SCOM (Microsoft System Center Operations Manager)

Microsoft System Center Operations Manager (SCOM) is a cross-platform data center management system for operating systems and hypervisors. Install this integration to correlate SCOM alerts into high-level incidents in BigPanda for better visibility and quicker remediation of production issues.

Supported Versions:
System Center 2012 R2 and 2016

Type:
Custom Script

Key Features

  • Automatically configures SCOM to send alerts to BigPanda.

  • Allows you to include custom fields in alerts.

  • Provides the SCOM Integration utility for streamlined installation and robust debugging options.

  • Supports SCOM installations that use an HTTP proxy server.

How It Works

The integration works by subscribing BigPanda to all alert notifications. When you install the integration, the SCOM Integration utility automatically installs the BigPanda command executable file and creates a command channel, a subscriber, and a subscription in SCOM. When a SCOM alert is generated, the information is forwarded to BigPanda by using these elements:

  • The command notification channel defines what information is sent to BigPanda. By default, all standard SCOM fields are sent to BigPanda, and you can add custom fields. It also determines that the notification is sent by running the BigPanda command executable file.

  • The notification subscriber defines the BigPanda channel as the recipient and determines the schedule for sending notifications. You can customize the notifications schedule.

  • The notification subscription defines the criteria for sending a notification. By default, all alerts are send to BigPanda, and you can filter which alerts are sent and set an initial delay. It also defines that the BigPanda channel is used to send the notification and the BigPanda subscriber receives the notification.

BigPanda then processes and correlates the alert from SCOM to create and maintain up-to-date incidents in BigPanda.

When Alerts are Updated and Closed

The life cycle of a SCOM alert in BigPanda reflects the notifications that SCOM sends.

  • Alerts are not updated—SCOM sends an alert when an error first occurs; it does not send updates when the error criteria change. Therefore, the error criteria in BigPanda remain in the initial state for the entire life cycle of the alert. Additionally, if SCOM is configured for auto-remediation, the remediation updates are not sent to BigPanda.

  • Alerts cannot transition from warning to critical—If a check in SCOM transitions from a warning to a critical state, SCOM closes the warning and sends a new, critical alert with a unique identifier. Therefore the initial warning alert is closed and a new critical alert is opened in BigPanda. This behavior does not affect alert correlation; however, the check is counted as two different alerts in BigPanda.

  • Some alerts are not closed automatically—For alerts from monitors, SCOM sends an update when the error is resolved, and the alert is automatically closed in BigPanda. For alerts from rules, SCOM does not send a resolution event so the related alert in BigPanda remains open. You must manually resolve BigPanda incidents that contain SCOM alerts from rules.

Acknowledged Alerts

When an alert is acknowledged in SCOM, it is marked as Acknowledged in BigPanda.

Installing The Integration

Administrators can install the integration by following the on-screen instructions in BigPanda. For more information, see Installing an Integration.

SCOM Data Model

BigPanda normalizes alert data from Microsoft Systems Center Operations Manager (SCOM). You can use tag values to filter the incident feed and to define filter conditions for Environments. The primary and secondary properties are also used during the correlation process.

Standard Tags

Tag
Description
Attributes

alert_source

Monitored object that generated the alert.

alert_name

Name of the alert in SCOM.

Second Property.

alert_description

Description of the alert in SCOM.

alert_severity

Level of the alert (OK, Warning, `Critical')

alert_priority

Importance of the alert.

alert_category

Operational category of the alert.

alert_resolution_state

Monitor state that automatically resolves the alert.

alert_owner

User who is listed in SCOM as investigating the alert.

alert_resolved_by

User who resolved the alert in SCOM, if applicable.

alert_last_modified_by

User who changed the alert in SCOM most recently, if applicable.

alert_id

Identifier for the alert in SCOM.

alert_last_modified_time

Time of the last update to the alert properties.

alert_raised_team

Time when the alert was first opened.

alert_resolution_time

Time when the monitor state returned to the resolution state, if applicable.

Custom Tags

You can independently configure the integration to send custom SCOM fields to BigPanda. These fields become custom tags in BigPanda are are available along with the standard tag data to help users resolve problems.

To send custom fields to BigPanda:

  1. In SCOM, open the Operations console, and then click Administration. You must have the Operations Manager Administrators role in SCOM.
  2. In the navigation pane, go to Notifications > Channels.
  3. Open the BigPanda channel and click the Settings tab.
  1. In the Command line parameters field, add the custom fields in one of the following ways.
    • Enter the field names manually. For example, CustomField1=domain_name.
    • Click the arrow beside and select the custom field you want to send.

