JeffVandervoort
-
Posts
89 -
Joined
-
Last visited
Content Type
Profiles
Forums
Events
Posts posted by JeffVandervoort
-
-
The Windows "Action Center" posts a message if antivirus is not running, or is out of date.  Assuming you have a way to grab this info, a Notification from PCM would be welcome.
-
Thanks, Marius, you fixed it with 2.5 beta 5!
I really appreciate your responsiveness. Looking forward to future PC Monitor improvements.
-
Sometimes, it's not good to be notified. Here's one example from my system:
The SMS_EXECUTIVE service (part of System Center Configuration Manager 2007) stops at 3AM every morning for a backup to occur, and restarts when the backup is finished. When the service stops, PC Monitor logs it, and every morning I have to dismiss the event.
But it's really "noise" that I don't need to mess with. But worse, if SMS_EXECUTIVE crashes at 3:10AM, I won't know it because the 3AM notification will stop further notifications.
What I'd like to do is have a rule like this:
"If Time = 3:00-3:01 AM, don't notify on SMS_EXECUTIVE shutdown."
That's the way I read the OP's request, too; maybe he meant something different.
-
I see the new beta 5 time conditions, but under Actions, all I can do is run a Scheduled Task. How do I use that to temporarily bypass monitoring for a specific Service?
-
Set it up and within minutes it had a real live test, which it passed with flying colors! Except...
1. I'm required to clear the notification before it will fire again. That is a problem. There may be Rules that should work that way, but where we're relying on PCM to intervene on our behalf, as here, the Rule needs to fire every time.
2. I still want each PCM Event in the Application log to be assigned an ID (and not all 0), for all the usability reasons that this is standard practice for events from other sources.
-
Thanks; I'll look into that. Haven't explored the Rules feature and didn't realize it could do all this--sounds great!
-
Until you give us a better solution, are there any XPath gurus at MMSoft, or in the community?
Web searches have mostly revealed that no one else knows how to create an Event filter, either! In particular because, in typical MS fashion, Event Viewer doesn't strictly adhere to XPath 1.0.
My biggest problem is that most of what's in [EventData] in the Event XML is what I need to be filtering on, but the current CPU utilization will always be different. So I need a "like" operator. But there isn't one. And I haven't been able to deduce what I need to do using other operators that ARE available, like "starts-with".
What I have now is attached (filter.txt). Event Viewer says the attached XPath is not valid. Don't know why, but it's also not what I really need.
I'm also attaching the edited XML of the event I'm trying to filter for (EditedEvent.txt).
-
Windows 6.x has a very powerful feature that allows specific Events to fire Scheduled Tasks.  However, one can't use it with PC Monitor Application Events because all PCM Events (or all that I know of) have an Event ID of 0.
Please give every built-in Notification a different Event ID, and display the Event IDs in the GUI.  For custom Notifications, make them user-assigned, starting at, say 1000.
This could DOUBLE the usefulness of PC Monitor...not only would we know about problems as they occur, but PCM could fix (or work around) them.
For example: I have set PC Monitor to watch CPU usage of a specific Service.  If that service exceeds 10% CPU for 3 minutes, it sends a Notification, and logs an Event.  I had wanted to have a Scheduled Task bump the Service when that Event was logged.  This would be very easy if it had a specific ID I could have Windows monitor, but it's not possible* with the current version of PCM.* Actually, it probably IS possible by crafting an XPath, and I'm attempting that now...but it's not point-and-click easy!
-
Update: My new Services Notification for PCM Service > 10% for > 3 minutes has fired twice on my other company's system (non-SBS, all WS2008 R2).
When I logged on to one of the problem machines, PCM Monitor Service was at 63% 30 minutes after the notification fired. It has since dropped back to 0-2%.
On the SBS machine I mentionned in my OP, PCM was about 30%. These VMs, however, have only 2 CPUs, where the SBS box has 4. Adjusted for that, the CPU usage is the same.
On the other high-usage box, PCM was back down to 0-2% by the time I logged on. But by that time it was an hour since the event fired.
These are a completely different domain from the SBS 2008 box, FWIW. Both machines are WS2008 R2 Core, dedicated DCs. Their only obvious commonality with the SBS box is that they are DCs. Not even using the same AV, and there isn't much beyond AV that's installed on these two.
Marius, I'll send you .reg files on these as well, shortly.
PCM CPU usage monitoring has not been active on all servers on this other domain until a couple hours ago due to my failure to accurately reverse-engineer the Registry settings I'd have to hack in order to push the settings. However, the 2 DCs discussed in this post had the latest Notification reg entries because they were set manually.
