
Modify
Allows you to modify the specification.

Note

  • If a computer matches both the include and exclude specifications, it is excluded.

Related Topics


Computer Group Properties, Formula Tab

Allows you to specify a Boolean formula that must evaluate True for a computer to be included in the computer group. The fields are defined as follows:

Specify the formula for the computer group
Specifies the computer grouping formula that must evaluate True for a computer to be included in the computer group. You can enter up to 1000 characters in the formula.

For example, to specify a computer grouping formula that matches computers running Windows 2000, enter:

AttributeValue(NT Current Version) = "5.0"
Insert
Allows you to insert expressions into the computer grouping formula.
Operator
Allows you to insert a Boolean operator into the computer grouping formula.
Function
Allows you to insert a function into the computer grouping formula.
Attribute
Allows you to insert a computer attribute into the computer grouping formula. Enclose the attribute name in single quotes in the expression.
Computer Group
Allows you to insert a computer group into the formula.

Related Topics


Computer Group Properties, General Tab

Allows you to specify a name and description for the computer group and to specify whether the computer group is enabled. The fields are defined as follows:

Name
Specifies the name of the computer group. Do not include any parentheses or commas in the name of the computer group.
Description
Specifies a description of the computer group.
Enabled
Specifies whether the computer group is enabled.


Computer Group Properties, Computers Tab

Computer Group Properties, Included Computers Tab

Allows you to specify, by domain and computer name, which computers to always include in the computer group. If a computer matches the specification in this window, Microsoft Operations Manager 2000 always includes it in the computer group, regardless of other specifications. The fields are defined as follows:

Domain
Identifies domain names that match the specified text pattern matching expression.
Computer
Identifies computer names that match the specified text pattern matching expression.
Add
Allows you to add computers to the specification.
Remove
Allows you to remove computers from the specification.
Modify
Allows you to modify the specification.

Note

  • If a computer matches both the include and exclude specifications, it is excluded.

Related Topics


Computer Group Properties, Processing Rules Tab

Allows you to associate processing rule groups with the computer group. The columns are defined as follows:

Name
Specifies the name of the processing rule group that is associated with the computer group.
Description
Specifies the description of the processing rule group that is associated with the computer group.

To associate another processing rule group with the computer group, click Add.

To disassociate a processing rule group from the computer group, select the processing rule group, and then click Remove.


Directory Edit Window

Allows you to specify criteria to define the files that the application log provider processes. The fields are defined as follows:

Directory
Specifies the location of the log files.
Format
Specifies the format of the log files in the specified directory.
File pattern
Displays the file pattern specified in the File Pattern Edit window.

Click Add to add a application log file pattern.


Event Processing Rules Window

Allows you to view, create, edit, and delete event processing rules in a processing rule group. The fields are defined as follows:

Name
Specifies the name of the rule.
Enabled
Specifies whether the rule is currently enabled.
Type
Specifies the event processing rule type, such as filter or forwarding.
Provider Name
Specifies the name identifying a particular instance of a provider that generates an event, such as Security for Windows Event Log.
Provider Type
Specifies the type of information provider that generates the event, such as Windows Event Log or WMI Events.
Source
Specifies the Windows event source that matches this rule, such as Microsoft Exchange Server or Microsoft SQL Server.
ID
Specifies the Windows event identification number that matches this rule.
Event Type
Specifies the event type, such as Error or Audit Failure.
Event Text Criteria
Specifies the text-pattern matching expression for event text for events matched by this rule.
Response
Specifies whether a rule match generates a response, and if so, what response.

To create an event processing rule, complete the following steps:

  1. Select Event Processing Rules in the left pane.
  2. Click Action on the menu bar.
  3. Click New on the Action menu.
  4. Click Event Processing Rule on the New Menu.

To edit a processing rule, complete the following steps:

  1. Select a processing rule in the right pane.
  2. Click Action on the menu bar.
  3. Click Properties on the Action menu.

To delete a processing rule, complete the following steps:

  1. Select a processing rule in the right pane.
  2. Click Action on the menu bar.
  3. Click Delete on the Action menu.

Related Topics


Export Management Pack Module Window

Allows you to export a group of processing rules and associated information to a data file. The fields are defined as follows:

Save as
Specifies the name of the file that will contain the processing rule group. Click Browse to select the directory where you want to save the file.
Create a new Management Pack module
Specifies that an existing file of the same name is overwritten with the exported file. Otherwise, a new Management Pack module file is created.
Add rules and views to the existing Management Pack module
Specifies that rules and views should be appended to an existing Management Pack module.
Exported views
Specifies the public views that will be exported. Check the views you want to export.
Description
Specifies the description of the Management Pack module.


File Pattern Edit Window

Allows you specify a pattern for monitored log files. The field is defined as follows:

File Pattern
Specifies the log-file pattern. A question mark (?) matches 0 or 1 characters, and an asterisk (*) matches 0 or more characters.


Import Management Pack module Window

Allows you to import a Management Pack module. The fields are defined as follows:

Management Pack module
Specifies the Management Pack module file (.akm) you want to import.
Merge Existing Management Pack
This option merges an existing Management Pack module with the new version being imported. The merge behavior results in the following:
  • User-added company knowledge on vendor-shipping rules is retained.
  • All user-added custom rules are retained.
  • User-modified rules, scripts, data providers, and computer groups on vendor-shipping rules are overwritten.
This option is recommended if you want to completely synchronize the existing Management Pack with the latest version, while retaining company knowledge and custom rules.
Replace Existing Management Pack
This option replaces an existing Management Pack module with the new version being imported. The replace behavior results in the following:
  • User-added company knowledge on vendor-shipping rules is removed.
  • All user-added custom rules are removed.
  • User-modified rules, scripts, data providers, and computer groups on vendor-shipping rules are overwritten.
This option is the recommended if you want a fresh install of the latest Management Pack and do not want to retain any user-created company knowledge or custom rules.
Backup Management Pack
Specifies that when upgrading an existing Management Pack module, that Management Pack module is backed up. Backups are placed in the %OPERATIONSMANAGERINSTALLDIR%\ONEPOINT\MPBACKUPS folder.
Description
Specifies the description of the Management Pack module.

Please note that with MOM Service Pack 1, the Merge option that imported an updated Management Pack module over an existing Management Pack module while preserving custom changes (to vendor rules and user-added custom rules) has been removed from the product.


Import Knowledge Pack Component Window

Import Management Pack Component Window

Allows you to import a SeNTry 2.x Management Pack component, including comments, to create a processing rule group. The fields are defined as follows:

Management Pack module component file name
Specifies the name of the Management Pack module component file (.adf) to import.
Add imported rules without overwriting existing rules
Specifies that the Management Pack module component will not delete or modify existing rules.
Replace existing rules with imported rules
Specifies that the Mangement Pack component will overwrite existing rules.
Assume the following log type for ADF entries that contain no log type
Specifies the log provider to use for the Management Pack module entries that do not specify a log type.
Application
Specifies to use the Application log provider for the Management Pack module entries that do not specify a log type.
Security
Specifies to use the Security log provider for the Management Pack module entries that do not specify a log type.
System
Specifies to use the System log provider for the Management Pack module entries that do not specify a log type.


Launch a Script Window

Allows you to initiate a script in response to a match on a processing rule, create new scripts, and edit existing scripts. The fields are defined as follows:

Script name
Specifies the name of the script.
Locally on the agent computer
Specifies to run the script on the agent computer.
Centrally on the Consolidator computer
Specifies to run the script on the Consolidator computer.
Process response before duplicate alert suppression
Specifies to run the script on the Consolidator computer before duplicate alert suppression is carried out, which results in the script running for each duplicate alert. Running a script after alert suppression is carried out results in the script running only for the first alert, and not for duplicated ones.
Script parameters
Specifies the parameters to pass to the script. These parameters are available to the script through the ScriptContext.Parameters object.
Name
Specifies the name of the script parameter.
Description
Specifies the description of the script parameter.
Value
Specifies the value of the script parameter.

To create a new script, click New.

To edit an existing script, select the script in the Script Name field, and then click Edit.

To edit a script parameter, select the script parameter, and then click Edit Script Parameter.


Missing Event Processing Rule Properties, Schedule Tab

Allows you to specify when you expect the event to occur. If the event does not occur in this time frame, it is considered a missing event.

Between ___ and ___
Specifies the start and stop time to watch for the event. To specify that you want to watch overnight for an event, specify a start time later than an stop time and check both days.
Sunday through Saturday
Specifies to watch for the event on the checked day of the week.


Notification Group Properties, Notification Group Tab

Allows you to specify the name of a notification group and assign operators to the group. Operators can belong to more than one notification group. The fields are defined as follows:

Name
Specifies the name of the notification group.
Group operators
Lists operators who have been added to the specified notification group and can receive alerts that affect the notification group. You can remove an operator from the notification group by clicking the operator name and clicking the bottom arrow.
Available operators
Lists operators who are not assigned to the specified notification group. You can add an available operator to the Group operators list by clicking the operator name, and then clicking the top arrow.
Properties
Allows you to view and edit the properties of the specified operator.


Notification Groups Window

Allows you to view, create, edit, and delete notification groups. Depending on the Management Pack modules installed, this window might contain default notification groups that are configured to receive notifications from processing rules defined in the Management Pack modules. For information about the notification group associated with a Management Pack module, see the Management Pack module knowledge base.