Customizing SCOM

You can customize the notifications schedule for sending SCOM alerts to BigPanda. You can also filter which alerts are sent and set an initial delay for sending alerts. For information on how to send custom fields to BigPanda, see SCOM Data Model.

Prerequisites

Operations Manager Administrators Role In SCOM.

Changing the Notifications Schedule

  1. In SCOM, open the Operations console, and then click Administration.
  2. In the navigation pane, go to Notifications > Subscribers.
  3. Open the BigPanda subscriber and click the Schedule tab.
  4. Configure the desired schedule settings.
    For more information, see Microsoft TechNet - How to Create Notification Subscribers. By default, the BigPanda integration always sends notifications.

Filtering and Setting Delays on Alerts

  1. In SCOM, open the Operations console, and then click Administration.
  2. In the navigation pane, go to Notifications > Subscriptions.
  3. Open the BigPanda subscription.
  4. To filter alerts, click the Subscription Criteria tab and set conditions that determine when notifications are sent to BigPanda.
    For more information, see Microsoft TechNet - How to Create Notification Subscriptions. By default, the BigPanda integration sends notifications for all alerts.
  5. To set an initial delay for sending alerts to BigPanda, click the Channels tab and go to the Alert aging section to configure the desired delay.
    For more information, see Microsoft TechNet - How to Create Notification Subscriptions. By default, the BigPanda integration sends notifications without a delay.

Unistalling SCOM

To uninstall the Microsoft System Center Operations Manager (SCOM) integration, use the BigPanda SCOM Integration utility to remove the integration.

Prerequisites

  • Manually resolve any open incidents related to the integration to remove them from your incident feed. Optionally, remove any additional data in BigPanda. For example, modify or remove any Environments or AutoShare rules that reference the integration.
  • Obtain access to the server where SCOM is installed.
  • Determine the OS on the server.

Procedure

  1. Download the latest BigPanda SCOM Integration utility for your operating system.
    Windows 64-bit
  2. Extract the downloaded archive and open a PowerShell console with a command prompt in the extracted directory.
  3. Change the execution policy for the PowerShell console to RemoteSigned by running the following command.

    • Set-ExecutionPolicy remotesigned
  4. Run the following command.

    • ./bigpanda-scom-cli.exe uninstall
  5. At the prompt, enter y to confirm the change, and press Enter.

Post-Requisites

Delete the integration in BigPanda to remove the SCOM integration from your UI.

Debugging SCOM

Prerequisites

  • Ensure BigPanda SCOM integration and SCOM Integration utility are installed.

  • Obtain access to the server where SCOM is installed.

  • Open PowerShell console and change the execution policy to RemoteSigned by running the following command.

Set-ExecutionPolicy remotesigned

Checking the Version

To check the version of the SCOM Integration utility, run the following command.

./bigpanda-scom-cli.exe --version

If you don't have the latest version of the utility, download and install it.

Windows 64-bit

Viewing the SCOM Log File

The SCOM Integration utility writes a message to a log file every time an alert is sent from SCOM to BigPanda. This information can be very helpful when diagnosing a problem.

Access the log file in the same directory where you extracted the utility. The file name is: bigpanda-scom-cli.log

Changing the Logging Options

You can change logging options by using the following flags with your commands.

Flag
Description

-d
--debug

Writes log messages to the screen instead of the log file.

-v
--verbose

Writes detailed information to the log. Consider this level when you are actively diagnosing problems.

Example:

./bigpanda-scom-cli.exe test --debug -k <YOUR APP KEY> -t <YOUR TOKEN>

Sending a Test Alert

You can send a test alert from SCOM to BigPanda. Run the following command and replace <YOUR APP KEY> and <YOUR TOKEN> with the corresponding values in BigPanda.

./bigpanda-scom-cli.exe test -k <YOUR APP KEY> -t <YOUR TOKEN>

Using a Proxy Server

If you're using an HTTP Proxy server in your SCOM configuration, you can use the --proxy flag when installing the utility and sending a test alert. For example, run the following command and replace <Proxy server URL> with the full URL to your proxy server.

./bigpanda-scom-cli.exe test --proxy <Proxy server URL>

Post-Requisites

If you are unable to resolve the problem, contact BigPanda support for assistance.

SCOM (Microsoft System Center Operations Manager)


Microsoft System Center Operations Manager (SCOM) is a cross-platform data center management system for operating systems and hypervisors. Install this integration to correlate SCOM alerts into high-level incidents in BigPanda for better visibility and quicker remediation of production issues.

Suggested Edits are limited on API Reference Pages

You can only suggest edits to Markdown body content, but not to the API spec.