How to get noisy discovery rules

Frequently changing properties and objects can be one of the causes of poor OpsMgr performance. In RC bits we saw optimizations on this topic, but still you must be aware that every configuration reload on the agents (21025 events but internal tasks as well) is going to tax your CPU. How much? It depends on MPs number, complexity and CPU power. I must admit I’m a little paranoid on agent health and resource utilization, but I do not want the monitoring infrastructure have a negative impact on business processes. Monitoring is great if it prevents down time not if it causes it, doesn’t it?

So, how can I check for bad MP behaviors. In a steady system newly discovered objects should be 0 or a few, discovered properties should register few changes. So the first question we must ask is which newly discovered objects are we getting and from which discovery rules. The second question is which properties are changing frequently and which are the related discovery rules. Initially I though to develop a powershell script, but I quickly changed my mind:

1. powershell uses the SDK it can access just the live DB that typically contains a few hours or at most a few days or data
2. I’d like to report on these changes so that I can have a weekly report in my inbox

So I turned to SQL queries against the data warehouse. I got a fairly accurate query for both questions. The only topic I must highlight is that the connection between the discovered objects and properties and the object or property itself is calculated based on the configuration part of the discovery rule:

<Discovery ID="Microsoft.SQLServer.2008.DBEngineDiscoveryRule.Server" Enabled="true" Target="Windows!Microsoft.Windows.Server.Computer" ConfirmDelivery="false" Remotable="true" Priority="Normal">
  <Category>Discovery</Category>
  <DiscoveryTypes>
    <DiscoveryClass TypeID="Microsoft.SQLServer.2008.DBEngine">
      <Property TypeID="SQL!Microsoft.SQLServer.ServerRole" PropertyID="InstanceName" />
      <Property TypeID="SQL!Microsoft.SQLServer.DBEngine" PropertyID="ConnectionString" />
      <Property TypeID="SQL!Microsoft.SQLServer.DBEngine" PropertyID="ServiceName" />
      <Property TypeID="SQL!Microsoft.SQLServer.DBEngine" PropertyID="ServiceClusterName" />
      <Property TypeID="SQL!Microsoft.SQLServer.DBEngine" PropertyID="FullTextSearchServiceName" />
      <Property TypeID="SQL!Microsoft.SQLServer.DBEngine" PropertyID="FullTextSearchServiceClusterName" />
      <Property TypeID="SQL!Microsoft.SQLServer.DBEngine" PropertyID="Version" />

but the <DiscoveryTypes> fragment of the discovery rules is not enforced, so we can have missing discovery rules. ON the other side the same class and property can be discovered by multiple rules, so we can a few more hits. But in any case this level of approximation is neglectable.

Discovered objects in the last 4 hours:

select distinct
MP.ManagementPackSystemName,
MET.ManagedEntityTypeSystemName,
D.DiscoverySystemName, D.DiscoveryDefaultName,
MET1.ManagedEntityTypeSystemName As ‘TargetTypeSystemName’, MET1.ManagedEntityTypeDefaultName ‘TargetTypeDefaultName’,
ME.Path, ME.Name,
ME.DWCreatedDateTime
from dbo.vManagedEntity ME
inner join dbo.vManagedEntityType MET on MET.ManagedEntityTypeRowId=ME.ManagedEntityTypeRowId
inner join dbo.vManagementPack MP on MP.ManagementPackRowId=MET.ManagementPackRowId
inner join dbo.vManagementPackVersion MPV on MPV.ManagementPackRowId=MP.ManagementPackRowId
left join dbo.vDiscoveryManagementPackVersion DMP on DMP.ManagementPackVersionRowId=MPV.ManagementPackVersionRowId
    AND CAST(DefinitionXml.query(‘data(/Discovery/DiscoveryTypes/DiscoveryClass/@TypeID)’) AS nvarchar(max)) like ‘%’+MET.ManagedEntityTypeSystemName+’%’
left join dbo.vManagedEntityType MET1 on MET1.ManagedEntityTypeRowId=DMP.TargetManagedEntityTypeRowId
left join dbo.vDiscovery D on D.DiscoveryRowId=DMP.DiscoveryRowId
where ME.DWCreatedDateTime > dateadd(hh,-4,getutcdate())