You can add operators to these default notification groups. The field is defined as follows:

Name
Specifies the name of the notification group.

Related Topics


Operator Properties, Command Tab

You can use third-party paging applications to notify operators of a detected condition. You can configure Microsoft Operations Manager 2000 to use an external command line to run software that pages operators through a modem rather than the SMTP e-mail service. This external command is specified within the processing rule sending responses to the notification group to which the operator belongs.

This tab allows you to specify whether to notify the operator by external command, the operator ID for the operator, and when to notify the operator by external command. The fields are defined as follows:

Notify this operator by external command
Specifies whether to run an external command to launch a third-party paging application.
Operator ID
Specifies the text to use for an operator identification in third-party application paging. This text is used for the $Operator ID$ variable when defining a notification response for a processing rule.
Always notify by external command
Specifies to notify the operator by external command 24 hours a day, seven days a week.
Notify this operator by external command at the specified times
Specifies to notify the operator by external command only between the specified times.
Between ___ and ___
Specifies the start and stop time for when to notify the operator by external command.
Sunday through Saturday
Specifies to notify the operator on the selected day of the week.


Operator Properties, E-mail Tab

Allows you to specify whether to notify the operator by e-mail, the e-mail address of the operator, and when to notify the operator by e-mail. The fields are defined as follows:

E-mail this operator
Specifies whether to notify the operator by e-mail.
E-mail address
Specifies the e-mail address of the operator.
Always e-mail this operator
Specifies to e-mail the operator 24 hours a day, seven days a week.
E-mail this operator at the specified times
Specifies to e-mail the operator only between the specified times.
Between ___ and ___
Specifies the start and stop time for when to e-mail the operator.
Sunday through Saturday
Specifies whether to e-mail the operator on the checked day of the week.


Operator Properties, General Tab

Specifies the name or description of the operator and whether the operator is enabled. The fields are defined as follows:

Name
Specifies the name or description of the operator.
Enabled
Specifies whether the operator is currently enabled.


Operator Properties, Page Tab

You can configure paging through a third-party paging service. Microsoft Operations Manager 2000 (MOM) sends an e-mail to the paging service, which forwards the e-mail to the appropriate operator, or paging recipient. The paging service must provide an SMTP e-mail service for MOM paging to work.

Allows you to specify whether to page the operator, the page address of the operator, and when to notify the operator by page. The fields are defined as follows:

Page this operator
Specifies to notify the operator by page.
Page address
Specifies the page address of the operator.
Always page this operator
Specifies to page the operator 24 hours a day, seven days a week.
Page this operator at the specified times
Specifies to page the operator only between the specified times.
Between ___ and ___
Specifies the paging start and stop times.
Sunday through Saturday
Specifies to page the operator on the selected days of the week.


Operators Window

Allows you to view, create, modify, and delete operators. The field is defined as follows:

Operator Name
Specifies the name of the operator.

To create an operator

  1. In the left pane, expand Rules, then expand Advanced, and select Operators.
  2. Click Action on the menu bar.
  3. Click Create Operator on the Action menu.
  4. Follow the instructions until you have finished creating an operator. For more information about the fields on a window, click Help.

To modify operator properties

  1. In the right pane, select an operator.
  2. On the menu bar, click Action.
  3. On the Action menu, click Properties.
  4. On the Operator Properties tabs, specify the desired values. For more information about the fields in a window, click Help.

To delete an operator from a notification group

  1. In the left pane, expand Microsoft Operations Manager (default).
  2. In the left pane, expand Rules.
  3. In the left pane, expand Notification Groups.
  4. In the left pane, click the notification group that you want to delete an operator from.
  5. Click the operator that you want to delete.
  6. On the menu bar, click Action.
  7. On the Action menu, click Delete.
    • If you want to remove the operator from only the selected notification group, click Remove this operator from the current notification group. This option removes the operator from the current notification group, but does not delete the operator record.
    • If you want to delete the operator from all notification groups, click Delete operator. This option removes the operator from all notification groups and deletes the operator record.

Related Topics


Performance Processing Rules Window

Allows you to view, create, edit, and delete performance processing rules for a processing rule group. This fields are defined as follows:

Name
Specifies the name of the rule.
Enabled
Specifies whether the rule is currently enabled.
Type
Specifies the performance processing rule type, measuring or threshold.
Provider Type
Specifies the type of information provider, such as Windows event log or WMI.
Provider Name
Specifies the user-defined name that identifies a particular instance of a provider, such as Security for Windows Log.
Response
Specifies whether a rule match generates a response, and if so, what response.

To create a performance processing rule, complete the following steps:

  1. Select Performance Processing Rules in the left pane.
  2. Click Action on the menu bar.
  3. Click New on the Action menu.
  4. Click Performance Processing Rule on the New Menu.

To edit a processing rule, complete the following steps:

  1. Select a processing rule in the right pane.
  2. Click Action on the menu bar.
  3. Click Properties on the Action menu.

To delete a processing rule, complete the following steps:

  1. Select a processing rule in the right pane.
  2. Click Action on the menu bar.
  3. Click Delete on the Action menu.


Processing Rule Groups Window

Allows you to view and print processing rule group details, create, edit, and delete processing rule groups, and navigate through the processing rule group hierarchy. The fields are defined as follows:

Enabled
Specifies whether the processing rule group is enabled.
Parent Rule Group
Specifies the parent of the processing rule group, and allows you to navigate to the parent processing rule group.
Child Rule Groups
Specifies the children of the processing rule group, and allows you to navigate to the children processing rule groups.
Description
Specifies the description of the processing rule group.
Bound to Computer Groups
Specifies the computer groups to which the processing rule will be distributed.
Microsoft Knowledge Base
Specifies the Knowledge Base information for the processing rule group. This field is available only if there is Knowledge Base information available.
Company Knowledge Base
Specifies the company-provided Knowledge Base information associated with the processing rule group. This field is available only if there is Company Knowledge Base information associated with the processing rule group.
Event Rules
Specifies the event processing rules in the processing rule group. Click an event rule to display its Properties window.
Alert Rules
Specifies the alert processing rules in the processing rule group. Click an alert rule to display its Properties window.
Performance Processing Rules
Specifies the performance rules in the processing rule group. Click a performance processing rule to display its Properties window.

To create a processing rule group, complete the following steps:

  1. In the left pane, select the processing rule group you want to contain the new processing rule group.
  2. Click Action on the menu bar.
  3. Click New on the Action menu.
  4. Click Processing Rule Group on the New menu.

To edit a processing rule group, complete the following steps:

  1. Select a processing rule group in the left pane.
  2. Click Action on the menu bar.
  3. Click Properties on the Action menu.

To delete a processing rule group, complete the following steps:

  1. Select a processing rule group in the left pane.
  2. Click Action on the menu bar.
  3. Click Delete on the Action menu.
  4. Select the appropriate option, and then click OK.

To print the details of a processing rule group, complete the following steps:

  1. Select a processing rule group in the left pane.
  2. Click Print in the right pane.


Processing Rule Group Properties, Computer Groups Tab

Allows you to view, add, and remove computer groups associated with the processing rule group. To deploy the rules in a processing rule group to agents, you must associate the processing rule group with computer groups. The fields are defined as follows:

Name
Specifies the name of the computer group associated with the processing rule group.
Description
Specifies the description of the computer group.

To associate an additional computer group with the processing rule group, click Add.

To disassociate a computer group from the processing rule group, select a computer group, and then click Remove.


Processing Rule Group Properties, General Tab

Allows you to specify the name for a processing rule group and whether the processing rule group is currently enabled. The fields are defined as follows:

Name
Specifies the name of the processing rule group.
Description
Specifies the description of the processing rule group.
Enabled
Specifies whether the rule group is currently enabled.
Processing rule group GUID
Specifies a globally unique identifier for the processing rule group. You can use this GUID to locate a specific processing rule group. This field is read-only.


Processing Rule Group Properties, Knowledge Base Tab

Allows you to view and edit the knowledge base for this processing rule group. The fields are defined as follows:

Microsoft Knowledge Base
Specifies the knowledge base for this processing rule group. This field is available only if Microsoft Operations Manager 2000 provides a knowledge base for this processing rule.
Company Knowledge Base
Specifies saved comments and information about this processing rule group.

To edit the company knowledge base, click Edit.


Processing Rule Properties, Alert Criteria Tab

Allows you to specify alert properties that you want this processing rule to match. The fields are defined as follows:

Match events from alert source
Specifies that the rule matches alerts from the specified source.
of severity
Specifies that the rule matches alerts with the specified severity, such as Error or Success.
only match alerts generated by rules in the following group
Specifies that the processing rule matches only alerts generated by rules in the specified processing rule group.
Browse
Allows you to browse for the processing rule group whose alerts you want this processing rule to match.
Criteria description
Specifies all criteria defined for the rule. This field is read-only.

To specify more advanced rule criteria, click Advanced.


Processing Rule Properties, Custom Fields

Allows you to populate the user-defined alert fields for the alert that the processing rule generates. The fields are defined as follows:

CustomField1 through CustomField5
Specifies values for the custom fields.


Processing Rule Properties, Alert Suppression Tab

Specifies whether to suppress duplicate alerts. To be considered a duplicate alert, the specified fields of an alert must be identical to those of an existing unresolved alert generated by the same processing rule. The fields are defined as follows:

Suppress duplicate alerts
Specifies whether to suppresses duplicate alerts.
Fields
Specifies which fields must be identical.

