Windows Server 2012 default Core Parking behavior changes

Since the Microsoft default behavior change for Core Parking is designed to maximize CPU performance, there is no built in method to re-enable core parking once it is disabled, as doing so can introduce degradation in CPU performance.

Due to the potential for performance degradation, modification of the default behavior of Windows Core Parking in Windows Server 2012 is not recommended nor supported. It was not designed/intended for OEMs to change the configuration in the current implementation of core parking in Windows Server 2012.

Currently by default, Windows Server 2012 disables core parking for Intel based processors to maximize energy efficiency and CPU performance.

How Core Parking works: 
=======================
Windows Core parking for Windows Server 2012 works by Parking and unparking of cores as needed to adjust to changing workloads for efficiency reasons. Parking a core, by itself, does not save power. Parking a core alters the behavior of the scheduler to target threads at other cores. This allows the parked core to stay idle more (decreasing its power consumption), at the cost of placing additional work on unparked cores (increasing their power consumption). Whether or not this tradeoff results in a more or less efficient system is highly dependent on the processor. Windows is tuned to select optimal settings (core parking on or off) depending on which processor is installed and for Windows Server 2012 is considered the most efficient.

SCOM 2012,Unable to open SCOM console,gives error and getting event id : 26319 logged with evaluation errors expired.

Symptom
=====

Customer tries to license the SCOM server 2012 SP1 Update-Rollup 2 via Powershell set-scomlicense and this commandlet is hanging.

Cause
======

User was running the commandlet under domain administrator privileged.

But the set-scomlicense requires write access also to the OpsManager DB.

Resolution
========

User switched to an account with OpsManager DB rights that has aslo local admin rights on the scom server. 

SCOM - Data warehouse event data writer process failed to perform maintenance operation

Problem

========

Event data collection process unable to write data to the Data Warehouse.
Failed to store data in the Data Warehouse.
Exception 'SqlException': Timeout expired. The timeout period elapsed prior to completion of the operation or the server is not responding.

Solution

========

1. Create This Registry on the RMS and each management servers: 

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Microsoft Operations Manager\3.0\Data Warehouse]

    "Command Timeout Seconds"=dword:00000384

This updates the DW processing timeout from 5 minutes to 15 minutes.

Note: This needs to be done on every Management Server (including the RMS).

2. Restart the System Center Management Service on the RMS and each management server

3. We can use the following process to fix the problem.

3.1Create an override to disable the maintenance procedure.

3.1.1.       In the OpsMgr console go to Authoring-> Rules-> Change Scope to “Standard Data Set” ;

3.1.2.       Right click the rule “Standard Data Warehouse Data Set maintenance rule” > Overrides > Override the Rule > For all objects of class: Standard Data Set;

3.1.3.       Check the check box next to Enabled and change the override value to “False”, and then apply the changes;

3.1.4.       This will disable dataset maintenance from running automatically.

3.2.       Restart the “System Center Management” service on RMS.  This is done to kill any maintenance already running, and ensure the override is applied immediately.

3.3.       Wait several minutes till all configuration is downloaded and then open SQL Server Management Studio to connect to the SQL server that hosts the Operations Manager Data Warehouse database.

3.4.       Run the following query against OperationsManagerDW.

USE OperationsManagerDW

     

DECLARE @DataSet UNIQUEIDENTIFIER

DECLARE myCursor CURSOR FOR

SELECT DISTINCT DatasetId FROM dbo.StandardDatasetAggregationHistory WHERE DirtyInd = 1

OPEN myCursor

FETCH NEXT FROM myCursor INTO @DataSet

WHILE @@FETCH_STATUS = 0

BEGIN

      WHILE(SELECT COUNT(*) FROM StandardDatasetAggregationHistory WHERE DirtyInd = 1 AND DatasetId = @DataSet) > 5

      BEGIN

            EXEC StandardDatasetMaintenance @DataSet

            WAITFOR DELAY '00:00:05'

      END

     

      FETCH NEXT FROM myCursor INTO @DataSet

END

CLOSE myCursor;

DEALLOCATE myCursor;

               

Note: This query may take several hours to complete.  This depends on how much data has been flooded to the warehouse.  Do NOT stop the query before completion. I suggest you arrange a non-business to run the above SQL query.