Modified properties in the last 4 hours:

select distinct
MP.ManagementPackSystemName,
MET.ManagedEntityTypeSystemName,
PropertySystemName,
D.DiscoverySystemName, D.DiscoveryDefaultName,
MET1.ManagedEntityTypeSystemName As ‘TargetTypeSystemName’, MET1.ManagedEntityTypeDefaultName ‘TargetTypeDefaultName’,
ME.Path, ME.Name,
C.OldValue, C.NewValue, C.ChangeDateTime
from dbo.vManagedEntityPropertyChange C
inner join dbo.vManagedEntity ME on ME.ManagedEntityRowId=C.ManagedEntityRowId
inner join dbo.vManagedEntityTypeProperty METP on METP.PropertyGuid=C.PropertyGuid
inner join dbo.vManagedEntityType MET on MET.ManagedEntityTypeRowId=ME.ManagedEntityTypeRowId
inner join dbo.vManagementPack MP on MP.ManagementPackRowId=MET.ManagementPackRowId
inner join dbo.vManagementPackVersion MPV on MPV.ManagementPackRowId=MP.ManagementPackRowId
left join dbo.vDiscoveryManagementPackVersion DMP on DMP.ManagementPackVersionRowId=MPV.ManagementPackVersionRowId
    AND CAST(DefinitionXml.query(‘data(/Discovery/DiscoveryTypes/DiscoveryClass/@TypeID)’) AS nvarchar(max)) like ‘%’+MET.ManagedEntityTypeSystemName+’%’
left join dbo.vManagedEntityType MET1 on MET1.ManagedEntityTypeRowId=DMP.TargetManagedEntityTypeRowId
left join dbo.vDiscovery D on D.DiscoveryRowId=DMP.DiscoveryRowId
where ChangeDateTime > dateadd(hh,-4,getutcdate())

Top discovery rule in the last 4 hours:

select ManagedEntityTypeSystemName, DiscoverySystemName, count(*) As ‘Changes’
from
(select distinct
MP.ManagementPackSystemName,
MET.ManagedEntityTypeSystemName,
PropertySystemName,
D.DiscoverySystemName, D.DiscoveryDefaultName,
MET1.ManagedEntityTypeSystemName As ‘TargetTypeSystemName’, MET1.ManagedEntityTypeDefaultName ‘TargetTypeDefaultName’,
ME.Path, ME.Name,
C.OldValue, C.NewValue, C.ChangeDateTime
from dbo.vManagedEntityPropertyChange C
inner join dbo.vManagedEntity ME on ME.ManagedEntityRowId=C.ManagedEntityRowId
inner join dbo.vManagedEntityTypeProperty METP on METP.PropertyGuid=C.PropertyGuid
inner join dbo.vManagedEntityType MET on MET.ManagedEntityTypeRowId=ME.ManagedEntityTypeRowId
inner join dbo.vManagementPack MP on MP.ManagementPackRowId=MET.ManagementPackRowId
inner join dbo.vManagementPackVersion MPV on MPV.ManagementPackRowId=MP.ManagementPackRowId
left join dbo.vDiscoveryManagementPackVersion DMP on DMP.ManagementPackVersionRowId=MPV.ManagementPackVersionRowId
    AND CAST(DefinitionXml.query(‘data(/Discovery/DiscoveryTypes/DiscoveryClass/@TypeID)’) AS nvarchar(max)) like ‘%’+MET.ManagedEntityTypeSystemName+’%’
left join dbo.vManagedEntityType MET1 on MET1.ManagedEntityTypeRowId=DMP.TargetManagedEntityTypeRowId
left join dbo.vDiscovery D on D.DiscoveryRowId=DMP.DiscoveryRowId
where ChangeDateTime > dateadd(hh,-4,getutcdate())
) As #T
group by ManagedEntityTypeSystemName, DiscoverySystemName
order by count(*) DESC

and this is a sample output from my environment… I must work on the DPM MP

– Daniele

This posting is provided "AS IS" with no warranties, and confers no rights.