To select all the fields, click Select All.

To clear all the selections, click Clear Selections.


Processing Rule Properties, Alert Tab

Allows you to specify whether a match to this rule generates an alert, and the properties for that alert. The fields are defined as follows:

Generate alert
Specifies whether a match to this rule generates an alert.
Alert severity
Specifies the level of severity of the alert, such as Security Breach or Critical Error.
Owner
Specifies the person responsible for tracking and resolving the alert.
Resolution state
Specifies the status of the resolution process of the alert, such as New or Resolved. The resolution state indicates whether the resolution process has begun.
Alert source
Specifies the source of the alert. The default is $Source Name$, but you can specify another parameter by clicking the arrow and selecting from the list.
Description
Specifies the description of the alert. Press the Enter key for line breaks within the Description box.

To populate the custom fields of the alert, click Custom Fields.


Processing Rule Properties, Consolidate Tab

Allows you to specify the event fields that must be identical for a consolidation rule match. If identical data in these fields is received in the specified amount of time, the events are consolidated into a single event. The fields are defined as follows:

Select which event fields must be identical for events to be consolidated
Specifies the event fields that must be identical in order to match the consolidation rule.
Events must occur within ___ seconds
Specifies that matching events must occur within the selected time.


Processing Rule Properties, Criteria Tab

Allows you to specify event properties that you want this processing rule to match. The fields are defined as follows:

Match events from source
Specifies that the rule matches events from the specified source.
with event ID
Specifies that the rule matches events with the specified event ID number.
of type
Specifies that the rule matches events of the specified type, such as Success Audit or Information.
with description
Specifies that the rule matches events with the specified text in the description field.
Criteria description
Specifies all criteria defined for the rule. This field is read-only.

To specify more advanced rule criteria, click Advanced.


Processing Rule Properties, Data Provider Tab

Allows you to specify the source of the data or events matched by the rule. The fields are defined as follows:

Provider name
Specifies the name of the data provider.
Provider type
Specifies the name of the data provider type for the selected provider, such as Windows event log, Windows performance counter, or timed event provider. This field is read-only.
Provider settings
Describes the settings for the provider instance. This field is read-only.

To create a new provider, click New.

To modify a performance processing rule provider type, click Modify. The Modify button is only available when viewing the properties for performance processing rules.


Processing Rule Properties, Filter Tab

Allows you to specify how events are filtered, or excluded, from the database. The fields are defined as follows:

Pre-filter
Specifies that for events matching the filter, Microsoft Operations Manager 2000 (MOM) stops evaluating further processing rules, and does not save matching events to the database.
Database Filter
Specifies that for events matching the filter, MOM continues evaluating processing rules, but does not save matching events to the database.
Conditional Filter
Specifies that for events matching the filter, MOM continues evaluating processing rules, but saves events to the database only if another processing rule match occurs.


Processing Rule Properties, General Tab

Allows you to specify the name for a processing rule and whether the rule is currently enabled. The fields are defined as follows:

Name
Specifies the user-defined name of the processing rule. The first character of any name should be a letter. The following characters can be letters, numbers, underscores, or blanks. Processing rule names are not required.
Enabled
Specifies whether the processing rule is currently enabled.
Rule action
Specifies what the processing rule does. This field is read-only.
Processing rule path
Specifies the path of the processing rule group to which the rule belongs. This field is read-only.
Processing rule GUID
Specifies a globally unique identifier for the processing rule. This field is read-only.
Last modified by
Specifies the account that last modified this rule, as well as the date and time the rule was last modified. This field is read-only.


Processing Rule Properties, Knowledge Base Tab

Allows you to view and edit the knowledge base for this processing rule. The fields are defined as follows:

Microsoft Knowledge Base
Specifies the knowledge base for this processing rule. This field is available only if Microsoft Operations Manager 2000 provides a knowledge base for this processing rule.
Company Knowledge Base
Specifies saved comments and information about this processing rule.

To edit the company knowledge base, click Edit.


Processing Rule Properties, Parameter Storage Tab

Microsoft Operations Manager 2000 always collects and processes event parameters. This tab allows you to specify the event parameters that you want this processing rule to store in the database. Event parameters are event properties, and vary depending on the event. Storing the parameters is necessary only if you want to create custom reports or database queries using the parameters. This tab is available only for collection rules. The fields are defined as follows:

Store all event parameters
Specifies that this processing rule collects all event parameters and stores them in the database.
Store these event parameters
Specifies that this processing rule stores in the database only the parameters specified by number. For example, security event ID 528 properties show that User Name is Parameter1 and Workstation Name is Parameter7. To specify that this processing rule collect only the User Name and Workstation Name parameters for the event, enter 1, 7. Use a hyphen (-) to specify a number range (such as 5-8), and a comma (,) to separate numbers.
Store no event parameters
Specifies that this processing rule stores no event parameters in the database. This option is appropriate for most environments. Storing event parameters unnecessarily may adversely affect database performance.


Processing Rule Properties, Responses Tab

Allows you to view, add, remove, and edit the responses to a match on the processing rule. The fields in this tab are not available for Pre-filters. The fields are defined as follows:

Response
Specifies the name of the selected response.
Type
Specifies the type of response such as script, command, or notification.

To add a new response, click Add, and then select the response from the Add menu.

To remove a response, select a response, and then click Remove.

To edit a response, select a response, and then click Edit.

Related Topics


Processing Rule Properties, Schedule Tab

Allows you to specify when this processing rule is active. The fields are defined as follows:

Specify optional schedule ...
Specifies when the rule should or should not be active.
Between ___ and ___
Specifies the start and stop time for when the rule is active. To specify that you want the rule active overnight, specify a start time later than an stop time and check both days.
Sunday through Saturday
Specifies whether the rule is active on the checked day of the week.


Processing Rule Search Results Window

Contains views of processing rule search results. This folder contains one folder for each open Rule Search window.

Related Topics


Providers Window

Allows you to view, create, edit, and delete data providers. The fields are defined as follows:

Type
Specifies the type of data provider, such as Windows Performance Counter or Windows Event Log.
Name
Specifies the name of the data provider.
Settings
Specifies the description of what the provider offers.

To create a data provider, complete the following steps:

  1. Select Providers in the left pane.
  2. Click Action on the menu bar.
  3. Click New on the Action menu.
  4. Click Provider on the New Menu.

To edit a provider, complete the following steps:

  1. Select a provider in the right pane.
  2. Click Action on the menu bar.
  3. Click Properties on the Action menu.

To delete a provider, complete the following steps:

  1. Select a provider in the right pane.
  2. Click Action on the menu bar.
  3. Click Delete on the Action menu.


Registry-Based Attribute Properties, General Tab

Allows you to specify the name and description of the attribute. The fields are defined as follows:

Name
Specifies the name of the attribute. The first character of the name must be a letter. Subsequent characters can be letters, numbers, underscores, or blanks. Do not include any parentheses or commas in the name of the attribute.
Description
Specifies a description of the attribute.
Enabled
Specifies whether statistics on this attribute are currently collected.


Registry-Based Attribute Properties, Registry Path Tab

Allows you to specify the registry key or value to use. The fields are defined as follows:

Which registry key would you like to use?
Specifies the registry key to use. This field is available only if you select Registry key on the Registry-Based Attribute Properties, Type tab.
Which registry value would you like to use?
Specifies the registry value to use. This field is available only if you select Registry value on the Registry-Based Attribute Properties, Type tab.

To browse the local registry to select a key or value, click Browse.


Registry-Based Attribute Properties, Type Tab

Allows you to specify the source of the attribute. The fields are defined as follows:

Registry value
Specifies whether the attribute is computed from a registry value.
Registry key
Specifies whether the attribute is computed from a registry key.


Registry-Based Attribute Properties, Value Tab

Specifies how the attribute key or value will be computed. The fields are defined as follows:

Check registry key for existence.
Specifies whether the attribute value is computed by checking that the registry key exists. This field is available only if you select Registry key on the Registry-Based Attribute Properties, Type tab.
Check registry value for existence.
Specifies whether the attribute value is computed by checking that the registry value exists. This field is available only if you select Registry value on the Registry-Based Attribute Properties, Type tab.
Retrieve registry key as a ___
Specifies that the registry key be retrieved as the selected data type. This field is available only if you select Registry key on the Registry-Based Attribute Properties, Type tab.
Retrieve registry value as a ___
Specifies that the registry value be retrieved as the selected data type. This field is available only if you select Registry value on the Registry-Based Attribute Properties, Type tab.


Rule Search, Criteria (Alert) Tab

Allows you to specify criteria of the alerts generated by the rules for which you are searching. The fields are defined as follows:

Alert source
Allows you to specify the source of the alert generated by the rule, or to identify it using wild card characters or text strings within the name. Alert source is typically defined by the creator of the rule.
Alert severity
Allows you to specify the severity of the alert generated by the rules for which you are searching, such as Security Breach or Critical Error.


