Modeling your infrastructure with SCOM Ondřej Ševeček GOPAS a.s. MCM: Directory Services MVP: Enterprise Security CHFI CEH CISA ondrej@sevecek.com www.sevecek.com
Agenda Brief SCOM recap Management packs hierarchy and dependencies VSAE and Management Pack Browser vs. XML Core management pack classes Inheritance, discoveries, monitors, rules Detailed investigation of DNS management pack GOC170 - Management Pack authoring
SCOM management server Microsoft Monitoring Agent works as agent on the MS TCP 5723 listening for client communications performs modules running on MS several instances of MonitoringHost.exe for running anything System Center Data Access Server TCP 5724 listening for console/powershell/msagent communication accesses databases directly System Center Management Configuration performs some MS management functions against database directly accesses databases directly
SCOM agent Microsoft Monitoring Agent HealthService Operations Manager event log 1210 - new configuration became active 1201 - new MP downloaded TCP 5723 to MS agent permanent TCP connection heartbeat every several seconds notifications from MS agent about new configuration irrespective of heartbeat Agent proxy can create hosted objects on other computers
Management pack XML configuration plus scripts.xml,.mp file or.mpb bundle file Sealed (digitally signed) or un-sealed and modifiable different MP cannot target/reference objects from an unsealed MP cannot define classes Strict versioning can update any management pack with newer version dependent MPs should work cannot remove MP which other MPs depend on Downloaded to clients %programfiles%\microsoft Monitoring Agent\Agent\Health Service State\Management Packs
Management pack dependencies Microsoft..Server.DNS Microsoft Server DNS Monitoring Microsoft..Library Core Library
Management pack dependencies Microsoft..Server.AD.2008.Discovery Active Directory Server 2008 and above Discovery Microsoft..Server.AD.2003.Discovery Active Directory Server 2003 Discovery Microsoft..Server.AD.2000.Discovery Active Directory Server 2000 Discovery Microsoft..Server.AD.Library Active Directory Server Common Library Microsoft..Server.DNS Microsoft Server DNS Monitoring Microsoft..Library Core Library
Management pack dependencies Microsoft..Server.AD.2008.Monitoring Active Directory Server 2008 and above Monitoring Microsoft..Server.AD.2008.Discovery Active Directory Server 2008 and above Discovery Microsoft..Server.AD.2003.Discovery Active Directory Server 2003 Discovery Microsoft..Server.AD.2000.Discovery Active Directory Server 2000 Discovery Microsoft..Server.AD.Library Active Directory Server Common Library Microsoft..Server.DNS Microsoft Server DNS Monitoring Microsoft..Library Core Library
Management pack dependencies Sevecek.Overrides Microsoft..Server.AD.2008.Monitoring Active Directory Server 2008 and above Monitoring Microsoft..Server.AD.2008.Discovery Active Directory Server 2008 and above Discovery Microsoft..Server.AD.2003.Discovery Active Directory Server 2003 Discovery Microsoft..Server.AD.2000.Discovery Active Directory Server 2000 Discovery Microsoft..Server.AD.Library Active Directory Server Common Library Microsoft..Server.DNS Microsoft Server DNS Monitoring Microsoft..Library Core Library
Better to separate overriding MPs Sevecek.Overrides AD Microsoft..Server.AD.2008.Monitoring Active Directory Server 2008 and above Monitoring Sevecek.Overrides DNS Microsoft..Server.AD.2008.Discovery Active Directory Server 2008 and above Discovery Microsoft..Server.AD.2003.Discovery Active Directory Server 2003 Discovery Microsoft..Server.AD.2000.Discovery Active Directory Server 2000 Discovery Microsoft..Server.AD.Library Active Directory Server Common Library Microsoft..Server.DNS Microsoft Server DNS Monitoring Microsoft..Library Core Library
Management pack elements Disco base/abstract class inherited object class object class Object Object instance object instance instance Object instance Object instance Object instance object instance object class monitor monitor monitor monitor singleton monitor monitor monitor monitormonitor monitor monitor monitor monitor rule rule
Concept of targeting Disco Agent object class Object instance Object instance Object instance object instance Disco Disco object class Object instance Object object instance class monitor monitor rule rule Disco Disco Object instance Object instance object class object class Object Object instance Object instance Object instance instance
