Hi Everyone, My name is Filip Lazar, and I work on the System Center Operations Manager team. Im currently focusing on the quality aspects of the management pack space. I'd like to reach out and get your feedback regarding your experiences in this area. Feedback for any of the questions asked below would be greatly appreciated, but please do share anything else you feel is relevant to this discussion. What are most common issues you encounter when importing new MPs that contribute to bad customer experience? Anything that applies across MPs and deals with quality categories in general would quite helpful to know. If you could share your top list of issues that you may have encountered such as non-optimal discovery intervals settings, MPs with lots of property churn, etc.that would be great. What do you consider to be the pain points in the current tuning process, and how well do you feel stock MPs are generally tuned when you first download them? Im also looking for any anecdotal information or metrics you might have such as average effort it takes to tune an MP, etc. What differentiates the best MPs from the rest, and what are key items that you look for in a quality MP? How high on an end user's mind do you believe MP quality to be? Does MP quality surface as a core issue that is considered in SCOM adoption as opposed to a competing product? Thanks, Filip

Hi Filip, I received too many alerts as soon as I re-imported the Data Warehouse MP (every minutes). I had to ask our DBA to restore the database to go back to the previouse condition (didn't know any other way). As soon as I re-imported again I received many Data Warehouse alerts and for second time I asked the DBA to restore the database again. Since then, I am afraid to re-import the MP (why doing that? There was a new version and when I imported it, it actully let me import it rather than receiveing the message that the MP is already exist).

I think that one of the most important things for an MP is for most/all rules & monitors to be DISABLED out of the box and let us enable what we want. (In fact, we're looking at a VERY expensive bit of software that will help us manage the MPs, including creating mass overrides/disables). There's too much "stuff" in most MPs that doesn't provide us any direct value. For example, in the SQL 2005 Management Pack, there's a rule for "AppDomain failed to unload with error code" that generates an alert (event ID 6291). What does this mean? There are no useful Google hits for it and there are NO hits for event ID 6291 in the MS KB. It's just one more monitor that the agent needs to handle, and if it does generate an alert, there's no way to determine what it means. What's more, the "Product Knowledge" for this rule refers to event ID 6219 (not 6291, which is what's in the rule configuration) - and there aren't any Google or MSKB hits for 6219, either. So, out of the 350+ rules & monitors in the SQL 2005 MP, we're probably going to use 10-20. This goes hand-in-hand with the MP guides needing to be VERY detailed about what they collect/do. If the MP guide explained this rule or at least referred to an MS KB article on what it meant, then maybe we'd see value in it and would implement it. "Fear disturbs your concentration"

Thanks for the feedback up to now - dokeep it coming!

Quick follow up to this Andy - you mentioned that you are looking at some software to help you manage the MPs. Is this custom software that you are writing, or is this an existing product?

It's an existing product called MPStudio by Silect."Fear disturbs your concentration"

MP quality reflects directly on SCOM'07 quality. Remember, without MPs, SCOM just sits there and stares at you. An MP needs to add value. It needs to function properly, without negatively impacting the environment it is monitoring. Most MPs accomplish this farly well. Some are just plain bad and or useless. Some issues I've encountered:1. Converted MPs. Typicaclly bad, useless and noisy. Print Server MP for instance. Completely useless. There is no value to this MP. It creates a lot of script failure noise, probably due to bad discoveries. Speaking of discoveries, in this MP they basically blow. When will this MP be fixed?????2. Discoveries, Discoveries, Discoveries. Why are discoveries such a problem? I've seen some rediculous discovery intervals in MPs. Bad discoveries are known to cause SCOM performance issues.3. Script or executable falied to run. OK, these alerts are a lot more common than they should be. It seems to be certain mamagement packs creating MUCH more noise than others, again I'm going to assume because of bad discoveries. Print Server MP and Virtualisation MP seem to be the the worst, I probably get 20-30 alerts a day. . Pring Server was so bad I removed the MP, it wasn't adding any value anyway (see above).4. Non-sensical rollups/aggregations. This one really peeves me kills credibility foravailabilability reporting. Example: Disk space monitor from Windows Server OS MP impacts availability stats for a server. THis is just plain dumb. I might have a drive that is low on space, but the server is still happily servrving stuff up to end users. THere has been no interruptino to service. Some PHB now runs an availability report and starts asking why the server was UNAVAILABLE. Nonsense.These things need to be based in reality. I know MS is really big on the whiole MOF thing. Either MOF is flawed or how it's being applied to this systems monitoring product is flawed.Anyways, my $.02Dean

