I did a few new SCOM 2012 installs recently and noticed that after pushing the agent to the DCs, they showed up grayed out in Ops Manager. Here’s a quick tip on how to fix that.
Logon to the DC(s), and with an administrative comand prompt run the HSLockdown tool, and add the local system account to the allowed group.
C:\Program Files\System Center Operations Manager\Agent:
*NOTE* In newer version, this is now stored in “C:\Program Files\Microsoft Monitoring Agent\Agent”
Run the command “HSLockdown /L” to show what accounts are being allowed or denied. In this case, my local system isn’t even populated.
Now run the HSLockdown tool again with the add switch to allow local system.
“HSLockdown /A “NT AUTHORITY\SYSTEM”
Restart the agent with “net stop heathservice && net start healthservice” and give it 5 minutes or so then it should be all green in your dashboard.
Hope this made your day at least a little easier!
In a lot of environments that have developers that use a lot of config files, sometimes it would be nice to keep older versions of those files. Fortunately Microsoft has graced us with shadow copies so we can have “Previous Versions”. The only issue with that, is you can only can’t turn on shadow copies (as far as I know) for specific files. So what I did was write a powershell script to take care of that, in a round-about way.
What this script does, is wait until the file has been modified then copy it to an “archive” location and time stamp it so you can review older copies.
At the beginning of this script there are two arrays that include variables of full paths to the files. “$OriginalPath” is the array that holds the full path to each file you want to watch. In the script here the two files I’m watching are “C:\configs\config1.txt” and “C:\configs\config2.txt”. Then the second array is where you want to archive the files to. In the script here it’s “C:\archive_configs\config1.txt” and “C:\archive_configs\config2.txt”.
What’s done after the arrays are initialize, is the time -1 minute and compares the last write value of the file in question to the current time -1 minute. If it has been modified, it copies to the archive location then modifies the name with a time stamp. Then loops back through if there are more files being checked in the array.
What I’ve done is put this in Task Scheduler to run every 1 minute. If you want to modify that, take the line:
$1MinAgo = (get-date).AddMinutes(-1)
and you the “Minutes” portion and the “(-1)” portion can both be modified.
I hope I’ve made your day a little bit easier!
Recently when working with a very old, decrepit server that was running out of disk space I went to compress a folder of logs in NTFS and the compress box was greyed out and I was unable to compress it.
This is because in NTFS the compression attribute isn’t supported for volumes with cluster sizes larger than 4k — this happened to be sized at 64k thus the inability.
The way that I typically check this is by simply running “CHKDSK D:” replacing D: with your prospective drive letter. The output of this will display your cluster size in bytes (divide by 1024 to get the cluster size in kb)
Hope I’ve made your day a little bit easier!
A while back I wrote a blog post about how to map your OneDrive as a local drive (network drive) and it has been hugely popular (contrary to anything I could have imagined)
I’ve even seen it referred to in the Microsoft Community Forums. So I decided to share something that I played with, starting to write a tool to automate this otherwise lengthy process. Granted at this point it’s still at something of a Version 0.1, but I’ll share it anyways.
There are three things you need to have to make this tool do it’s magic.
- Your Microsoft CID
- Your Email
- Your Password
As long as you have those things the tool will do the rest!
The only thing here that you need to do is have your Microsoft CID, which isn’t too hard to do. Let’s help you grab that real quick!
- Go login at https://www.onedrive.com
- Click “Files” once you’ve logged in
- Copy the CID in the top URL bar
Once you have this ID copied, you’re all set! You can download the poweshell script here. Right click, and run with powershell! *Note* Accessing OneDrive this way is NOT supported and may act sluggish at times.
In some free time I’ll be working on using the Windows Live APIs to automatically pull the CID in the next version of this application. I hope I’ve made your day a little bit easier!
We all have performance issues at one time or another, and the majority of what I hear admins doing is the age old “Turn it off and back on again” or some variation thereof depending on the situation.
This isn’t always the fix, so we move on to the logs — right? Well you should anyways. Depending on what OS you’re in you look at Task Manager, PerfMon, Resource Monitor, a third-party application or something at an abstracted level if the machine in question is virtualized. If you’re using built-in tools like a PerfMon capture or a Data Collection Set (DCS), they can be helpful but sometimes just hard to understand if you’re looking for something other than am I using too much RAM or CPU %. This is where PAL comes in, it does the analysis of the logs for you and writes them to an HTML page with easy(er) to read and understand output and statistics.
The PAL tool is a powerful tool that reads in a performance monitor counter log and analyzes it using known thresholds. It is written by Performance SME Clint Huffman who is a Premier Field Engineer for Microsoft.
- Common built-in thresholds for many major Microsoft products such as IIS, MOSS, SQL, BizTalk, Exchange, and Active Directory.
- An easy “click-next” GUI that makes running these reports extremely simple.
- A GUI that allows you to edit, or create your own thresholds.
- Creates an HTML with an optional XML report.
- Analyzes performance counters for thresholds that vary based on the criteria entered by the user specifying the machines role and hardware specifications.
Let’s walk through a basic use of PAL.
First, you’re going to go to pal.codeplex.com to download the PAL setup .zip file.
You’re then going to unzip the folder and run setup.exe, when you do you will most likely get this message.
Click yes, and it will take you to the download page of the .NET Chart Controls page where you can download and install them real quick.
Then Run setup.exe again and you should be good to go. Next, Next Next and it’s installed, now let’s run this!
Click next to, and it will take you to the “Counter Log” tab. On this page you select your .blg, .csv, or .tsv performance log files that you’ve created already. PAL comes with a sample log that I’ll be using for this demonstration. Note that if you don’t want to process the whole log you can select a date range to process.