Rule Search, Criteria (Event) Tab

Allows you to specify criteria of the events identified in the rules for which you are searching. The fields are defined as follows:

Event ID
Specifies the number of the event identified in the rules for which you are searching.
Event source
Allows you to specify the application that logged the event, such as OnePointService or MSSQL Server. You can specify it exactly or identify it using wildcard characters or text strings within the source name.
Event description
Allows you to specify the description of the event identified in the rules for which you are searching. You can specify it exactly or identify it using wildcard characters or text strings within the description.
Event type
Allows you to specify the type of the event, such as Error, Warning, or Information.
Event processing rule type
Allows you to specify the type of the processing rule for which you are searching, such as Filter Event or Alert on or Respond to Event.


Rule Search, Criteria (Performance) Tab

Allows you to specify performance criteria within the rules for which you are searching. The fields are defined as follows:

Instance
Specifies the performance counter instance used to report performance values. You can specify it exactly or identify it using wildcard characters or text strings within the instance name.
Domain
Specifies the domain of the computer on which the performance data is collected. You can specify it exactly or identify it using wildcard characters or text strings within the domain name.
Computer
Specifies the computer on which the performance data is collected. You can specify it exactly or identify it using wildcard characters or text strings within the computer name.
Performance processing rule type
Allows you to specify the type of performance rule for which you are searching.


Rule Search, General Tab

Allows you to specify general criteria of the processing rule for which you are searching. The fields are defined as follows:

Rule Name
Allows you to specify the processing rule name, or to identify it using wild card characters or text strings within the name.
Rule type
Allows you to specify the type of rule for which you are searching.
All rule types
Searches all rule types for the specified rule. You can search by rule name, last modified information, and rule response information.
Event processing rules
Searches all event processing rules. You can refine your search by specifying data provider, event criteria, and rule response information.
Alert processing rules
Searches all alert processing rules. You can refine your search by specifying alert criteria and rule response information.
Performance processing rules
Searches all performance processing rules. You can refine your search by specifying performance criteria and rule response information.
Last modified
Specifies the account that last modified this rule, as well as the date and time the rule was last modified. This field is read-only.


Rule Search, Location Tab

Allows you to specify the processing rule groups within which to search for a specified processing rule. The fields are defined as follows:

All processing rule groups
Specifies to search within every processing rule group.
Only the specified processing rule group, not child groups.
Allows you to choose a processing rule group within which to search. This option does not search child processing rule groups within the specified processing rule group.


Rule Search, Provider Tab

Allows you to specify a rule for which to search by its data provider. The fields are defined as follows:

Provider name
Allows you to specify the data provider name, or to identify it using wild card characters or text strings within the name.
Provider type
Allows you to specify the type of data provider, such as Windows Event Log or WMI Events.


Rule Search, Responses Tab

Allows you to specify whether a script response or a specific notification group is part of a response to the rule for which you are searching. The fields are defined as follows:

Launch script
Allows you to select a script for which to search.
Notification group
Allows you to specify a notification group for which to search.


Rules Search Window

Rule Search Window

Contains the results of processing rule search. The fields are defined as follows:

Name
Specifies the name of the processing rule.
Enabled
Specifies whether the rule is enabled.
Type
Specifies the type of processing rule, such as Event Collection or Compare Performance Data.
Path
Specifies the location of the processing rule in the Processing Rule Groups folder.

Related Topics


Rules Settings Window

Allows you to enable or disable the processing rule group detail report in the right pane. When the detailed report is disabled, only the list of child processing rule groups is displayed in the right pane.

Enable
Clear this check box to disable the detailed report in the right pane.


Script Parameter Window

Allows you to specify parameters to pass to the script. The fields are defined as follows:

Name
Specifies the name of the script parameter.
Description
Specifies the description of the script parameter.
Value
Specifies the value of the script parameter.


Script Properties, General Tab

Allows you to specify script properties. The fields are defined as follows:

Name
Specifies the name of the script.
Description
Specifies the description of the script.
Language
Specifies the language in which the script is written.


Script Properties, Parameters Tab

Allows you to view, add, edit, and remove parameters that are passed to the script. These parameters are available to the script through the ScriptContext.Parameters Varset Object. The fields are defined as follows:

Name
Specifies the name of the script parameter.
Description
Specifies the description of the script parameter.
Value
Specifies the value of the script parameter.

To add a parameter, click Add.

To edit a parameter, select a parameter, and then click Edit.

To remove a parameter, select a parameter, and then click Remove.

Note The script Service Bounce Asynchronous is hardcoded for use with Microsoft Operations Manager 2000 only. If you use this script in a rule, you must give it the Name parameter OnePoint. Otherwise, OnePoint service will shut down.


Script Properties, Script Tab

Allows you to specify the source code of the script. The field is defined as follows:

Specify the source code for the script.
Allows you to specify the source code of the script.


Scripts Window

Allows you to view, create, edit, and delete scripts. The fields are defined as follows:

Name
Specifies the name of the script.
Language
Specifies the language in which the script is written.
Description
Specifies the description of the script.

To create a script, complete the following steps:

  1. Select Scripts in the left pane.
  2. Click Action on the menu bar.
  3. Click New on the Action menu.
  4. Click Script on the New Menu.

To edit a script, complete the following steps:

  1. Select a script in the right pane.
  2. Click Action on the menu bar.
  3. Click Properties on the Action menu.

To delete a script, complete the following steps:

  1. Select a script in the right pane.
  2. Click Action on the menu bar.
  3. Click Delete on the Action menu.


Search Results Window

Contains folders of search results.

Related Topics


Select Item Window

Allows you to select, create, and modify computer groups, attributes, processing rules, or processing rule groups. This window displays some of the following columns, depending on the item type:

Name
Specifies the name of the item.
Type
Specifies the attribute type: string, integer, float, or IP address.
Enabled
Specifies whether the item is currently enabled.
Description
Specifies the short description of the item.
Domain spec
Specifies the domain to which the computer must belong to be a member of the computer group.
Expression
Specifies the attribute shared by the members of the computer group.

To select an item for use in the rule you are creating, select the item, and then click OK.

To create an item, click New.

To modify an item, select the item, and then click Modify.


Send a Notification to a Notification Group Properties, Command Format Tab

Allows you to specify the format of a command line to use to send a notification to a notification group. The command line launches a third-party paging application that uses a modem to notify operators in the notification group. The fields are defined as follows:

Use Default Command
Specifies to use the notification command specified in the Configuration snap-in Global Settings.
Custom Command
Specifies the custom command line to use for this notification.


Send a Notification to a Notification Group Properties, E-mail Format Tab

Allows you to specify the format of e-mail messages to notification groups. The fields are defined as follows:

Use default e-mail format
Specifies to use the default e-mail format provided by Operations Manager. The default e-mail message text includes the following fields: Computer, Time, Source, Event ID, Text, Type, User, Agent, Provider Type, Provider Name, and Category.
Custom e-mail format
Specifies to use a custom e-mail format that you specify.
Subject
Specifies the subject line of the custom e-mail message.
Message
Specifies the fields to include in the custom e-mail message.


Send a Notification to a Notification Group Properties, Notification Tab

Allows you to specify the notification group you want to notify when a rule match occurs, create new notification groups, and modify notification groups. The field is defined as follows:

Notification
Specifies the name of the notification group.

To create a new notification group, click New.

To modify a notification group, select a notification group in the Notification field, and then click Modify.


Send a Notification to a Notification Group Properties, Page Format Tab

Allows you to specify the format of pages sent to notification groups using a third-party paging service. Your paging service must provide an SMTP e-mail service for Microsoft Operations Manager 2000 (MOM) paging to work. MOM sends an e-mail to the paging service, which forwards the e-mail to the appropriate paging recipient. The fields are defined as follows:

Use default page format
Specifies to use the default page format provided by Microsoft Operations Manager. The default page message text includes the following fields: Text and Event URL.
Custom page format
Specifies to use a custom page format.
Subject
Specifies the subject line of the page.
Message
Specifies the fields to include in the message of the page.


SNMP Response Editor Window

Allows you to specify where to generate an SNMP trap. The fields are defined as follows:

Locally on the agent computer
Specifies to generate an SNMP trap on the agent computer.
Centrally on the Consolidator
Specifies to generate an SNMP trap on the Consolidator computer.


Threshold Processing Rule Properties, Criteria Tab

Allows you to specify threshold properties that you want this processing rule to match. The fields are defined as follows:

Match from instance
Specifies that the rule matches events from the specified provider instance.
from domain
Specifies that the rule matches events from the specified domain.
from computer
Specifies that the rule matches events from the specified computer.
Criteria description
Specifies all criteria defined for the rule. This field is read-only.

To specify a more advanced rule criteria, click Advanced.


Timed Event Provider Properties, Schedule Tab

Allows you to specify when to generate a timed event. The fields are defined as follows:

Generate event every ___ ___
Specifies how often to generate an event.
Synchronize at ___
Specifies the time of day to begin generating the timed events.


State Variable Update Window

Allows you to view, add, remove, and edit the state variable update operations to perform as a response. The fields are defined as follows:

Variable Name
Specifies the name of the state variable to update.
Action
Specifies the action to perform on the state variable.
Value
Specifies the value, if any, to which to update the state variable.
Perform the operation
Allows you to specify whether to update the state variable locally on the agent computer or centrally on the Consolidator computer. The updated state variables are available to scripts that run where the variables are updated. If you select Locally on the agent computer, the updated state variables are available to scripts that run on the agent computer.
Locally on the agent computer
Specifies to update the state variable on the agent computer.
Centrally on the Consolidator computer
Specifies to update the state variable on the Consolidator computer.

To add a new state variable update operation, click Add.