Hi Filip,There's already a great thread going in the Management Packs section started by Dan Rogers http://social.technet.microsoft.com/Forums/en-US/operationsmanagermgmtpacks/thread/03c8a055-fbcb-4433-931a-8e471bd82d3dI guess this overlaps (a bit) with yours.Anyway one of the major painpoints I found out the hard way is that there's no such thing as a 'rollback to previous version' in case of bugged MP (shouldn't IMO hit the streets in the first place).With a couplebugged SQL MP's in a row last year, we've lost tons of credits with our DBA's. Also I had a hard time explaining to management why MSFT wasn't able to provide a decent MP for one of their own products and why it took so long to get it fixed(credibility down the drain).Cheers,Serge

Hi there, Here is a list of things that are good in management packs: MPs with discovery DISABLED by default - e.g. new Exchange 2007 MP MPs with service level objectives built in MPs with distributed application models built in Common issues include: Too many alerts being enabled 'out of the box' this confuses and scares off customers, who perceive OpsManager to be a 'noise generator' rather that simply reporting operational problems Management pack QA is generally not the best - e.g. previous MOSS/SharePoint management packs Availability rollups - as previously mentioned, this could be addressed more sensibly. Critical state should mean that a service is unavailable or that failure is imminent. It would help if it was easier to achieve a lesser level of monitoring for customers that are new to OpsManager, many of our customers are coming from much more simple monitoring products. This would help the adoption curve. Things that are not so good : ISA 2006 management pack not supporting SP1 - is this still true? this is unacceptable, we were told that this will NEVER be fixed :( OCS management pack not having a state view, at least it didn't when I last looked Matt

Unlike some of the above, I am happy to have the rules/monitors enabled out-of-the-box.But I mayturn off Notifications when importing a new MP, so if there are problems, no "storms" occur. An hour or two later,notifiations will be turned back on, having applied any over-rides to subdue excessive alerts.Personally, I wouldn't know what to turn on/off for Exchange or SQL or AD(as examples) as I'm not that much of an expert on them. I would rather let the Microsoft engineers for those products tell the guys writing the MP's what they consider to be the rulesets that need enabling and go with that. What I see as one of the pluses with SCOM is that (my assumption may be wrong) the MS engineers would know the innards of their products better than others. Otherwise if that were not the case then I would stick with NAGIOS monitoring (which we use for Unix/Linux)...It's free and there's plenty of support. But I can't get to the "bowels" of say Exchange, with Nagios, without a LOT of work. So SCOM is used and I plug in the Exchange MP, and the Exchange admins are happy with the alerting...Finding out if I should turn on/off certain monitors for the Blackberry Exchange servers is not on my list of to do's. I expect that to be part of an informed MS engineer's list of work.HTH,John Bradshaw

Thanks for all of your feedback, it's greatly appreciated.In particular, the examples provided add a lot of value!Filip

I agree with both points above. In general most MPs have too many rules/monitors enabled which need to have overrides created right out of the box, when they really should be disabled out of the box. It also seems a bit strange that mp guides are as thin as they are considering the volume of rules/monitors/etc it puts in your OpsMgr environment,and the number of overrides that have to be created to manage the noise. It would be nice to have a guide that details whats really going on, with discoveries etc. for clarification: The points above are more centered on 3rd party hardware management packs, like HP, Dell and IBM.

Hi Filip, I generally agree that the quality of the management packs is not good enough (or not what you would expect for the price that you have to pay for OpsMgr). My pet peeve is probably the missing Replication monitoring in the SQL Server Management Pack. I mean, this is really, really, really basic stuff. Stefan

Hi Filip The MPs give to many alerts that cant be used, and the documentation does not give information enough, you have to test to much. We use to much time receiving mails from server administrators with requests of disabling alerts. In our installation the Ex and AD MP are running almost default, but with SQL we had to develop our own. IIS,MOSS,SPS we have disabled 95% of the MP, because they gave to many alerts. I think the MP default settings should be cut down, to core service monitoring(needs to know alerts), then I could if I had the time enable all the (nice to have alerts).

