SCOM Objects Not Un-Discovering

A little while back we ran into a problem where a Web site would not undiscover after removing it from the IIS Server and the IIS guys were getting alerts for a Web Site that no longer existed! What should happen in a normal environment is that SCOM will detect that the site no longer exists and remove it from being monitored. In this particular case that wasn’t happening.

As I move through this blog post some of this information I’ll make specifically about an IIS Web Site but the SQL and PowerShell will all be the same process for pretty much any object that is not undiscovering even when the actual object no longer exists.

However specifically in the case of IIS, Discoveries in the MP will check the sites entries in the applicationHost.config file located on the IIS server and add every site listed in this file as an entity to SCOM. The file is under %windir%\system32\inetsrv\config\ and it’s an xml file so you can fire it up in notepad. You’ll see an entry similar to this…

<sites>
<site name=”Default Web Site” id=”1″>
<application path=”/”>
<virtualDirectory path=”/” physicalPath=”%SystemDrive%\inetpub\wwwroot” />
</application>
<application path=”/MonitoringView” applicationPool=”OperationsManagerMonitoringView”>
<virtualDirectory path=”/” physicalPath=”C:\Program Files\System Center 2012\Operations Manager\WebConsole\MonitoringView” />
</application>
<application path=”/OperationsManager” applicationPool=”OperationsManager”>
<virtualDirectory path=”/” physicalPath=”C:\Program Files\System Center 2012\Operations Manager\WebConsole\WebHost” />
</application>
<application path=”/AppDiagnostics” applicationPool=”OperationsManagerAppMonitoring”>
<virtualDirectory path=”/” physicalPath=”C:\Program Files\System Center 2012\Operations Manager\WebConsole\AppDiagnostics\Web” />
</application>
<application path=”/AppAdvisor” applicationPool=”OperationsManagerAppMonitoring”>
<virtualDirectory path=”/” physicalPath=”C:\Program Files\System Center 2012\Operations Manager\WebConsole\AppDiagnostics\AppAdvisor\Web” />
</application>
<bindings>
<binding protocol=”http” bindingInformation=”*:80:” />
<binding protocol=”net.tcp” bindingInformation=”808:*” />
<binding protocol=”net.pipe” bindingInformation=”*” />
<binding protocol=”net.msmq” bindingInformation=”localhost” />
<binding protocol=”msmq.formatname” bindingInformation=”localhost” />
</bindings>
</site>
<site name=”Microsoft System Center 2012 Orchestrator Web Service” id=”2″>
<application path=”/”>
<virtualDirectory path=”/” physicalPath=”C:\Program Files (x86)\Microsoft System Center 2012\Orchestrator\Web Service” />
</application>
<application path=”/Orchestrator2012″ applicationPool=”System Center 2012 Orchestrator Web Features”>
<virtualDirectory path=”/” physicalPath=”C:\Program Files (x86)\Microsoft System Center 2012\Orchestrator\Web Service\Orchestrator2012″ />
</application>
<bindings>
<binding protocol=”http” bindingInformation=”:81:” />
</bindings>
</site>
<siteDefaults>
<logFile logFormat=”W3C” directory=”%SystemDrive%\inetpub\logs\LogFiles” />
<traceFailedRequestsLogging directory=”%SystemDrive%\inetpub\logs\FailedReqLogFiles” />
</siteDefaults>
<applicationDefaults applicationPool=”DefaultAppPool” />
<virtualDirectoryDefaults allowSubDirConfig=”true” />
</sites>

 

So in this sample file we have 2 different sites. So if we were to delete one, we’d expect IIS to update this file removing the references to the website and then SCOM to undiscover it accordingly. So I’d follow this troubleshooting path.

a. Open the IIS Manager console to check the web sites
b. Open the applicationHosts.config file to file the web sites whether they match the ones in IIS manager console.
c. Capture an SCOM ETL Trace and find the value returned for the IIS sites.

In our situation, this wasn’t the cause but it’s not bad information to know.

 

Multiple Discoveries?

Another potential cause for objects not undiscovering might be multiple discoveries discovering the same web site and then something wrong with the Reference Count being decremented. I won’t go into this too much as there is a fine write up here but the short explanation is that SCOM creates a Reference Count on an object when it’s discovered.  If another discovery discovers the same object, it will increment the Reference Count by one. If the object is removed and discovery runs for the next time, the Reference Count will decrease by one. If Reference Count reaches 0, the object will be removed in SCOM database (undiscovered).

If you’re at all interested in this you can find the Reference Count values inside the C:\Program Files\Microsoft System Center 2012 R2\Operations Manager\Server\Health Service State\Health Service Store folder. Open up the HealthServiceStore.edb file with an appropriate viewer like this one. You’ll probably need to stop the HealthService first as the database will be in use.

 

Just Delete it already!

So in this case, I’d chosen to delete this object, this web site from SCOM the manual way.

1. Find the BaseManagedEntityID for the Web Site in the BaseManagedEntity table of the OperationsManager Database. Since the website is on a 2012 Server, I’ll issue the follow sql query:

SELECT *
FROM [OperationsManager].[dbo].[MT_Microsoft$Windows$InternetInformationServices$6$2$WebSite]

SQL Select All BaseManagedEntityID

 

 

 

 

 

 

 

 

We can see that it’s returned one item, my default website. We’ll need to take note of the BaseManagedEntityId of the object ‘C1CC591F-DF73-FEF8-5800-92985CB51626’.

 

Just to make sure the SCOM Console is telling me the same thing, let’s take a look at the under Discovered Inventory, we can see the website listed there.