To remove a state variable update operation, select the state variable update operation you want to remove, and then click Remove.

To edit a state variable update operation, select the state variable update operation you want to edit, and then click Edit.


State Variable Update Operation Window

Allows you to add and edit a state variable update operation. For more information about accessing the State variables from a script, see State Object. The fields are defined as follows:

Operation
Specifies the type of operation to perform.
Number of occurrences
Specifies the number of state variables to store. This field is only available with the Store the last N occurrences operation.
State variable name
Specifies the state variable name to update. This field is not available with the Store the last N occurrences operation.
State variable root
Specifies the root variable name by which to store the occurrences of variables. This field is only available with the Store the last N occurrences operation. When storing the last N occurrences of a variable, Microsoft Operations Manager 2000 (MOM) creates several variables stored with the state variable root. You can access these variable from a script through the State object. MOM creates the following variables with the state variable root:
State_Variable_Root.size
Specifies the number of occurrences stored. This value is equal to the value specified in the Number of occurrences field.
State_Variable_Root.first
Specifies which State_Variable_Root.N variable contains the earliest occurrence of the variable. If State_Variable_Root.first equals 4, then the earliest occurrence of the variable is stored in State_Variable_Root.4.
State_Variable_Root.last
Specifies which State_Variable_Root.N variable contains the latest occurrence of the variable. If State_Variable_Root.last equals 2, then the latest occurrence of the variable is stored in State_Variable_Root.2.
State_Variable_Root.N
Specifies each of the occurrences of the variable. N can be 1 to the value specified in the Number of occurrences field. The occurrences cycle through the N variables overwriting the oldest occurrence. Use the .first and .last variables to keep track of the order of occurrences.
Property
Specifies the event or alert property to which to set the state variable. This field is only available with the Set variable value to property or Store the last N occurrences operation.
Text
Specifies the text to which to set the state variable. This field is only available with the Set variable value to text operation. You can specify the $State Variable$ variable in the Text field. The $State Variable$ variable represents the value of the variable before the state variable update operation is performed.
Number
Specifies the number to which to set the state variable. This field is only available with the Set variable value to number operation.


Windows Event Provider Properties, General Tab

Allows you to specify the Windows event log from which the provider reads data. The field is defined as follows:

Log type
Specifies the Windows event log from which the provider reads data.


Windows Performance Counter Provider Properties, General Tab

Allows you to specify performance counter provider properties. The fields are defined as follows:

Name
Specifies the name of the performance provider.
Counter definitions from
Specifies the computer from which to read performance counter definitions.
Browse
Allows you to browse for the computer from which to read performance counters.
Object
Specifies the name of the performance object to sample.
Counter
Specifies the name of the performance counter to sample.
Instance
Specifies the performance counter instances to sample. The special instance <All> indicates that the provider supplies values for all instances of a given counter.
Description
Specifies the description of the selected performance object and counter. This field is read-only.
Sample every
Specifies how often the performance counter provider samples data.


WMI Numeric Provider Properties, Synchronization Tab

Allows you to specify whether to synchronize sampling data, and if so, when. Sampling begins at the synchronization time each day. The field is defined as follows:

Synchronize at
Specifies the time every day at which to synchronize sampling data.


WMI Numeric Provider Properties, General Tab

Allows you to specify WMI numeric provider properties. For information about the Microsoft WMI SDK, which includes a WMI object browser, see the Microsoft Web site msdn.microsoft.com. To monitor page faults for the OnePoint service, you could create the following WMI numeric provider:

Field | Value
Provider Name | OnePoint PageFaults
WMI Namespace to be searched | root\CIMV2
Class of objects to be measured | Win32_Process
Object instance expression | Description="OnePointService.exe"
Numeric property to sample | PageFaults
Text property to be instance | Description
Sample every | 15 minutes

In this example, if you wanted to monitor page faults for all services, you could leave the Object instance expression field blank. The fields are defined as follows:

Provider Name
Specifies the WMI provider name.
WMI namespace to be searched
Specifies the WMI namespace to which the class of the WMI numeric data belongs. Namespace is a unit for grouping classes and instances.
Class of objects to be measured
Specifies the WMI class to which the numeric data belongs. Class defines the basic unit of management. Each class is a template for a type of managed object. All instances of the type use the template.
Object instance expression
Specifies the instance to measure. Instances contain actual data. If you leave this field blank, all instances of the object are collected. You can use the same operators in this field as those used in the WMI where clause. For more information, see Microsoft WMI documentation.
Numeric property to sample
Specifies the numeric property to measure.
Text property to be instance
Property of the object used to differentiate the instance from other instances.
Sample every
Specifies how often to sample the WMI numeric data.


WMI Provider Properties, General Tab

Allows you to specify WMI provider properties. For information about the Microsoft WMI SDK, which includes a WMI object browser, see the Microsoft Web site msdn.microsoft.com. For example, to monitor the RemoteAccess service and provide a WMI event when RemoteAccess changes from Stopped to Running, you might create the following WMI provider:

Field | Value
Name | RemoteAccess Service Watcher
Namespace | root\CIMV2
Query | select * from __InstanceOperationEvent within 5 where TargetInstance isa "Win32_Service" and TargetInstance.Name = "RemoteAccess" and TargetInstance.State = "Running"
Property List | __Namespace, __Path

In this example, the properties __Namespace and __Path are returned. If you want all properties returned, leave the Property List field blank.

The fields are defined as follows:

Name
Specifies the WMI provider name.
Namespace
Specifies the WMI namespace to which the class of the WMI numeric data belongs. Namespace is a unit for grouping classes and instances.
Query
Specifies the WQL query for WMI event notification.
Property list
Specifies the list of properties you want to view for the notification object. Separate the properties with a comma.


Glossary

A

administrator account
Account used to log on to Windows 2000 by users to create service accounts, install Microsoft Operations Manager 2000 components, and have access to the Configuration snap-in. Administrators are members of the Administrators group and have full control over the domain or computer.
agent
Service that runs on every computer you want to monitor. An agent captures information from the computer on which it is running. An agent applies predefined processing rules to the captured data and performs actions as defined by the processing rules.
Agent Manager
Part of the Consolidator component that tracks computer groups and processing rules, and installs and uninstalls agents as necessary.
alert
An indication of a significant event. Alerts are defined by processing rules.
alert forwarding
Feature that sends alerts from one configuration group to another. Allows the creation of an efficient hierarchical alert management structure for large enterprise networks.
alert rule
Processing rule that specifies one response for a number of previously defined alerts.
alert severity
Property of an alert indicating its seriousness. Examples include Service Unavailable, Security Breach, Critical Error, Error, Warning, Information, and Success.
alert view
Window that displays specified alerts in the configuration group.
attribute
Computer characteristic, typically defined by a Registry key or value.
attribute view
Window that displays specified computer attributes in the configuration group.

B

Boolean regular expressions
Search criteria for text pattern matching that allow you to combine regular expressions using the Boolean operators and, or, and not.

C

company knowledge base
Information you add to alerts or processing rules about resolving the indicated condition.
computer group
Collection of computers with some attribute in common. Computer groups are defined by computer grouping rules for similar event management.
computer group view
Window that displays specified computer groups in the configuration group.
computer grouping rule
Rule that combines computers with common attributes into a group to be similarly managed and monitored.
computer view
Window that displays specified computers in the configuration group.
configuration group
Group of computers containing the following Microsoft Operations Manager 2000 components: one database, one or more Data Access Servers, one or more Consolidators, and one or more agents.
computer rule formula
Regular expression or wildcards used to create a computer grouping rule. For example: Windows_Version = 2000 AND (MSMQ_Installed).
component
Individual part of the product: agent, Consolidator, Data Access Server (DAS), or database.
conditional filter
Filter that allows Microsoft Operations Manager 2000 to evaluate further processing rules, but does not insert events into the database unless another processing rule match occurs.
Consolidator
Collects and sends collected information from agents through the Data Access Server (DAS) to the database. Acts as an agent on its local computer. The Consolidator and Agent Manager install together on a central computer.
consolidation rule
Processing rule for grouping multiple events from a computer into a single summary event.

D

Data Access Server (DAS)
Component that receives events from the Consolidators and inserts them into the database. Requests for data from the database and requests to insert data into the database typically go through the DAS.
database
Central product component that stores information including events, alerts, rules, and scripts.
database filter
Filter that allows Microsoft Operations Manager 2000 to evaluate further processing rules, but does not insert matching events into the database.
datastream
Flow of events, alerts, and performance information from the agents to the Consolidator, from the Consolidator to the DAS, and from the DAS to the database.
duplicate alert suppression
Feature that combines multiple identical alerts within a specified period of time into one alert.

E

event
Any significant occurrence in the system or an application that requires a user to be notified or an entry to be added to a log.
Microsoft Operations Manager 2000 monitors events logged in Windows 2000 event logs and other application logs, among others.
event consolidation
Combines multiple events into one event. The single event identifies the number of consolidated events and when the first and last consolidated events occurred.
event rule
Processing rule for generating an alert when specific events occur.
event view
Window that displays specified events in the configuration group.

F

filter
See filtering rule.
filtering rule
Processing rule for excluding an event, alert, or performance data from some or all processing by Microsoft Operations Manager 2000. Types of filters include pre-filters, conditional filters, and database filters.
forwarding
See alert forwarding.

G

No Glossary entries.