Management pack dependencies @IsRODC ReadOnlyDC.Computer Microsoft..Server.AD.2008.Discovery Active Directory Server 2008 and above Discovery DFSR Microsoft..Server.AD.2003.Discovery Active Directory Server 2003 Discovery Microsoft..Server.AD.2000.Discovery Active Directory Server 2000 Discovery Domain Forest Site SiteLink Microsoft..Server.AD.Library Active Directory Server Common Library DomainControllerRole Microsoft..Library Core Library
Management pack dependencies @IsRODC ReadOnlyDC.Computer Microsoft..Server. AD.2008.Monitoring Active Directory Server 2008 and above Monitoring Microsoft..Server.AD.2008.Discovery Active Directory Server 2008 and above Discovery DFSR Microsoft..Server.AD.2003.Discovery Active Directory Server 2003 Discovery Microsoft..Server.AD.2000.Discovery Active Directory Server 2000 Discovery Domain Forest Site SiteLink Microsoft..Server.AD.Library Active Directory Server Common Library DomainControllerRole Microsoft..Library Core Library
Sample environment mutual forest non-selective gopas.virtual (GPS) SCOM 2012 R2 sevecek.com (SEVECEK)
Sample environment 10.10.0.1 inet <any> RR 2003 <any> gopas.cz 10.10.0.11 10.10.0.12 DC1 2012 R2 DC2 2008 R2 gopas.virtual _msdcs.gopas.virtual gopas.cz 10.10.0.13 SEVECEK-DC 2012 R2 Client81 8.1 sevecek.com
Sample environment <any> RR 2003 <any> gopas.cz DC1 2012 R2 DC2 2008 R2 gopas.virtual gopas.virtual sevecek.com _msdcs.gopas.virtual Client81 8.1 gopas.cz sevecek.com SEVECEK-DC 2012 R2 sevecek.com
Sample environment <any> RR 2003 <any> gopas.cz DC1 2012 R2 DC2 2008 R2 gopas.virtual gopas.virtual _msdcs.gopas.virtual gopas.virtual _msdcs.gopas.virtual sevecek.com gopas.cz gopas.cz SEVECEK-DC 2012 R2 Client81 8.1 sevecek.com sevecek.com
System... in SCOM 2012 R2 System.Software.Library System Software Library System.AdminItem.Library System Administration Item Library System.Health.Library Health Library System.Library System Library
System... in SCOM 2012 R2 System.Snmp.Library SNMP Library System.ApplicationLog.Library System Application Log Library System.Software.Library System Software Library System.AdminItem.Library System Administration Item Library System.Health.Library Health Library System.Library System Library
System... in SCOM 2012 R2 System.Performance.Library Performance Library System.Snmp.Library SNMP Library System.ApplicationLog.Library System Application Log Library System.Software.Library System Software Library System.AdminItem.Library System Administration Item Library System.Health.Library Health Library System.Library System Library
System... in SCOM 2012 R2 Microsof..Library Core Library System.Performance.Library Performance Library System.Snmp.Library SNMP Library System.ApplicationLog.Library System Application Log Library System.Software.Library System Software Library System.AdminItem.Library System Administration Item Library System.Health.Library Health Library System.Library System Library
Microsoft.SystemCenter.Library System Center Core Library Microsof..Library Core Library System.Performance.Library Performance Library System.Snmp.Library SNMP Library System.ApplicationLog.Library System Application Log Library System.Software.Library System Software Library System.AdminItem.Library System Administration Item Library System.Health.Library Health Library System.Library System Library
Microsoft.SystemCenter.Library System Center Core Library Microsof..Library Core Library System.Performance.Library Performance Library System.Snmp.Library SNMP Library System.ApplicationLog.Library System Application Log Library System.Software.Library System Software Library System.AdminItem.Library System Administration Item Library System.Health.Library Health Library System.Library System Library
Microsoft.SystemCenter.DataWarehouse.Library Data Warehouse Library Microsoft.SystemCenter.InstanceGroup.Library Instance Group Library Microsoft.SystemCenter.Library System Center Core Library Microsof..Library Core Library System.Performance.Library Performance Library System.Health.Library Health Library Microsoft..Server.DNS.Optional.Enabl e..2003.2008.2008r2.discovery Microsoft Server DNS Optional Enable 2003 2008 2008R2 Discovery Microsoft..Server.DNS Microsoft Server DNS Monitoring Microsoft..Server.DNS.Optional.Enabl e.event.collection Microsoft Server DNS Optional Enable Event Collection System.Library System Library Microsoft..Server.DNS.Optional.Enabl e.performance.collection Microsoft Server DNS Optional Enable Performance Collection