Hi, Windows base OS - I found that if the disks failed this MP doesn't send alerts about that SQL MP - Have no replication monitor, SQL replication is very important and the SQL MP is not include that Exchange MP - No mail flow monitor out of the organization (only internal), right now I wrote a script that send email to my friend mail server using SMTP, my friend mail server have auto replay to my emails and I'm checking this auto replay using POP3, maybe Microsoft (SCOM group) have an option to create this service (auto replay) or can send email to non existing mailbox and check the NDR Notification - In MOM 2005 there was build in notification group, e.g. all my DBA can joined to SQL build in notification group and all SQL problem was send to my DBA, in SCOM there aren't build in notification group Right now if I have network down I'm getting agent is not available alert from all my agents (hundreds)

#3 is fixed with the R2 Exchange MP."Fear disturbs your concentration"

Basically agree with the others. Scripts cause a lot of errors. If you fail to upgrade Windows Scripting Host 5.6 to 5.7, you'll find your agents running 10-12 cscript.exe processes simultaneously, each of them using 150 MBs of memory and 100% CPU - effectively making the monitored server unusable. Last summer I imported the DNS management pack. Because of some scripting error, it made unusable ALL of the domain controllers at one of our clients. I called Microsoft support, and the error was already known for them. However, the same buggy MP was available for 3 months in the management pack catalog, and there was no warning that problems may occur. This is related to the management of management packs. Further, sometimes I feel that categorization of alerts could be fine-tuned. Operators want to know if something really goes bad. It's said, OpsMgr imlements service-based management; however, operators get a lot of "red" alerts because of errors having a relatively minor effect on operations.mz

Hello there,I have an example of an unsatisfactory experience with the Configuration Manager 2007 management pack.Firstly, this has not been updated for two years and is a converted MOM 2005 MP.Now the real issue:Our ConfigMgr site is in native mode and the management pack did not warn us when the site server document signing certificate was expired. I would have thought that this type of event would be included.It is strange how the ConfigMgr team do not communicate with their brethren in the OpsManager team and help improve this.Please can we have more collaboration efforts? I know I have mentioned this before, but the new Exchange MP is fantastic. It shows a real understanding of availability for the service rather than the servers.Matt.

I agree with most of the comments posted, however I wanted to highlight the frustration of waiting for MPs when a product is released. When Ops Mgr was released,my understanding was that management packs would become a key deliverable for every Microsoft application and OS release thereafter. However, this commitment appears to have been conveniently forgotten and it seems very random as to whether management packs will be released for new products in any kind of reasonable timeframe.

I have to concur with the waiting frustration. I remember a statement from a formerhead of the Management and Solutions Division at TechEd Barcelona a couple of years ago: No MSFT product will hit the shelves without the accompanying MP ...Cheers,Serge

The WSUS MP has lousy Alert descriptions.See how meaningful the following Description Field is... Alert: Silent Clients Source: WSUS Path: MyServer Last modified by: System Last modified time: 24/06/2009 9:32:02 AM Alert description: I think u need to add dilute HCL to make the description visible.John Bradshaw

I want to chime in on the WSUS MP alert descriptions. Worthless in many cases. Looking at a couple of alerts right now and have no idea what I need to do. Going to have to take the MP apart.Pete Zerger, MVP-OpsMgr and SCE | http://www.systemcentercentral.com

Definitely timely delivery of MPs for all OS and Server products is a must. I think the current commitment is RTM + 90 days, but even if this is met, it hinders immediate adoption at the RTM timeframe. I do appreciate that developing an MP for concurrent release may not be feasible, but consistancy in delivering on this commitment should be considered a priority.Pete Zerger, MVP-OpsMgr and SCE | http://www.systemcentercentral.com

There is a limitation in the AD MP which does not allowmonitoring of a domain other than the one where the RMS sits. We have more than 1 domain to monitor but we can't do it with the MS AD MP.The MS DHCP MP does not support more than 500 scopes. We have more than 500 scopes so this MP is also not helping us.I would say that in general the documentation is VERY deficient. The documentation should list the rules monitors discoveries and explain what they do.I also find that the information to run in low privilege environnement is not adequate. For example, to run the AD MP with "low-privilege" you need to "be a member of the Administrators group" (from the documentation). Can someone explain to me what is "low-privilege"about the Administrators group ???The MPs released by MS do not look like professionally made and tested packages. It looks likethe MPs have beenthrown together so they could sell opsmgr which would be useless without them...