H

heartbeat
Periodic pulse from the agent that contains information related to its viability. The heartbeat also informs the Consolidator of the current rules evaluated by the agent, requesting updates if necessary.

I

No Glossary entries.

J

No Glossary entries.

K

knowledge base
A collection of rule comments that embodies knowledge about the meaning and importance of events. The Microsoft Knowledge Base contains predefined information from Microsoft. The company knowledge base contains information entered by the Microsoft Operations Manager 2000 user.

L

No Glossary entries.

M

Managed Computers list
List of computers matching the Managed Computer rule for an Agent Manager.
Managed Computer rule
Rule that specifies the computers on which an Agent Manager is responsible for installing and uninstalling agents.
Management Pack modules
Predefined solutions from Microsoft. Contain computer groups and processing rules, with filters, performance counters, and alerts defined for specific customer applications such as Microsoft Exchange.
master configuration group
Configuration group to which zone configuration groups forward alerts.
measuring rule
Processing rule for collecting a numeric value from Windows NT performance counters. See performance measure.
missing event
An event that was supposed to occur within a specified time interval, but did not occur.
missing event rule
Processing rule for generating an alert when particular events do not occur during a specified time. See missing event.
MOM Administrator Console
Interface based on Microsoft Management Console (MMC) technology, used for monitoring and event management. Can include the Microsoft Operations Manager 2000 Monitor, Rules, and Configuration snap-ins.

N

nested groups
Rule groups within rule groups.
notification group
List of operators and scheduled availability for receiving page or e-mail responses.

O

OnePointOp ConfgAdms
Windows 2000 group providing member accounts with the permissions necessary to modify the computers on which Microsoft Operations Manager 2000 installs agents.
OnePointOp Operators
Windows 2000 group providing member accounts with the permissions necessary to specify what information is collected and what the product does with it.
OnePointOp System
Windows 2000 group providing member accounts with the permission necessary for Data Access Server (DAS) and Consolidator service accounts.
OnePointOp Users
Windows 2000 group providing member accounts with the permissions necessary to monitor collected information. User accounts cannot modify product functionality.
OnePointOp MOM Reporting
Windows 2000 group providing member accounts with the permissions necessary to run reports using MOM Reporting.
operator
Person scheduled to receive e-mail or page responses from Microsoft Operations Manager 2000.

P

performance data
Sampled numeric data collected from Windows NT performance counters.
performance data view
Window that displays specified performance information.
performance measure
Sampled numeric data collected for capacity planning.
performance threshold
Sampled numeric data compared to a threshold value. Microsoft Operations Manager 2000 generates an alert if the threshold is crossed in either direction.
pre-filter
Filter that excludes an event from further processing by Microsoft Operations Manager 2000. The event is not inserted in the database.
private view
A view that is accessible only by the user who created it, and is saved in the My Views folder.
processing rule
Rule that defines how Microsoft Operations Manager 2000 collects, processes, and responds to information. Types of processing rules include event, filtering, missing event, consolidation, alert, performance measuring, and performance threshold.
processing rule group
Set of processing rules grouped together with a single name. Grouping processing rules together allows you to associate more than one processing rule with a computer group.
processing rule match
Occurs when Microsoft Operations Manager 2000 receives information that matches a processing rule. When a processing rule match occurs, the product performs the actions and response defined in that rule.
provider
Source of information collected by Microsoft Operations Manager 2000. Providers include system event logs and performance counters, among others.
public view
A view that is accessible by anyone, and is saved in the Public Views folder.

Q

No Glossary entries.

R

regular expressions
Search criteria for text pattern matching that provide more flexibility than simple wildcard characters.
MOM Reporting
Interface to the database that allows you to generate reports, including specific security auditing and general system monitoring reports, and graphs useful for capacity planning or performance analysis.
resolution history
Microsoft Operations Manager 2000 automatically tracks changes to alert fields. You can also enter your own information about an alert.
resolution state
Status in the cycle of resolving alerts. Default resolution states include New, Acknowledged, and Resolved, among others.
response
Action that Microsoft Operations Manager 2000 initiates when a processing rule match occurs. Notifications, command or batch files, scripts, and SNMP traps are examples of possible responses. Responses that occur on the Consolidator computer are central responses. Responses that occur on the agent computer are local responses.
rule
Method of grouping computers or identifying data to collect. You can define two types of rules:
  • Computer Grouping: Rule that creates a collection of computers for similar event management.
  • Processing: Rule that defines the events, alerts, and performance data to collect, what to do with the information once it is collected, and how to respond to the indicated condition.

S

script
Simple program that can be added to a processing rule as a response, or used as an extension to the event criteria definition.
service level agreement time
The amount of time an alert can remain in an alert resolution state before it becomes a service level exception.
service level exception
An alert that has remained longer than specified in a resolution state. For example, the default service expectation time for an alert to remain in the New resolution state is 10 minutes. If an alert's resolution state is New for longer than 10 minutes, it is considered a service level exception.

T

threshold rule
Processing rule for creating an alert when a Windows NT performance counter value crosses a defined threshold. See performance threshold.

U

uninstall delay
The amount of time Microsoft Operations Manager 2000 waits before removing an unnecessary agent from a managed computer. The default uninstall delay is 48 hours.

V

view
A window in the Microsoft Operations Manager 2000 Monitor snap-in that displays specified data from the database.

W

Web Console
Interface that allows you to access database information from any Windows platform that can run Microsoft Internet Explorer.
Web Console server
Component installed on a Microsoft Internet Information Services computer that hosts the Web Console.
Web farm
Potentially hundreds of Windows 2000 servers linked in a network environment to support a company's web site. Many thousands of users can access a company's web farm servers in a day. Microsoft Operations Manager 2000 helps network administrators ensure smooth web farm operation.

X

No Glossary entries.

Y

No Glossary entries.

Z

zone configuration group
Configuration group that forwards alerts to the master configuration group.


Microsoft Operations Manager Icons

Microsoft Operations Manager 2000 uses icons to help you identify different snap-ins, events, alerts, views, status, and folders.

Snap-in Icons | Event Icons | Alert Icons
View Icons | Agent Status Icons | Folder Icons

Snap-in Icons

The following icons identify the different snap-ins available in the MOM Administrator Console:

MOM icon | Identifies the Operations Manager Console snap-in.
MOM icon | Identifies the Monitor snap-in.
MOM icon | Identifies the Rules snap-in.
MOM icon | Identifies the Configuration snap-in.

Event Icons

The following icons identify different Windows NT event types:

MOM icon | Error. Identifies an event that resulted in data or function loss.
MOM icon | Error Action. Identifies an Error event that generated an alert.
MOM icon | Failure Audit. Identifies a failed audited security access event.
MOM icon | Failure Audit Action. Identifies a Failure Audit event that generated an alert.
MOM icon | Warning. Identifies an event that might indicate future problems.
MOM icon | Warning Action. Identifies a Warning event that generated an alert.
MOM icon | Information. Identifies a successful application, service, or driver event.
MOM icon | Information Action. Identifies an Information event that generated an alert.
MOM icon | Audit Success. Identifies a successful audited security access event.
MOM icon | None. Identifies an event with no event type.
MOM icon | None Action. Identifies a Success event that generated an alert.
MOM icon | Unknown. Identifies an event type that MOM does not recognize.
MOM icon | Unknown Action. Identifies an Unknown event that generated an alert.

Alert Icons

The following icons identify alert severity:

MOM icon | Service Unavailable. Identifies alerts generated for missed heartbeats and other events indicating that an application or service is unavailable to its users.
MOM icon | Security Breach. Identifies an alert that indicates a security compromise has occurred. Systems on the network are at risk.
MOM icon | Critical Error. Identifies an alert that indicates a serious problem needing attention immediately.
MOM icon | Error. Identifies an alert that is important and needs attention soon.
MOM icon | Warning. Identifies an alert that might indicate future problems.
MOM icon | Information. Identifies an alert that simply provides information.
MOM icon | Success. Identifies an alert that indicates a successful event or operation.

View Icons

The following icons identify different types of views in the Monitor snap-in:

MOM icon | Identifies an alert view.
MOM icon | Identifies a computer attributes view.
MOM icon | Identifies a computer group view.
MOM icon | Identifies a computer performance view.
MOM icon | Identifies a computer view.
MOM icon | Identifies an event view.
MOM icon | Identifies a performance view.
MOM icon | Indentifies a computer view containing one or more computers with a stopped service.
MOM icon | Identifies a computer view containing a Security Breach as the highest severity alert.
MOM icon | Identifies a computer view containing a Critical Error as the highest severity alert.
MOM icon | Identifies a computer view containing an Error as the highest severity alert.
MOM icon | Identifies a computer view containing a Warning as the highest severity alert.
MOM icon | Identifies a computer view containing an Information alert as the highest severity alert.
MOM icon | Identifies a computer view containing a Success alert as the highest severity alert.
MOM icon | Identifies an alert view containing one or more computers with a stopped service.
MOM icon | Identifies an alert view containing a Security Breach as the highest severity alert.
MOM icon | Identifies an alert view containing a Critical Error as the highest severity alert.
MOM icon | Identifies an alert view containing an Error as the highest severity alert.
MOM icon | Identifies an alert view containing a Warning as the highest severity alert.
MOM icon | Identifies an alert view containing an Information alert as the highest severity alert.
MOM icon | Identifies an alert view containing a Success alert as the highest severity alert.