Computer relatives Microsoft..Server.DC.Computer Domain Controller Microsoft..Server.Computer Server discovered where applicable discovered where applicable discovered everywhere Microsoft..Computer Computer System.Computer Computer System.Device Microsoft..Client.Computer Client discovered where applicable
Operating System relatives no instance discovered Microsoft..Server.OperatingSystem Server Operating System Microsoft..OperatingSystem Operating System System.OperatingSystem Operating System System.LocalEntity Microsoft..Client.OperatingSystem Client Operating System no instance discovered
Computer hosts Operating System Microsoft..Server.DC.Computer Domain Controller Microsoft..Server.Computer Server Microsoft..Computer Computer System.Computer Computer Microsoft..OperatingSystem Operating System System.OperatingSystem Operating System System.LocalEntity System.Device Microsoft..Client.Computer Client
Health Service relatives discovered everywhere Microsoft.SystemCenter.Agent.ManagementServer Management Server Agent Microsoft.SystemCenter.Agent Agent Microsoft.SystemCenter.HealthService Health Service Microsoft..LocalApplication discovered where applicable discovered where applicable
Computer Microsoft.SystemCenter.Agent.ManagementServer Management Server Agent Microsoft.SystemCenter.Agent Agent Microsoft..Server.DNS.Server DNS Server Microsoft.SystemCenter.HealthService Health Service Microsoft..OperatingSystem Operating System Microsoft..Computer Computer
Server Computer Group contains Computer Microsoft..Server.ComputerGroup Server Computer Group Microsoft.SystemCenter.ComputerGroup Computer Group Microsoft..Server.DC.Computer Domain Controller Microsoft..Server.Computer Server Microsoft..Computer Computer System.Computer Computer Microsoft..Client.Computer Client
DNS relationships Microsoft..Server.DNS.Forwarder.IPAddress Microsoft..Server.DNS.Forwarder.IPAddress Microsoft..Server.DNS.Forwarder.IPAddress Microsoft..Server.DNS.Forwarder.IPAddress DNS Forwarder IP Address Microsoft..Server.DNS.Forwarder.IPAddress Microsoft..Server.DNS.Forwarder.IPAddress DNS Forwarder IP Address DNS Forwarder IP Address Microsoft..Server.DNS. Microsoft..Server.DNS. Microsoft..Server.DNS. DNS DNS Microsoft..Server.DNS.Forwarder Microsoft..Server.DNS.Forwarder DNS Forwarder Microsoft..Server.DNS.Server DNS Server Microsoft..Computer Computer
DNS relationships Microsoft..Server.DNS.Forwarder.IPAddress. Unconditional / Conditional.Forward / Conditional.Reverse DNS Forwarder IP Address Unconditional / Conditional Forward / Conditional Reverse Microsoft..Server.DNS.Forwarder.IPAddress DNS Forwarder IP Address Microsoft..Server.DNS.Forwarder.IPAddress Microsoft..Server.DNS.Forwarder.IPAddress Microsoft..Server.DNS.Forwarder.IPAddress DNS Forwarder IP Address Microsoft..Server.DNS. Microsoft..Server.DNS. Microsoft..Server.DNS. DNS DNS Microsoft..Server.DNS.Forwarder Microsoft..Server.DNS.Forwarder DNS Forwarder Microsoft..Server.DNS.Server DNS Server Microsoft..Computer Computer
DNS relationships Microsoft..Server.DNSDomain DNS Domain Forwarder IP Address Forwarder IP Address Forwarder IP Address containment DNS DNS DNS DNS DNS DNS DNS Forwarder DNS Server containment DNS Server Microsoft..Server.DNS.Server.2008R2.Group DNS 2008 R2 Servers Computer Computer
Unit monitors DNS Domain Forwarder IP Address Forwarder IP Address Forwarder IP Address containment DNS DNS DNS DNS DNS DNS DNS Forwarder DNS Server DNS Server Computer Computer
Rollup monitors DNS Domain Forwarder IP Address Forwarder IP Address Forwarder IP Address containment DNS DNS DNS DNS DNS DNS DNS Forwarder DNS Server DNS Server Computer Computer
Deeper rollup monitors DNS Domain Forwarder IP Address Forwarder IP Address Forwarder IP Address containment DNS DNS DNS DNS DNS DNS DNS Forwarder DNS Server DNS Server Computer Computer
Deeper rollup monitors DNS Domain Forwarder IP Address Forwarder IP Address Forwarder IP Address containment DNS DNS DNS DNS DNS DNS DNS Forwarder DNS Server DNS Server Computer Computer
Děkuji za pozornost! GOC170 - Management Pack authoring Ondřej Ševeček GOPAS a.s. MCM: Directory Services MVP: Enterprise Security CHFI CEH CISA ondrej@sevecek.com www.sevecek.com