3.5.       Once the query finishes, delete the overrides configured in step 1.

WSUS for Windows Server 2012 - Unable to download updates Event 364. Content file download failed. Reason: value does not fall within the expected range

Please make sure the hotfix kb2838998 installed:

WSUS server can't connect to Windows Update in Windows Server 2012
http://support.microsoft.com/kb/2838998

If the hotfix has been already installed
Please run the following command on you WSUS server 
and run the synchronization again:

wsusutil reset

WSUSutil.exe is located 
%drive%\Program Files\Update Services\Tools folder on your WSUS server

Logon/Logoff Event ID 540 when not logged on

1. Backup the SCM.MOF file from the %WINDIR%\System32\wbem folder in case the settings have to be reverted.

 2. Review the following lines to the SCM.MOF file (will be at the bottom of the file..), and change as needed:
instance of NTEventLogEventConsumer
{
Name = "SCM Event Log Consumer";
SourceName = "Service Control Manager";
EventType = 1;
Category = 0;
NameOfUserSIDProperty = "sid";
CreatorSid = {1,1,0,0,0,0,0,5,18,0,0,0};
};
/////////////////////////////////////////////////////////////////////////////
// SCM Event Log filter
instance of __EventFilter
{
Name = "SCM Event Log Filter";
QueryLanguage = "WQL";
Query = "select * from MSFT_SCMEventLogEvent";
EventNamespace = "root\\cimv2";
CreatorSid = {1,1,0,0,0,0,0,5,18,0,0,0};
};
/////////////////////////////////////////////////////////////////////////////
// SCM Event Log filter-to-consumer binding
instance of __FilterToConsumerBinding
{
Consumer = "NTEventLogEventConsumer.Name=\"SCM Event Log Consumer\"";
Filter = "__EventFilter.Name=\"SCM Event Log Filter\"";
CreatorSid = {1,1,0,0,0,0,0,5,18,0,0,0};
};

 3. Save the file as SCM.MOF after making the changes.

 4. Open a command prompt and navigate to the %WINDIR%\System32\wbem folder.

 5. Execute the following command in a system command prompt:
mofcomp.exe scm.mof
Note To open a system command prompt, use the following command:
at <time> /interactive cmd.exe
Note The <time> placeholder represents the time for when the command will run.

 6. Restart the computer.

Missing large amounts of free disk space

Symptom

========
Went to the tools --> folder options--> checked hidden folders ---> unchecked hide all the OS folders.

On the drive there was a folder "System volume information".

Cause
=======

From the following “dir” log file, I understand that some GUID “{3808876b-c176-4e48-b7ae-04046e6cc752}” files have been generated in the folder “System Volume Information” and occupying more disk space.

Solution

==========
Went to the tools --> folder options--> checked hidden folders ---> unchecked hide all the OS folders.

On the drive there was a folder "System volume information".

Check the permission on System Volume Information folder. Permissions should be as follows:

Administrators : Full Control

Create Owner: Special Permission

System: Full Control

Delete the shadow copies on a computer using the below command:vssadmin delete shadows /all 

Operation Manager Audit Collection Service fail to start -->Error 0X8009030D :The credentials supplied to the package were not recognized

Error 0X8009030D :The credentials supplied to the package were not recognized

Solution

=========
a.    Open the command line.
b.    Go to C:\Windows\system32\security\adtserver folder.
c.    Run “adtserver.exe -c”,
       and choose the certificate issued to the FQDN name for the ACS collector.
d.    Start the Operation Manager Audit Collection Service.

Kernel memory dump files may not be generated on Windows Server 2008-based or Windows Vista Service Pack 1 (SP1)-based computers.

Kernel memory dump files may not be generated on Windows Server 2008-based or Windows Vista Service Pack 1 (SP1)-based computers.

You may also notice the following event is logged in the System event log: 

Event ID: 49
Event Type: Error
Event Source: volmgr
Description: Configuring the Page file for crash dump failed. Make sure there is a page file on the boot partition and that is large enough to contain all physical memory. 

Solution

============

1.  Click Start , type regedit in the Start Search box, and then click regedit in the Programs list.

     If you are prompted for an administrator password or for confirmation, type your password,
     or click Continue . 

2.  Locate and then click the following registry subkey:

     HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\CrashControl 

3.  On the Edit menu, point to New , and then click DWORD Value . 

4.  Type IgnorePagefileSize , and then press ENTER. 

5.  Right-click IgnorePagefileSize , and then click Modify . 

6.  In the Value data box, type 1 , and then click OK . 

7.  Exit Registry Editor. 

8.  Reboot the system for the change to take effect.

SCOM - Created a sample MP to create the performance data based on WMI Query

1. Create a Probe-Based (script) performance collection rule & Set Target as “Windows Computer”

2. Select Management Pack and Set the Rule Name.

3. Set the Schedule

4. Type the Name and extension of the script, such as DiskSizeCollectionScript.vbs, timeout value and copy the below script.

5. Set Timeout to the length of time in seconds, minutes, hours, or days, the script can run before it is terminated.

6. On the Performance Mapper page, map parameters from the script to fields [Parameters are case sensitive]

• Object : Disk_Name

• Counter : Disk_Size

• Instance : $Data/Property[@Name='drive']$

• Value : $Data/Property[@Name='diskSize']$

7. Click Ok and create

Reference Link
http://technet.microsoft.com/en-us/library/bb381406(TechNet.10).aspx

'======================Script ================

Dim oAPI, oBag , oArgs , objShell,disksizeGB

' Set SCOM parameters

Set oAPI = CreateObject("MOM.ScriptAPI")

Set oArgs = WScript.Arguments

Set objShell = Wscript.CreateObject("Wscript.Shell")

strComputer = "."