Agent Status Icons

The following icons identify different agent states:

MOM icon | Indicates the agent is stopped.
MOM icon | Indicates the agent is running.

Folder Icons

The following icons identify contents of folders:

Monitor

MOM icon | Identifies a folder containing a component computer whose agent status is Stopped or with Service Unavailable as the highest severity alert.
MOM icon | Identifies a folder containing a Security Breach as the highest severity alert.
MOM icon | Identifies a folder containing a Critical Error as the highest severity alert.
MOM icon | Identifies a folder containing an Error as the highest severity alert.
MOM icon | Identifies a folder containing a Warning as the highest severity alert.
MOM icon | Identifies a folder containing an Information alert as the highest severity alert.
MOM icon | Identifies a folder containing a Success alert as the highest severity alert.

Rules

MOM icon | Identifies the Computer Groups folder.
MOM icon | Identifies the Processing Rules folder.
MOM icon | Identifies the Event Processing Rule folder.
MOM icon | Identifies the Alert Processing Rules folder.
MOM icon | Identifies the Performance Processing Rules folder.
MOM icon | Identifies a folder that contains an enabled processing rule group.
MOM icon | Identifies a folder that contains a disabled processing rule group.
MOM icon | Identifies a folder that contains an enabled processing rule group within a processing rule group.
MOM icon | Identifies a folder that contains a disabled processing rule group within a processing rule group.
MOM icon | Identifies the Notification Groups folder.
MOM icon | Identifies the Advanced folder.
MOM icon | Identifies the Scripts folder.
MOM icon | Identifies the Computer Attributes folder.
MOM icon | Identifies the Data Providers folder.
MOM icon | Identifies the Search Results folder.
MOM icon | Identifes the Processing Rules Search Results folder.

Configuration

MOM icon | Identifies the Global Settings folder.
MOM icon | Identifies the Pending Installations folder.
MOM icon | Identifies the Agent Managers folder.


Microsoft Operations Manager Toolbar Buttons

Monitor Toolbar Buttons

Rules Toolbar Buttons

Configuration Toolbar Buttons

Monitor Toolbar Buttons

The following toolbar buttons are available where applicable in the Monitor snap-in:

MOM toolbar button | Allows you to identify specific alerts you want to find and displays the alerts.
MOM toolbar button | Allows you to identify specific events you want to find and displays the events.
MOM toolbar button | Displays MOM Reporting if it is installed on the local computer, or opens Internet Explorer and displays reports saved to the Web.
MOM toolbar button | Allows you to create a new Monitor view. Available for folder or root node.
MOM toolbar button | Creates a new folder. Available for folder or root node.
MOM toolbar button | Toggles auto-refresh of a Monitor view. The Monitor can auto-refresh the data in a view at a specified rate.
MOM toolbar button | Allows you to insert and delete columns in a Monitor view, and specify their order, in the detail pane.
MOM toolbar button | Displays the previous page of items in a Monitor detail pane.
MOM toolbar button | Displays the next page of items in a Monitor detail pane.
MOM toolbar button | Displays the first page of items in a Monitor detail pane.
MOM toolbar button | Copies selected items to the Clipboard as text.
MOM toolbar button | Creates a new event processing rule based on the selected event. Your user account must be a member of the OnePointOp Operators user group.
MOM toolbar button | Creates a new alert processing rule based on the selected alert. Your user account must be a member of the OnePointOp Operators user group.
MOM toolbar button | Displays the knowledge base for the rule that generated the selected alert.
MOM toolbar button | Displays a list of all alerts for the selected computer.
MOM toolbar button | Displays a list of open alerts, alerts that are not Resolved, for the selected computer.
MOM toolbar button | Displays a list of all events for the selected computer.
MOM toolbar button | Displays a list of the latest computer attribute values collected from the selected computer.
MOM toolbar button | Displays a list of computer groups to which the selected computer belongs.
MOM toolbar button | Displays a list of the latest performance counter values for the selected computer.
MOM toolbar button | Displays the computers belonging to the selected computer group.
MOM toolbar button | Displays a property page of alerts that were generated by the selected event.
MOM toolbar button | Sets the alert resolution state to resolved.
MOM toolbar button | Displays the rule that generated the selected alert.
MOM toolbar button | Displays a graph of selected counters.
MOM toolbar button | Displays a graph of all counters in the view.
MOM toolbar button | Displays a graph of selected counters in the view.
MOM toolbar button | Adds selected counter to the graph view.
MOM toolbar button | Removes selected counter from the graph view.

Rules Toolbar Buttons

The following toolbar buttons are available where applicable in the Rules snap-in:

MOM toolbar button | Allows you to create a new computer attribute definition.
MOM toolbar button | Allows you to create a new computer group.
MOM toolbar button | Allows you to create a new notification group.
MOM toolbar button | Allows you to create a new provider.
MOM toolbar button | Allows you to create a new script.
MOM toolbar button | Allows you to create a new processing rule group.
MOM toolbar button | Allows you to expand or collapse all child processing rule groups in the right pane.
MOM toolbar button | Allows you to expand or collapse all rules under the child processing rule groups in the right pane.
MOM toolbar button | Allows you to create a new event processing rule.
MOM toolbar button | Allows you to create a new alert processing rule.
MOM toolbar button | Allows you to create a new performance processing rule.
MOM toolbar button | Associates a computer group with one or more processing rule groups.
MOM toolbar button | Associates a processing rule group with one or more computer groups.
MOM toolbar button | Displays the knowledge base entries for the selected processing rule.
MOM toolbar button | Creates a new operator within selected notification group.

Configuration Toolbar Buttons

The following toolbar buttons are available where applicable in the Configuration snap-in:

MOM toolbar button | Allows you to modify the global settings of the configuration group.
MOM toolbar button | Allows you to modify Agent Manager settings for the configuration group.
MOM toolbar button | Allows you to modify agent settings for the configuration group.
MOM toolbar button | Allows you to modify Consolidator settings for the configuration group.
MOM toolbar button | Allows you to add computers to and remove computers from the Managed Computers list.
MOM toolbar button | Allows you to modify the agent settings on a specific computer.
MOM toolbar button | Performs the installation or removal of any agents that are awaiting approval.
MOM toolbar button | Scans managed computers for all Agent Managers displayed in the view.
MOM toolbar button | Scans managed computers for the selected Agent Manager.
MOM toolbar button | Excludes the selected agent computer from the Agent Manager Managed Computers list.


Print the Help System

You can print all topics in the Microsoft Operations Manager 2000 (MOM) Help system as follows:

  1. In the navigation pane of the Help Viewer, click the Contents tab.
  2. Right-click the MOM book at the top of the table of contents, and then click Print.
  3. In the Print dialog box, click Print the selected heading and all subtopics, and then click OK.
  4. In the second Print dialog box that opens, click OK.

Related Topics


State Object

The State object is a named varset object. As a response to an event, alert, or performance measurement, you can save and edit state information in the State object. You can then access this state information from scripts.

There are different types of state operations. Most state operations edit a variable by incrementing it, decrementing it, or setting it to a specific value. These operations include the following operations:

  • Increment variable value
  • Decrement variable value
  • Set variable value to property
  • Set variable value to text
  • Set variable value to number

These operations make the variable specified in the State variable name field available to scripts through the State object.

The Store the last N occurrences operation creates the following variables with the state variable root:

State_Variable_Root.size
Specifies the number of occurrences stored. This value is equal to the value specified in the Number of occurrences field.
State_Variable_Root.first
Specifies which State_Variable_Root.N variable contains the earliest occurrence of the variable. If State_Variable_Root.first equals 4, then the earliest occurrence of the variable is stored in State_Variable_Root.4.
State_Variable_Root.last
Specifies which State_Variable_Root.N variable contains the latest occurrence of the variable. If State_Variable_Root.last equals 2, then the latest occurrence of the variable is stored in State_Variable_Root.2.
State_Variable_Root.N
Specifies each of the occurrences of the variable. N can be 1 to the value specified in the Number of occurrences field. The occurrences cycle through the N variables overwriting the oldest occurrence. Use the .first and .last variables to keep track of the order of occurrences.

Set the operation, values, and name and root field for state operations with the State Variable Update Operation Window.

Example 1

To access the number of times an event occurred after setting a state response to increment the LogonViolations.Count state variable name, enter:

Dim MYcount

MYcount = State.Get("LogonViolations.Count")

Example 2

To access the last occurrence of the logon domain after setting a state response to record the last 50 occurrences of the Logging Domain variable with the LogonViolations.LoggingDomain state variable root, enter:

Dim MYLastOccurrence
Dim MYLastDomain

MYLastOccurrence = State.Get("LogonViolations.LoggingDomain.last")
MYLastDomain = State.Get("LogonViolations.LoggingDomain." + MYLastOccurrence)

Related Topics


Disabling an Alert

Alerts are generated by certain types of processing rules. You can disable an alert without disabling or deleting the processing rule. The processing rule will continue to collect information and run responses, but the alert is not generated.

Disabling an alert in the Monitor requires your user account to be a member of the Operators (OnePointOps Operators) user group. For more information, see Requirements and Permissions.