Thanks everyone. A lot of common themes have been coming up in your feedback, which is quite helpful.

ISA MP fix for SP1 is in the works. This should come in the third quarter.Microsoft Corporation

Please let the CongifMgr team know of your concerns with their MP. We communicate with them, but the answer is "we are not hearing this from our customers."Coming from you, it means something. Remember, this is the config manager MP - it doesn't come from the ops manager team.Microsoft Corporation

Hi Dan, What is the best method of doing this? Is it the CM forums on this site? Matt.

I'm sorry Dan, but that answer is a bit nonsensical. If I call into PSS with a Windows Server MP problem or an Exhange MP problem, which queue do you think I'm going to end up in? I think it's you guy's that are going to have the stats. YOU need to tell these guys "WE'RE hearing it from your customers". It's bad enough when we get the run around and finger pointing between vendors.........

We had lot of issues with the BizTalk MP, This takes lot of CPU on the servers due to discoveryscripts and monitor scripts. I douldnt deploy Biztalk on our production servers as its dosent make sense to monitor the system with the current MP version. BizTalk is the MP that had lot of issues from the first version. MS Support people admit the issue with the MP after a long discussion and call and dont have a ETA on the new version. Its really sad that MS couldnt create a good MP for MS products itself.Another issue is with SQL MP, where "A SQL job failed to complete successfully." alert dosent make sense and not reporting the real SQL Job failure.

Yes, what's the best method to feedback on MP's? Here,via the Feedback link of the MP in the System Center Operatons Manager 2007 MP catalog, via connect.microsoft.com or something else?Which method is most likely to get the feedback to the correct department?

Microsoft also promised at Teched in Barcelona 2.5 years agoto work on SCOMmanagement packs, test them internally to remove noise and to release them as beta before getting them rtm. But since then i think there are only 2-3 management packs released (apart from new products), rest is still the crappy 2005 upgraded packs.And invest in mp's not depending on trust.Some discoveries are performed from the RMS and you need trusts to all other forestswhich you want to monitor. Looks like i need to create my own AD mp again (i had to rewrite large parts in mom2005 as well). I've about 99% of my servers in other forests (around 80 atm)without trusts, but i'm sure most compagnies have a DMZ. It should be a design goal of an mp to work without trust.Also i would like to see improvement of the readability of mp's. It's very hard to understand what is monitored exactly.If you don't understand what is being monitored, you can'tsolvean issue anyway.

Pls see here http://social.technet.microsoft.com/Forums/en-US/operationsmanagermgmtpacks/thread/61078b8f-f66d-473b-8480-9813645f035dfor new ISA MP not working on R2.Thx,John Bradshaw

This is about the beta Exchange 2010 management pack. Why do the agents need to have Local System as the action account? Can we NOT do this anymore? Running ANYTHING as local system is a massive security hole, which is why we run our Agent Action Account with a "service account." And once you find out that you need to change the AAA, there's no way to do it from the Operations Console or from Programs & Settings; you never get asked if you want to change the AAA."Fear disturbs your concentration"

Hi, I wouldliketo see the management packs more in form of daily basises issues rather than environmental custom need. The example would be: Harware failure, space issues rather than drive defragmentation. Every Friday, the defragmentation runs and I don't know how to deal with it and tune it. Also, there are lots of "Script or Excutable Failed to run" and "WMIProbe Module Failed Excution"and I am not sure how to deal with those either.

hi ZibaI realise yours is a general comment but specifically with regard to the fragmentation:http://blogs.technet.com/kevinholman/archive/2009/09/28/new-base-os-mp-6-0-6667-0-adds-file-fragmentation-monitor-to-all-logical-disks.aspxKevin Holmans blog is one to keep an eye for all the bits of "real world" info that don't make it into the MP guides. CheersGrahamView OpsMgr tips and tricks at http://systemcentersolutions.wordpress.com/

Thank you Graham as always for your help.

AD MP will monitor other domains but will not populate topology discovery for domains that do not have a trust to the domain the RMS is joined to.