Set objWMIService = GetObject("winmgmts:" & "{impersonationLevel=impersonate}!\\" & strComputer & "\root\cimv2")

Set colVolume = objWMIService.ExecQuery("Select * from Win32_Volume")

For each objVolume in colVolume

disksizeGB=round(objVolume.Capacity/1024/1024/1024,0)

Set oBag = oAPI.CreatePropertyBag()

Call oBag.AddValue ("DiskName", objVolume.Caption)

Call oBag.AddValue ("DiskSize", diskSizeGB)

Call oAPI.Return(oBag) 

Next

'======================End======================

SCOM -- Deleting a computer manually from the SCOM Database (Delete Agent on SCOM Console)

The customer find there are some machines which has been deleted on “agent managed”, but it still exist in the ‘monitoring’

Workaround:

==========
We can set the field of these 2 machine in database to IsDeleted directly. But, please notice that it is a non-supported way. So, before you apply it, please ask for customer do a decision on apply it or not. If the customer want to apply it, they should take risk themselves.

Pre-Check:

1.    Get the TopLevelHostEntityId for the problematic machine.

Steps:

We can run the SQL command line below:

Use OperationsManager

select * from MT_Computer, BaseManagedEntity

where MT_Computer.basemanagedEntityId = BaseManagedEntity.BaseManagedEntityId

and BaseManagedEntity.Name = '<computer name>'

              

 The <computer name> should be replaced by the FQDN name of the agent.

NOTE:

Here will return the TopLevelHostEntityId
         which we will use in the following actions.

         

    

2.    Query for TopLevelHostEntityId  get above and check the IsDeleted column from each row return.

Steps:

Run the SQL command below:

Use OperationsManager

Select fullname, ismanaged, isdeleted from BaseManagedEntity where TopLevelHostEntityId = '<TopLevelHostEntityId get above>'

The < TopLevelHostEntityId get above> should be replaced by the TopLevelHostEntityId of Agent

Set to IsDeleted directly in database:

WARNING: The workaround need modify the data in database directly, it is a non-supported way and may has some potential risk in the future. So, please take the risk yourself. Otherwise, please do NOT apply the action below.

3.    If you find that the isdeleted column are not consistant or you want to force remove this computer. You can run the SQL query below:

Use OperationsManager

Update BaseManagedEntity Set Isdeleted=1 where TopLevelHostEntityId = '<TopLevelHostEntityId get above>'

               

After the customer do the work around, the issue is resolved now.

SCOM - Large Table query

SELECT TOP 1000
a2.name AS [tablename], (a1.reserved + ISNULL(a4.reserved,0))* 8 AS reserved,
a1.rows as row_count, a1.data * 8 AS data,
(CASE WHEN (a1.used + ISNULL(a4.used,0)) > a1.data THEN (a1.used + ISNULL(a4.used,0)) - a1.data ELSE 0 END) * 8 AS index_size,
(CASE WHEN (a1.reserved + ISNULL(a4.reserved,0)) > a1.used THEN (a1.reserved + ISNULL(a4.reserved,0)) - a1.used ELSE 0 END) * 8 AS unused,
(row_number() over(order by (a1.reserved + ISNULL(a4.reserved,0)) desc))%2 as l1,
a3.name AS [schemaname]
FROM (SELECT ps.object_id, SUM (CASE WHEN (ps.index_id < 2) THEN row_count ELSE 0 END) AS [rows],
SUM (ps.reserved_page_count) AS reserved,
SUM (CASE WHEN (ps.index_id < 2) THEN (ps.in_row_data_page_count + ps.lob_used_page_count + ps.row_overflow_used_page_count)
ELSE (ps.lob_used_page_count + ps.row_overflow_used_page_count) END ) AS data,
SUM (ps.used_page_count) AS used
FROM sys.dm_db_partition_stats ps
GROUP BY ps.object_id) AS a1
LEFT OUTER JOIN (SELECT it.parent_id,
SUM(ps.reserved_page_count) AS reserved,
SUM(ps.used_page_count) AS used
FROM sys.dm_db_partition_stats ps
INNER JOIN sys.internal_tables it ON (it.object_id = ps.object_id)
WHERE it.internal_type IN (202,204)
GROUP BY it.parent_id) AS a4 ON (a4.parent_id = a1.object_id)
INNER JOIN sys.all_objects a2  ON ( a1.object_id = a2.object_id )
INNER JOIN sys.schemas a3 ON (a2.schema_id = a3.schema_id)
WHERE a2.type <> N'S' and a2.type <> N'IT'