To disable an alert:

  1. Expand Microsoft Operations Manager (default) in the left pane.
  2. Expand Monitor in the left pane.
  3. Display the alert. For more information, see Viewing Alerts.
  4. Click the alert in the right pane.
  5. Click Action on the menu bar.
  6. Click All Tasks on the Action menu.
  7. Click View Rule. Note the name of the processing rule in case you want to re-enable the alert later.
  8. Select the Alert tab.
  9. Clear the Generate alert check box, and then click OK.

Related Topics


Approving All Pending Actions

By default, computers requiring agent installations and uninstallations are added to the Pending Installations list to wait for approval. You can approve or cancel all pending actions or each individual pending action.

To approve all pending installations or uninstallations:

  1. Expand Microsoft Operations Manager (default) in the left pane.
  2. Expand Configuration in the left pane.
  3. Click Pending Installations in the left pane.
  4. Click Action on the menu bar.
  5. Click Approve All Pending Actions on the Action menu.
  6. Click Action on the menu bar.
  7. Click Process All Approved Actions on the Action menu. The time required for installation or uninstallation depends on your network configuration.
  8. Click Action on the menu bar.
  9. Click Refresh on the menu bar.

Related Topics


Approving a Pending Action

By default, computers requiring agent installations and uninstallations are added to the Pending Installations list to wait for approval. You can approve or cancel all pending actions or each individual pending action.

To approve an individual pending installation or uninstallation:

  1. Expand Microsoft Operations Manager (default) in the left pane.
  2. Expand Configuration in the left pane.
  3. Click Pending Installations in the left pane.
  4. Click the pending installation or uninstallation in the right pane that you want to approve.
  5. Click Action on the menu bar.
  6. Click Approve Pending Action on the Action menu.
  7. Repeat steps 4 through 6 for each action you want to approve.
  8. Click Pending Installations in the left pane.
  9. Click Action on the menu bar.
  10. Click Process All Approved Actions on the Action menu. The time required for installation or uninstallation depends on your network configuration.

Related Topics


Canceling All Pending Actions

By default, computers requiring agent installations and uninstallations are added to the Pending Installations list to wait for approval. You can approve or cancel all pending actions or each individual pending action.

To cancel all pending installations or uninstallations:

  1. Expand Microsoft Operations Manager (default) in the left pane.
  2. Expand Configuration in the left pane.
  3. Click Pending Installations in the left pane.
  4. Click Action on the menu bar.
  5. Click Cancel All Pending Actions on the Action menu.
  6. Click Action on the menu bar.
  7. Click Refresh on the menu bar.

Related Topics


Canceling a Pending Action

By default, computers requiring agent installations and uninstallations are added to the Pending Installations list to wait for approval. You can approve or cancel all pending actions or each individual pending action.

To cancel an individual pending installation or uninstallation:

  1. Expand Microsoft Operations Manager (default) in the left pane.
  2. Expand Configuration in the left pane.
  3. Click Pending Installations in the left pane.
  4. Click the installation or uninstallation in the right pane that you want to cancel.
  5. Click Action on the menu bar.
  6. Click Cancel Pending Action on the Action menu.
  7. Repeat Steps 4 through 6 for each action you want to cancel.

Related Topics


Excluding a Computer in the Configuration Snap-in

You can exclude a computer from the Managed Computers list of an Agent Manager using the Configuration snap-in. You can exclude a computer using the Agent Manager properties windows, or in the Pending Installations list.

To exclude a computer using the Agent Manager properties:

  1. If the computer is not already listed in the Managed Computers list, complete the following steps:
    • Expand Microsoft Operations Manager (default) in the left pane.
    • Expand Configuration in the left pane.
    • Click Agent Managers in the left pane.
    • In the right pane, click the Agent Manager responsible for the computer you want to exclude. For more information about determining the Agent Manager for a computer, see Monitoring the Status of a Component.
    • Click Action on the menu bar.
    • Click Modify Managed Computer Rules.
    • On the Managed Computer Rules tab, click Add.
    • Follow the instructions until you have identified the computer you want to exclude, and then click OK.
  2. If the computer is already listed in the Managed Computers list, complete the following steps:
    • Expand Microsoft Operations Manager (default) in the left pane.
    • Expand Configuration in the left pane.
    • Click Agent Managers in the left pane.
    • In the right pane, click the Agent Manager responsible for the computer you want to exclude. For more information about determining the Agent Manager for a computer, see Monitoring the Status of a Component.
    • Click Action on the menu bar.
    • Click View Managed Computers.
    • Click the computer you want to exclude.
    • Click Exclude. The agent will be removed at the next Managed Computer scan.

      • Note

      • If you want to remove the agent from the computer now, click Uninstall Now.

To exclude a computer in the Pending Installations list:

  1. Expand Microsoft Operations Manager (default) in the left pane.
  2. Expand Configuration in the left pane.
  3. Click Pending Installations in the left pane.
  4. In the right pane, click the computer you want to exclude from the Managed Computers list.
  5. Click Action on the menu bar.
  6. Click Exclude from Managed Computers List.

Related Topics


Excluding a Computer in the Monitor Snap-in

You can exclude a computer from the Managed Computers list for an Agent Manager using the Monitor snap-in.

Excluding a computer from a Managed Computers list using the Monitor requires your user account to be a member of the Configuration Administrators (OnePointOp ConfgAdms) group. For more information about user accounts and groups, see Requirements and Permissions.

To exclude a computer from the Managed Computers list using the Monitor snap-in:

  1. Expand Microsoft Operations Manager (default) in the left pane.
  2. Expand Monitor in the left pane.
  3. Expand Components in the left pane.
  4. Click Agents in the left pane.
  5. In the right pane, click the computer you want to exclude.
  6. Click Action on the menu bar.
  7. Click All Tasks on the Action menu.
  8. Click Exclude from Managed Computers List.

Related Topics


Uninstalling an Agent Now

You can remove an agent from a computer immediately. You might uninstall an agent immediately if you do not want to wait for the Agent Manager to automatically remove it at the next Managed Computer scan. Agent Managers uninstall unneeded agents after the uninstall delay period. For more information, see Configuring Global Agent Manager Settings.

The Uninstall Now procedure removes an agent immediately and excludes the computer from the Managed Computers list.

To uninstall an agent immediately:

  1. Expand Microsoft Operations Manager (default) in the left pane.
  2. Expand Configuration in the left pane.
  3. Click Agent Managers in the left pane.
  4. In the right pane, click the Agent Manager responsible for the agent you want to uninstall. For more information about determining the Agent Manager responsible for an agent, see Monitoring the Agent Status of a Component Computer.
  5. Click Action on the menu bar.
  6. Click View Managed Computers on the Action menu.
  7. Click the computer with the agent you want to uninstall.
  8. Click Uninstall Now, and then click OK.

Note

  • An Agent Manager cannot uninstall agents that were manually installed, such as outside a firewall, unless the Agent Manager has been granted control of the agents. For more information about uninstalling manually installed agents, see the Installation Guide.

Related Topics


Uninstalling All Agents

If necessary, you can uninstall all agents from computers in the Managed Computers list of an Agent Manager. This task is typically performed as part of removing the product from your enterprise.

If you remove agents from monitored computers, data is no longer collected, rules are not evaluated, and information is not stored in the database for those computers.

Note

  • An Agent Manager cannot uninstall agents that were manually installed, such as outside a firewall, unless the Agent Manager has been granted control of the agents. For more information about uninstalling manually installed agents, see the Installation Guide.

To permanently remove all agents from computers in the Managed Computers list of an Agent Manager:

  1. Expand Microsoft Operations Manager (default) in the left pane.
  2. Expand Configuration in the left pane.
  3. Click Agent Managers in the left pane.
  4. In the right pane, click the Agent Manager whose agents you wish to remove.
  5. Click Action on the menu bar.
  6. Click Modify Managed Computer Rules on the Action menu.
  7. Click a rule on the Managed Computer Rules tab.
  8. Click Delete.
  9. Repeat Steps 7 and 8 for every rule.
  10. In the right pane, click the Agent Manager with agents you wish to remove.
  11. Click Action on the menu bar.
  12. Click All Tasks on the Action menu.
  13. Click Uninstall Agents.
  14. If you want to remove all agents from all Agent Managers in the configuration group, repeat steps 3 through 14 for every Agent Manager.

Note

  • If you do not delete the Managed Computer rules, the agents you remove will be reinstalled at the next Managed Computer scan.

Related Topics


Viewing Component Status

You can view the status of the agent running on computers containing other components: the agent itself, the agent on the Consolidator computer, and the agent on the Agent Manager computer.

To view the agent component status:

  1. Expand Microsoft Operations Manager (default) in the left pane.
  2. Expand Monitor in the left pane.
  3. Expand Components in the left pane.
    • If you want to view agent status, click Agents in the left pane.
    • If you want to view agent status on Consolidator computers, click Agents in the left pane.
    • If you want to view agent status on Agent Manager computers, click Agent Manager in the left pane.

Related Topics


Agent Properties, Heartbeat Tab

Allows you to specify how often agents check for processing rule updates and report availability of managed computers. The field is defined as follows:

Heartbeat every ___ seconds
Specifies how often the agent heartbeat occurs.
Report computer availability every ___ seconds
Specifies how often the agent reports the availability of the computer.


Windows Performance Counter Provider Properties, Synchronization Tab

Allows you to specify the time of day at which to synchronize sampling data. The field is defined as follows:

Synchronize at
Specifies whether to synchronize sampling data and, if so, what time of day synchronization will take place.