Configuring Monitoring Scenarios in the Windows Servers Base Operating System State Management Pack

The Microsoft Windows Servers Base Operating System Management Pack for MOM 2005 includes several monitoring scenarios that are configurable. The following table lists these scenarios and also indicates which elements of the monitoring scenario can be modified. Finally, this table indicates if additional configuration is necessary in order to use the monitoring scenario. Detailed instructions for each of these monitoring scenarios are included later in this guide.

Table 6 Configurable Monitoring Scenarios

Scenario

Configurable Elements

Configuration Required

Disk Free Space Monitoring

Modify the threshold values that are used to trigger both warning and error events.

No

Performance Thresholds

Modify the thresholds for performance alerting. Enable rules that are disabled by default and modify thresholds for these rules.

No

Modifying Script Parameters

Many of the monitoring scenarios are configured by changing parameters of scripts that are associated with an event rule. It is necessary to change the script parameter within the event rule rather than changing the script parameter within the equivalent script that is listed under the Scripts node in the MOM Administrator console. Changing a parameter of a script within the Scripts node does not change the value of the parameter for event rules that are associated with the script.

Committing Configuration Changes

After making configuration changes to the Management Pack, you can deploy the changes to managed computers immediately by committing the configuration changes manually. Otherwise, changes are deployed to managed computers after the rule change polling interval (five minutes by default) and the agent configuration interval (one minute by default).

To commit configuration changes

  1. In the MOM Administrator console, navigate to Management Packs.

  2. Right-click Management Packs, and click Commit Configuration Change.

Disk Free Space Monitoring

The Microsoft Windows Servers Base Operating System Management Pack monitors the disk space of all disk drives within managed computers. Thresholds can be defined for both system drives and non-system drives. The values that are set for non-system drives and system drives are used to determine the green, yellow, and red states for state monitoring of disk free space.

Configuration

Ensure that the following event rule is enabled for each version of Windows: \State Monitoring and Service Discovery\Event Rules\Run Storage State Monitoring. This event rule is enabled by default.

Customization

You can modify the threshold values that the event rule uses to trigger warning and error events. The following table lists the default threshold values for both warning and error events. For non-system and system drives, warning and error events are generated when both threshold values are met.

Table 7 Default Disk Space Threshold Values

Drive

Warning Threshold

Error Threshold

All volumes

N/A

100 MB

Non-system drives

500 MB and 10% or less free space

250 MB and 5% or less free space

System drives

500 MB and 10% or less free space

250 MB and 5% or less free space

To customize disk space monitoring thresholds

  1. In the MOM Administrator console, navigate to the Run Storage State Monitoring event rule.

  2. Right-click the rule, click Properties, and then click the Response tab.

  3. In the Script parameters box, select the Microsoft Windows Storage State Monitoring script, and then click Edit.

  4. To modify a script parameter, select the parameter and click Edit Script Parameters.

  5. After modifying script responses, click OK, click OK again, and then click Apply.

  6. After modifying the script responses, commit the configuration changes to apply the changes to agent computers.

Performance Thresholds

The Microsoft Windows Servers Base Operating System Management Pack alerts on performance thresholds. You should evaluate these thresholds and determine if the default values for these thresholds are appropriate for your environment. The following table lists the default performance thresholds.

Table 8 Default Performance Thresholds

Counter

Threshold

Default State

Notes

Memory\Pages/sec.

Greater than 50 for 15 minutes (3 samples)

Disabled

Before enabling this rule, create a baseline Pages/sec performance signature for each system. After you have created a baseline, set a default threshold that works for the largest percentage of managed computers. Configure overrides to define thresholds for exceptions cases.

The threshold value is configured on the Alert tab of the rule properties (Under Alert severity, click Edit).

PhysicalDisk\Avg. Disk sec./Read

Greater than 50 for any single sample

Enabled

The threshold value is configured on the Threshold tab of the rule properties.

PhysicalDisk\Avg. Disk sec./Write

Greater than 50 for any single sample

Enabled

The threshold value is configured on the Threshold tab of the rule properties.

Memory\Available Megabytes

Less than 10 MB (10000000 bytes) for 15 minutes (3 samples).

