Detect Agent MM Toggle Event Rule

SCOMAgentHelper.DetectAgentMMToggleEvent.Rule (Rule)

Detect MM Action event, trigger MM action, write new MM status to agent event log.

Knowledge Base article:

Summary

This will detect specific events on agent-managed machines that are used to trigger a write action on the mgmt server. The write action will use a PowerShell script to modify maintenance mode status of the agent. Depending on the Verify parameter used, an agent task may be used to write a verification event at the agent.

Overrideable Parameters

Name	Description	Default Value
SpreadInitializationOverIntervalSeconds	This implements a sleep command in the beginning of the Write Action script for a random duration of seconds between 0 and this value. This can be used in large environments where you might have a large number of agents which trigger MM at the same time. For large environments, start testing with 15 and increase only if needed, depending on results.	0
WaitForStatusToUpdateSeconds	After making changes to MM status, wait for mgmt server SDK to reflect this (in the database really) before proceding in the Write Action script. Also this is used for waiting for the WriteMMStatus agent Task to complete (which is part of that same Write Action script). Therefore, whatever this value is, the Write Action could take twice as long to complete since it is used in two different parts/loops of the script.	180
WriteActionTimeoutSeconds	The amount of time that the Write Action will attempt to create the event before aborting the workflow.	400
WriteToEventLog	This will control debug info written to the Operations Manager event log.	false

Element properties:

Target	Microsoft.SystemCenter.ManagementService
Category	Maintenance
Enabled	True
Event Source	SCOMAgentHelper
Alert Generate	False
Remotable	True
Event Log	Operations Manager

Member Modules:

ID	Module Type	TypeId	RunAs
DS	DataSource	Microsoft.Windows.EventProvider	Default
WA	WriteAction	SCOMAgentHelper.TriggerMMToggle.WriteStatusEvent.WA	Default

Source Code:

<Rule ID="SCOMAgentHelper.DetectAgentMMToggleEvent.Rule" Target="SC!Microsoft.SystemCenter.ManagementService" Enabled="true" ConfirmDelivery="true" Remotable="true" Priority="Normal" DiscardLevel="100">

  <Category>Maintenance</Category>

  <DataSources>

    <DataSource ID="DS" TypeID="Windows!Microsoft.Windows.EventProvider">

      <ComputerName>$Target/Property[Type="System!System.Entity"]/DisplayName$</ComputerName>

      <LogName>Operations Manager</LogName>

      <Expression>

        <And>

          <Expression>

            <RegExExpression>

              <ValueExpression>

                <XPathQuery Type="UnsignedInteger">EventDisplayNumber</XPathQuery>

              </ValueExpression>

              <Operator>MatchesRegularExpression</Operator>

              <Pattern>^(3001|3002)$</Pattern>

            </RegExExpression>

          </Expression>

          <Expression>

            <SimpleExpression>

              <ValueExpression>

                <XPathQuery Type="String">PublisherName</XPathQuery>

              </ValueExpression>

              <Operator>Equal</Operator>

              <ValueExpression>

                <Value Type="String">SCOMAgentHelper</Value>

              </ValueExpression>

            </SimpleExpression>

          </Expression>

        </And>

      </Expression>

    </DataSource>

  </DataSources>

  <WriteActions>

    <WriteAction ID="WA" TypeID="SCOMAgentHelper.TriggerMMToggle.WriteStatusEvent.WA" Target="SC!Microsoft.SystemCenter.CollectionManagementServer">

      <Action>$Data/Params/Param[2]$</Action>

      <!--<AgentDisplayName>$Data/Params/Param[3]$</AgentDisplayName>-->

      <AgentDisplayName>$Data/LoggingComputer$</AgentDisplayName>

      <Comment>$Data/Params/Param[4]$</Comment>

      <DurationMinutes>$Data/Params/Param[5]$</DurationMinutes>

      <DurationMinutesMaxAllowed>525960</DurationMinutesMaxAllowed>

      <Force>$Data/Params/Param[6]$</Force>

      <Reason>$Data/Params/Param[7]$</Reason>

      <SpreadInitializationOverIntervalSeconds>0</SpreadInitializationOverIntervalSeconds>

      <UserName>$Data/Params/Param[8]$</UserName>

      <Verify>$Data/Params/Param[9]$</Verify>

      <WaitForStatusToUpdateSeconds>180</WaitForStatusToUpdateSeconds>

      <WorkflowName>SCOMAgentHelper.DetectAgentMMToggleEvent.Rule</WorkflowName>

      <!--This should be at least double the WaitForStatusToUpdateSeconds value-->

      <WriteActionTimeoutSeconds>400</WriteActionTimeoutSeconds>

      <!--TRUE FOR TESTING. FALSE FOR RELEASE-->

      <WriteToEventLog>false</WriteToEventLog>

    </WriteAction>

  </WriteActions>

</Rule>