Logon/Logoff Event ID 540 when not logged on

1. Backup the SCM.MOF file from the %WINDIR%\System32\wbem folder in case the settings have to be reverted.

 2. Review the following lines to the SCM.MOF file (will be at the bottom of the file..), and change as needed:
instance of NTEventLogEventConsumer
{
Name = "SCM Event Log Consumer";
SourceName = "Service Control Manager";
EventType = 1;
Category = 0;
NameOfUserSIDProperty = "sid";
CreatorSid = {1,1,0,0,0,0,0,5,18,0,0,0};
};
/////////////////////////////////////////////////////////////////////////////
// SCM Event Log filter
instance of __EventFilter
{
Name = "SCM Event Log Filter";
QueryLanguage = "WQL";
Query = "select * from MSFT_SCMEventLogEvent";
EventNamespace = "root\\cimv2";
CreatorSid = {1,1,0,0,0,0,0,5,18,0,0,0};
};
/////////////////////////////////////////////////////////////////////////////
// SCM Event Log filter-to-consumer binding
instance of __FilterToConsumerBinding
{
Consumer = "NTEventLogEventConsumer.Name=\"SCM Event Log Consumer\"";
Filter = "__EventFilter.Name=\"SCM Event Log Filter\"";
CreatorSid = {1,1,0,0,0,0,0,5,18,0,0,0};
};

 3. Save the file as SCM.MOF after making the changes.

 4. Open a command prompt and navigate to the %WINDIR%\System32\wbem folder.

 5. Execute the following command in a system command prompt:
mofcomp.exe scm.mof
Note To open a system command prompt, use the following command:
at <time> /interactive cmd.exe
Note The <time> placeholder represents the time for when the command will run.

 6. Restart the computer.

Missing large amounts of free disk space

Symptom

========
Went to the tools --> folder options--> checked hidden folders ---> unchecked hide all the OS folders.

On the drive there was a folder "System volume information".

Cause
=======

From the following “dir” log file, I understand that some GUID “{3808876b-c176-4e48-b7ae-04046e6cc752}” files have been generated in the folder “System Volume Information” and occupying more disk space.

Solution

==========
Went to the tools --> folder options--> checked hidden folders ---> unchecked hide all the OS folders.

On the drive there was a folder "System volume information".

Check the permission on System Volume Information folder. Permissions should be as follows:

Administrators : Full Control

Create Owner: Special Permission

System: Full Control

Delete the shadow copies on a computer using the below command:vssadmin delete shadows /all 

Operation Manager Audit Collection Service fail to start -->Error 0X8009030D :The credentials supplied to the package were not recognized

Error 0X8009030D :The credentials supplied to the package were not recognized

Solution

=========
a.    Open the command line.
b.    Go to C:\Windows\system32\security\adtserver folder.
c.    Run “adtserver.exe -c”,
       and choose the certificate issued to the FQDN name for the ACS collector.
d.    Start the Operation Manager Audit Collection Service.

Kernel memory dump files may not be generated on Windows Server 2008-based or Windows Vista Service Pack 1 (SP1)-based computers.

Kernel memory dump files may not be generated on Windows Server 2008-based or Windows Vista Service Pack 1 (SP1)-based computers.

You may also notice the following event is logged in the System event log: 

Event ID: 49
Event Type: Error
Event Source: volmgr
Description: Configuring the Page file for crash dump failed. Make sure there is a page file on the boot partition and that is large enough to contain all physical memory. 

Solution

============

1.  Click Start , type regedit in the Start Search box, and then click regedit in the Programs list.

     If you are prompted for an administrator password or for confirmation, type your password,
     or click Continue . 

2.  Locate and then click the following registry subkey:

     HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\CrashControl 

3.  On the Edit menu, point to New , and then click DWORD Value . 

4.  Type IgnorePagefileSize , and then press ENTER. 

5.  Right-click IgnorePagefileSize , and then click Modify . 

6.  In the Value data box, type 1 , and then click OK . 

7.  Exit Registry Editor. 

8.  Reboot the system for the change to take effect.

SCOM - Created a sample MP to create the performance data based on WMI Query

1. Create a Probe-Based (script) performance collection rule & Set Target as “Windows Computer”

2. Select Management Pack and Set the Rule Name.

3. Set the Schedule

4. Type the Name and extension of the script, such as DiskSizeCollectionScript.vbs, timeout value and copy the below script.

5. Set Timeout to the length of time in seconds, minutes, hours, or days, the script can run before it is terminated.

6. On the Performance Mapper page, map parameters from the script to fields [Parameters are case sensitive]

• Object : Disk_Name

• Counter : Disk_Size

• Instance : $Data/Property[@Name='drive']$

• Value : $Data/Property[@Name='diskSize']$

7. Click Ok and create

Reference Link
http://technet.microsoft.com/en-us/library/bb381406(TechNet.10).aspx

'======================Script ================

Dim oAPI, oBag , oArgs , objShell,disksizeGB

' Set SCOM parameters

Set oAPI = CreateObject("MOM.ScriptAPI")

Set oArgs = WScript.Arguments

Set objShell = Wscript.CreateObject("Wscript.Shell")

strComputer = "."