The threshold value is measured in bytes. To calculate the value for megabytes, multiple the byte value by 0.000001.

Enabled

The threshold value is configured on BOTH the Alerts tab of the rule properties (Under Alert severity, click Edit.) and the Responses tab of the rule properties within the Microsoft Windows Base OS Exclude Exchange From Available Megabyte script. Modify the value in both locations.

Memory\% Committed Bytes

Greater than 80% for 15 minutes (3 samples)

Enabled

The threshold value is configured on the Alert tab of the rule properties (Under Alert severity, click Edit).

Processor\% DPC Time

Greater than 15%

Disabled

The threshold value is configured on the Alert tab of the rule properties (Under Alert severity, click Edit).

Processor\% Interrupt Time

Greater than 10

Enabled

The threshold value is configured on the Alert tab of the rule properties (Under Alert severity, click Edit.).

Processor\%Processor Time

For a 25 minute period of time (5 samples), % Processor Time is greater than 95% and the Processor Queue Length is greater than 15.

Enabled

The threshold value is configured on the Responses tab of the rule properties through the Microsoft Windows Base OS CPU Overload script.

There are two recommended options for adjusting threshold values:

  • Create an override for a performance threshold rule and assign one or more override criteria. You can create overrides for values that are set on either the Threshold tab or the Alerts tab. The process for creating an override is different, depending on which tab is used. Each override criteria applies the value that you specify to a computer or computer group that you choose. When you export the Management Pack, the override name is retained; however, you need to reset the override criteria when you import the Management Pack.

  • Modify the threshold value in the threshold rule. If you use this method, the changes you make to the threshold values are exported with the Management Pack. You do not need to reset these values after importing the Management Pack.

Adjust the threshold in the corresponding rule for each version of Windows that is supported by the Management Pack. Rules must be enabled before you can create an override.

To modify performance thresholds by creating rule overrides from the Threshold tab

  1. In the MOM Administrator console, navigate to the following location: Microsoft Windows Servers Base Operating System\< Windows Version >\State Monitoring and Service Discovery\Performance Rules.

  2. Right-click the desired rule, and then click Properties.

  3. On the Threshold tab, select the Enable threshold overrides for this rule check box.

  4. Modify the override name, if desired.

  5. Click Set Criteria.

  6. In the Set Override Criteria dialog box, click Add and complete the following three steps:

    1. Specify a target computer or computer group.

    2. Type the value that you want to apply to the threshold override.

    3. Click OK.

  7. Repeat the previous step for each override criteria that you want to create for the threshold rule.

  8. Click OK, and then click Apply.

To modify performance thresholds by creating rule overrides from the Alerts tab

  1. In the MOM Administrator console, navigate to the following location: Microsoft Windows Servers Base Operating System\ <Windows Version>\ State Monitoring and Service Discovery\Performance Rules.

  2. Right-click the desired rule, and then click Properties.

  3. Click the Alerts tab.

  4. Under Alert severity click Edit.

  5. In the Edit Alert Severity Condition dialog box, select the default value to override, and click Edit. Select only the value, such as "10". Do not select the entire threshold string.

  6. Click Override.

  7. In the Insert Override dialog box, modify the override name, if desired.

  8. In the Default Value box, type the default value (not the override value). For example, type "10". Do not type the entire threshold string.

  9. Click OK.

  10. In the Edit Alert Severity Condition dialog box, click Show Overrides.

  11. Select the override you just created, and click Set Criteria.

  12. In the Set Override Criteria dialog box, click Add.

  13. In the Set Override Criteria dialog box, click Add, and complete the following three steps:

    1. Specify a target computer or computer group.

    2. Type the value that you want to apply to the threshold override.

    3. Click OK.

  14. Repeat the previous step for each override criteria that you want to create for the threshold rule.

  15. Click OK.

  16. When you return to the property page for the rule, click Apply.

To modify performance thresholds by adjusting the threshold value

  1. In the MOM Administrator console, navigate to the following location: Microsoft Windows Servers Base Operating System\< Windows Version >\State Monitoring and Service Discovery\Performance Rules.

  2. Right-click the desired rule, and then click Properties.

  3. On the Threshold tab, change the threshold criteria.

  4. Click Apply.