Microsoft continues apace at releasing MPs that are NOT ready for primetime. Today, the Exchange 2010 MP was released. Since we're testing 2010 here, I installed the MP (the 3rd revision for us) on my R2 system. Immediately, all of my agents went nuts and reported "Critical Operations Manager hotfixes are not installed." The description of the alert contained a reference to a non-existent KB article/hotfix for R2, 974144 as well as an URL that was 404, http://go.microsoft.com/fwlink/?LinkID=167912. The hotfix & URL for SP1 worked OK. I tweeted about this and @ExchMon responded "You may see some incorrect alerts, but it isn't required for it to function. Hotfix will be available from opsmgr soon." and I responded to that, the ExchMon response was "Fair - the hotfix package was delayed and we thought it better to get the MP out with Exchange for testing, etc.". This is 100% unacceptable for any reason. MP quality has already been a serious issue with SCOM and releasing something like this just adds to the black-eyes that SCOM continues to receive, and rightfully so. PS: the previous 2 versions of the Exchange 2010 never did discover all of our systems, either. "Fear disturbs your concentration"

Hi Filip, I am using most of the the OS/Windows server and I wish they had same MGMT PKS MOM 2005 for SCOM 2007 default mgmt packs. This way, we would just choose those to receive alrets. Thanks, Ziba

Hi Filip,Perhaps you could enlighten us all with an update to all the feedback. It would be good if you could provide specific comments, not generalities, so we can gauge the effectiveness of the responses provided.thankyou,John Bradshaw

Thanks for the perspective.However, behind the scenes, things do get back to the right teams from PSS (we have a process that does this that was introduced a few months back).But there is NOTHING that moves a product team like direct customer feedback. So yes, hit their blogs, hit their forums on this site, call their support team - a problem with a products management pack is a problem with the product. And chime in here. Believe it or not, over time, we analyze the trends in this data. In some cases we start immediate action if it is an MP that OM team owns (there are only 4 that OM team still owns, and one of them is the OM MP and the other is the base OS MP for server or client).So when you call into PSS for an exchange problem, the Exchange PSS team will know about the management pack - they are being trained on it to get ready for the Exchange 2010 management pack - the first MP for exchange actually written by the product team. That's a huge change up - but your perspective does reflect history accurately - black hole. We're working on the hole - little by little.Microsoft Corporation

Hi John,At the time the thread was startedone of the things being considered was the Authoring Console Resource Kit, which has since been released. A lot of the feedback provided here helped shaped what was released,in particular, the MP Best Practices Tool. It helpeddeterminethe need forit, as well ashelped us definesome of the actual Best Practices this tool scans for.As Dan mentions, we also send feedbackinternally to respective product team responsible for features or MPs,which impacts the work that gets done in terms of identifying gapsand opportunities to help improve your experience.It may not beimmediately evident that this feedback gets used, but we do hold ourselves accountable to improving the trend we see from the community.Filip

There are two services in IT where a service failure will bring instant death to an IT professional's career; email and printing. Both services are critical to almost all organizations. Printing, besides being a operationally critical function, is one that is very costly to most organizations. It is a cost that many organizations are trying to contain in this bad economy. Companies are tightly managing resources devoted to printing. The Print Services MP in SCOM 2007 R2 is horrible. The functionality is far less than what was present in MOM 2005. The currently released Print Services MP is incapable of the basic discovery of printers. Plus, the reports are completely inadequate. Sean Toomey

I would say through the CM forums, which are monitored by the CM group. That combined with Bubsig's suggestion of the OM team telling them has them hearing the issue from multiple sides.

Can product teams be required to create a seperate discovery and monitoring mp going forward? DPM 2010 MP just RTM and it has just a monitoring MP, so when I override a monitor in that MP, guess what...All my agents get the override MP. Stop targeting Windows Computer for discoveries that are not SEED discoveries. Please do not nest discoveries (IIS 2000/2003), and make most everything about a discovery exposable via overrides so we can control what these things do (I know that maybe hard in the case of scripted discoveries). Please be more careful about what REPORTS are targeting, so as not to cause confusion in the console when looking at the reporting tasks (major boo boo MP's that do this: SharePoint 2007, Exchange 2010). Do not include monitors and or rules in an application managment pack that will duplicate the monitoring efforts of other management packs (IE Exchange 2010 doing a SCOM agent version check which raises a critical alert if not at the current version - on ALL agents in your enviornment Exchange 2010 box or not). Regards, Blake Email: mengotto<at>hotmail.com Blog: http://discussitnow.wordpress.com/