Discovered Inventory Website

 

 

 

 

 

Now if you’d prefer to do this in PowerShell and you don’t know the name of the class we could also try the following.

Get-Scomclass | ? {$_.Name -like “*Internet*”} | select Name

Name
—-
Microsoft.Windows.InternetInformationServices.ComputerGroup
Microsoft.Windows.InternetInformationServices.FTPServer
Microsoft.Windows.InternetInformationServices.FTPSite
Microsoft.Windows.InternetInformationServices.InstanceGroup
Microsoft.Windows.InternetInformationServices.NetApplicationComponent
Microsoft.Windows.InternetInformationServices.AspNetWebApplicationEndpoint
Microsoft.Windows.InternetInformationServices.AspNetWebServiceEndpoint
Microsoft.Windows.InternetInformationServices.NNTPServer
Microsoft.Windows.InternetInformationServices.NNTPVirtualServer
Microsoft.Windows.InternetInformationServices.ServerRole
Microsoft.Windows.InternetInformationServices.ServerRoleGroup
Microsoft.Windows.InternetInformationServices.SMTPServer
Microsoft.Windows.InternetInformationServices.SMTPVirtualServer
Microsoft.Windows.InternetInformationServices.WebServer
Microsoft.Windows.InternetInformationServices.WebSite
Microsoft.Windows.InternetInformationServices.6.2.ComputerGroup
Microsoft.Windows.InternetInformationServices.6.2.ServerRole
Microsoft.Windows.InternetInformationServices.6.2.FTPServer
Microsoft.Windows.InternetInformationServices.6.2.FTPSite
Microsoft.Windows.InternetInformationServices.6.2.LegacySMTPServer
Microsoft.Windows.InternetInformationServices.6.2.LegacySMTPVirtualServer
Microsoft.Windows.InternetInformationServices.6.2.ServerRoleGroup
Microsoft.Windows.InternetInformationServices.6.2.WebServer
Microsoft.Windows.InternetInformationServices.6.2.ApplicationPool
Microsoft.Windows.InternetInformationServices.6.2.WebSite
Microsoft.Windows.InternetInformationServices.6.2.AspNetWebApplicationEndpoint
Microsoft.Windows.InternetInformationServices.6.2.AspNetWebServiceEndpoint
Microsoft.Windows.InternetInformationServices.ApplicationComponent
Microsoft.Windows.InternetInformationServices.ApplicationPool

 

As an educated guess, I’d say the Class I am looking for is “Microsoft.Windows.InternetInformationServices.6.2.WebSite”.

Get-SCOMClass -name “Microsoft.Windows.InternetInformationServices.6.2.WebSite” | Get-SCOMClassInstance | Select DisplayName, ID

DisplayName Id
———– —
Default Web Site c1cc591f-df73-fef8-5800-92985cb51626

 

Default Web Site PowerShell

 

 

 

 

 

 

So we know the ID of the default website is “c1cc591f-df73-fef8-5800-92985cb51626”. We’ll need that ID for the next query.

 

2. Run the following SQL Query as this will mark the related entities to be deleted.

USE OperationsManager
CREATE TABLE #DIRTY(TypedManagedEntityId UNIQUEIDENTIFIER)
INSERT INTO #DIRTY(TypedManagedEntityId)
SELECT TypedManagedEntityId FROM TypedManagedEntity WHERE BaseManagedEntityId IN ( SELECT BME.BaseManagedEntityId FROM BaseManagedEntity BME WHERE BME.BaseManagedEntityID like ‘C1CC591F-DF73-FEF8-5800-92985CB51626’ )
DECLARE @EntityId UNIQUEIDENTIFIER
DECLARE @TimeGenerated DATETIME
DECLARE myCursor CURSOR FOR
SELECT TypedManagedEntityId FROM #DIRTY
OPEN myCursor
FETCH NEXT FROM myCursor INTO @EntityId
WHILE @@FETCH_STATUS = 0
BEGIN
SET @TimeGenerated = GETUTCDATE()
EXEC dbo.p_TypedManagedEntityDelete @EntityId, @TimeGenerated
FETCH NEXT FROM myCursor INTO @EntityId END
CLOSE myCursor
DEALLOCATE myCursor
DROP TABLE #DIRTY

 

3. If you look at discovered inventory in the SCOM Console you’ll see that it will no longer appear there.

Discovered Inventory Website Removed

 

 

 

 

 

But the database will still have it listed as “isDeleted 1” and it will purge it at the next interval.

SQL Delete BaseManagedEntityID

 

 

 

 

 

 

 

 

4. Run the following SQL to purge the deleted items to let it take effect immediately

USE [OperationsManager]
DECLARE @rowcount int
DECLARE @Err int
DECLARE @GroomingThresholdUTC datetime
SET @GroomingThresholdUTC = getutcdate()
EXEC @Err = dbo.p_DiscoveryDataPurgingByTypedManagedEntity @GroomingThresholdUTC,250, @rowcount
EXEC @Err = dbo.p_DiscoveryDataPurgingByRelationship @GroomingThresholdUTC,250, @rowcount
EXEC @Err = dbo.p_DiscoveryDataPurgingByBaseManagedEntity @GroomingThresholdUTC,250, @rowcount

 

This time if we re-run our SQL Query, the results will be different. The Object has been purged.

SQL Delete BaseManagedEntityID Purged

 

 

 

 

 

 

 

 

 

As always, before you go poking around and deleting things from your database it’s a good idea to have a backup and/or contact Microsoft Premier Support first.

 
Comments

No comments yet.

Leave a Reply