Set objWMIService = GetObject("winmgmts:" & "{impersonationLevel=impersonate}!\\" & strComputer & "\root\cimv2")

Set colVolume = objWMIService.ExecQuery("Select * from Win32_Volume")

For each objVolume in colVolume

disksizeGB=round(objVolume.Capacity/1024/1024/1024,0)

Set oBag = oAPI.CreatePropertyBag()

Call oBag.AddValue ("DiskName", objVolume.Caption)

Call oBag.AddValue ("DiskSize", diskSizeGB)

Call oAPI.Return(oBag) 

Next

'======================End======================

SCOM -- Deleting a computer manually from the SCOM Database (Delete Agent on SCOM Console)

The customer find there are some machines which has been deleted on “agent managed”, but it still exist in the ‘monitoring’

Workaround:

==========
We can set the field of these 2 machine in database to IsDeleted directly. But, please notice that it is a non-supported way. So, before you apply it, please ask for customer do a decision on apply it or not. If the customer want to apply it, they should take risk themselves.

Pre-Check:

1.    Get the TopLevelHostEntityId for the problematic machine.

Steps:

We can run the SQL command line below:

Use OperationsManager

select * from MT_Computer, BaseManagedEntity

where MT_Computer.basemanagedEntityId = BaseManagedEntity.BaseManagedEntityId

and BaseManagedEntity.Name = '<computer name>'

              

 The <computer name> should be replaced by the FQDN name of the agent.

NOTE:

Here will return the TopLevelHostEntityId
         which we will use in the following actions.

         

    

2.    Query for TopLevelHostEntityId  get above and check the IsDeleted column from each row return.

Steps:

Run the SQL command below:

Use OperationsManager

Select fullname, ismanaged, isdeleted from BaseManagedEntity where TopLevelHostEntityId = '<TopLevelHostEntityId get above>'

The < TopLevelHostEntityId get above> should be replaced by the TopLevelHostEntityId of Agent

Set to IsDeleted directly in database:

WARNING: The workaround need modify the data in database directly, it is a non-supported way and may has some potential risk in the future. So, please take the risk yourself. Otherwise, please do NOT apply the action below.

3.    If you find that the isdeleted column are not consistant or you want to force remove this computer. You can run the SQL query below:

Use OperationsManager

Update BaseManagedEntity Set Isdeleted=1 where TopLevelHostEntityId = '<TopLevelHostEntityId get above>'

               

After the customer do the work around, the issue is resolved now.

SCOM - Large Table query

SELECT TOP 1000
a2.name AS [tablename], (a1.reserved + ISNULL(a4.reserved,0))* 8 AS reserved,
a1.rows as row_count, a1.data * 8 AS data,
(CASE WHEN (a1.used + ISNULL(a4.used,0)) > a1.data THEN (a1.used + ISNULL(a4.used,0)) - a1.data ELSE 0 END) * 8 AS index_size,
(CASE WHEN (a1.reserved + ISNULL(a4.reserved,0)) > a1.used THEN (a1.reserved + ISNULL(a4.reserved,0)) - a1.used ELSE 0 END) * 8 AS unused,
(row_number() over(order by (a1.reserved + ISNULL(a4.reserved,0)) desc))%2 as l1,
a3.name AS [schemaname]
FROM (SELECT ps.object_id, SUM (CASE WHEN (ps.index_id < 2) THEN row_count ELSE 0 END) AS [rows],
SUM (ps.reserved_page_count) AS reserved,
SUM (CASE WHEN (ps.index_id < 2) THEN (ps.in_row_data_page_count + ps.lob_used_page_count + ps.row_overflow_used_page_count)
ELSE (ps.lob_used_page_count + ps.row_overflow_used_page_count) END ) AS data,
SUM (ps.used_page_count) AS used
FROM sys.dm_db_partition_stats ps
GROUP BY ps.object_id) AS a1
LEFT OUTER JOIN (SELECT it.parent_id,
SUM(ps.reserved_page_count) AS reserved,
SUM(ps.used_page_count) AS used
FROM sys.dm_db_partition_stats ps
INNER JOIN sys.internal_tables it ON (it.object_id = ps.object_id)
WHERE it.internal_type IN (202,204)
GROUP BY it.parent_id) AS a4 ON (a4.parent_id = a1.object_id)
INNER JOIN sys.all_objects a2  ON ( a1.object_id = a2.object_id )
INNER JOIN sys.schemas a3 ON (a2.schema_id = a3.schema_id)
WHERE a2.type <> N'S' and a2.type <> N'IT'