If you click Next, you’ll be taken to the “Threshold File” tab. Here you can select which threshold you’d like to use. If you’re just looking at SQL, or Exchange, or whatever performance logs you’ve captured, you can select that here to include those specific thresholds. If you’re just looking at general system overall performance the “System Overview” file works, which is what we will be using here since that’s what the sample log file is based on.
If you know exactly what you’re looking for and want to make your own file, you’re able to do that as well! Choose a basic file and click “Edit” and you’ll be taken to a GUI that allows you to edit the threshold file in an environment that resembles PerfMon.
Click next and you’re taken to the “Questions” tab. Here you select the OS, PhysicalMemory and UserVa (which is only for 32-bit machine log files). The thresholds chosen on the previous screen are modified based on the information you put in here.
Click Next again and you’re taken to the “Output Options” tab. Here you have two options to modify if you wish. First is the Analysis Interval, that allows you to choose the interval in seconds that the log is split into. By default, it takes the total time span of the file and splits it 30 times. You can then choose to process every single counter in the log file if you want to be extremely detailed. Note that changing either of these can have a huge impact on the performance of the system that is running them and how long it will take to process.
Click next and you’re taken to the “File Ouptut” tab. Here you can select where your output goes. *Note* there will be an html document as well as a folder that holds the images in the html document, so if you’re sending the data to someone you will have to grab both pieces.
Click next and you’re taken to the Queue tab and the Execute tab. These shows what powershell code you’ve generated thus far in the process, if you have more than one file to process you can queue them up and run them all under the same instance of PAL. This is also where you choose how much CPU you’re going to delicate to the processing of the logs. I am going to tell you that this program pulls the ENTIRE log file into memory and processes it there. Keep that in mind when your working here, if you only have 4GB of RAM on your laptop and are running a 7GB SQL performance log — well…kiss your disk good bye because you’re going to be running 3GB of that out of page file. Also note that this is a VERY intensive process and if you give it all of your CPU cores it WILL use them as you will note in a screenshot I took below.
Click finish and it will kick off the process, as I said — take a look at that CPU!
Once it’s finished it will look like this. *Note* that the sample log I pulled here was 504Kb with only 787 instances and it still ran at 100% CPU for a little over 4 minutes. I have a dedicated VM in my development environment that I give 32GB RAM and 16 cores to eat through these and still sometimes with SQL it may take a few hours.
It then opens up the web page that it created, I’ve added a few snips of what it looks like here. It starts with a table of contents, and then lays out everything it just processed in nice tables and graphs.
You can download a full zip file of the web page, and the folder that contains the images below.
This tool has been extremely helpful to me, and I hope I’ve just made your day at least a little bit easier by sharing it with you!
Video Posted on
This past weekend I was invoking my disaster recovery plan for a system of mine and I went to boot the .iso to run the restore (CA ArcServ D2D Bootkit) and I kept on getting this error. Under the gun of pressure as the production hours quickly approached I had to figure it out.
*** STOP: 0x0000005D (0x000000000FABBBFF, 0x0000000000000000, 0x0000000000000000,0x0000000000000000)
Of course this is extremely frustrating when in a DR situation. So here is the quick, and simple answer.
This error occurs when you have the machine you’ve created in VMWare set to a 32-bit architecture, while attempting to boot into a 64-bit environment. Power down your VM, edit the settings like shown below to x64 and you’ll be all set!
Now you’ll be able to boot up with no issues at all. I hope I’ve made your day at least a little bit easier!
A few days ago the phone rings, I get an ear-full about how some application isn’t working correctly and how it’s all the network’s fault and the repercussions of this outage will possibly cause so much damage that the world will start turning…the OTHER DIRECTION. Unfortunately for us IT Professionals, this is all too common of an occurrence. Nonetheless, I jumped in to see what I could do. I had never seen this application before so I had to start troubleshooting from the ground up. Very quickly I noticed it was running (or supposed to be running) over web protocols, so I whipped out the handy-dandy wireshark to get a look. Hm…it establishes a TLSv1 tunnel and shoots all the data at the server that way. Well, the Apps team was no where to be found so I had to find out what was moving across the wire here to figure out the issue. This is where fiddler comes in to play *Trumpets Fanfare*.
Fiddler is a fantastic little tool that does different things with packet captures and things of the sort. For this blog, I want to talk about its’ ability to man in the middle your own machine to provide visibility into an encrypted tunnel. Lets do a little demonstration here.
I’ve done a quick search in on bing, using HTTPS — thing fancy here at all.
I started fiddler prior to performing the search above, and this is what it shows up with, a whole bunch of nothing. Tunnel Tunnel Tunnel Tunnel…dang security.
Alas, fiddler has an option to man in the middle yourself and decrypt the tunnel! Just go to Tools > Fiddler Options > HTTPS > and check the box that says “Decrypt HTTPS traffic”. I chose browsers only for this demonstration, though you can do all traffic for other uses and applications.
It lets you know that you’re doing something that defies the laws of CAs.
Now here we go, re-launch the browser and go to https://bing.com, it throws a security error stating that the certificate is untrusted.
For this to work, you will need to add the exception, if you view the cert you can see that it was assigned to fiddler, when it’s clearly stating that it is for bing.com
Once that is all excepted, you can do the same search we did before — plain and simple.
Back to Fiddler, and ta-da! Congratulations, you’ve bypassed the security of your own data and now have visibility into the tunnel.
That’s it, very simple. You can view inside your SSL/TLS tunnel using fiddler in just a few simple steps. Side note, I was able to use that to determine what was happening on the wire for my application failure and was able to remedy the failure.
I hope I’ve made your day at least a little bit easier!