Config settings are now resolved on the other machines; hopefully we won't have more in the next 24 hours. But I'll be sure to let y'all know!
Hope it gets fixed, but...
Moral of the story: PCM needs to monitor itself with EVERY possible relevant monitor and report problems. That should not be an option, or a user configuration. If the user opts to monitor NOTHING, PCM should be monitored.
And that makes it even more imperitive that the "Computer is up an running" notification be replaced with a "PC Monitor Service is launched" notification. PCM will NEVER be able to accurately report ANYTHING at the moment the service is launched.
-
Great! I need that, too. Thanks!
-
Cool...thanks!
-
Thanks, Marius, will send it shortly.
-
If I use Group Policy to push out a configuration change to PCM clients via registry, does PCM automatically start using the new configuration, or do I need to bump the PCM service, or open & close the GUI?
-
Hi Paul
So far, I'm only aware of it on the one...but I've not spent any time looking at PC Monitor CPU usage in the last couple months. Not until I discovered the problem by accident. That's why I'm setting up a Notification on the other 9 to make PCM tattle on itself, if it occurs.
One can't uninstall the PCM SVCHOST processes per se...SVCHOST is part of Windows. The DLL that SVCHOST is hosting in the instance with the runaway CPU is (likely) installed & uninstalled by PCM. But it could also be a Windows service that PCM is sharing. But I haven't dug into that. What I do know about the CPU-sucking SVCHOST instance is that it stops doing so the instant I terminate PCMonitorSVC, so it's reasonable to assume PCM is using that SVCHOST instance.
If it's just the one box, I'm hoping I can isolate it to one particular monitor so I can turn off that monitor until MMSoft can fix it (if it's, in fact, a PCM bug). Sad thing is that on an SBS box, there's a LOT of stuff being monitored, so it could take a while.
-
On one of my machines, an SBS 2008 box, PCMonitorSrv.exe (2.4.1) takes about 30% CPU, while a SVCHOST.EXE instance that appears to be related to it takes about 20%. The SVCHOST instance stops with the PCMonitorSvc, so I'm assuming they're related.
When the service is started, it runs 0-5% for anywhere from a few minutes to a few hours; then jumps to 50% (total of the 2 services). To my knowledge, this is the only machine (of 10 so far) that does this; at least it's the only one I've noticed. I'm in the process of adding a "Service" Notification on the other 9 to alert me if the service uses > 10% CPU for > 3 minutes to see how widespread it is.
I've restarted the SBS box and uninstalled/reinstalled PC Monitor; no change.
-
I like the idea, too.
A former client was a large general contractor. We'd set up field offices with a server, connected by VPN to the main office. When the job was over, the server would come back and wait a few weeks or months for a new assignment. I always wanted to have the servers "on the bench" wake up once a month, install updates from WSUS & Group Policy, renew computer passwords & certs if needed, and then shut down again.
I don't have that client any more, but this would have been very useful to them. Thought about scripting it but those kinds of projects tend to go by the wayside!
I also MAY have a use for that on a small scale in a new cloud biz I'm starting.
-
Here, the server did NOT shut down, but I received a notification that the server was "up and running" that led me to believe the situation in your 2nd paragraph had, indeed, occurred. Perhaps I failed to make it clear, but that was the whole point of my post; PC Monitor misled me about servers having restarted, and I wasted time tracking down a problem that had not occurred.
The sequence of Notifications I described would make very clear that no servers had restarted; only the Agent. And that restart due to an upgrade.
I do strongly believe that an application whose mission is reporting should report on itself. Regardless, I've worked around the problem by creating a custom Event notification that looks for PC Monitor Event 0 with Keywords "New, Update, Found".
As for the "up and running" message, consider this scenario. The only reason the notification is posted is that the service started. There could be 0 bytes free on drive C:, 100% CPU usage, services down left and right, but it would still tell me "Relax, Jeff, all is well."
And that happened to one of my servers the other night. All file shares went offline, and I logged on to discover PC Monitor Service was taking about 30-50% CPU. With no notifications whatsoever. (I am monitoring the situation to see if it occurs again and will follow up if it does.) I restarted PC Monitor, got the "All Clear" notification but nothing else from it...and then had to restart the server from the console because I couldn't keep an RDP session running long enough to do it from my desk!
PC Monitor should report only what it knows. It should not be speculating about the health of the system, because at that moment, PCM is in the dark about everything going on around it. All it knows at that moment is that it launched successfully. Therefore, that is all it should be telling me.
That said, I'm perfectly capable of pretending that where it says "server is up and running" it really means "service is up and running". And to take a break from the stress of the moment to smile at the irony of the reassuring notification I receive while all hell is breaking loose!
-
When the Agent launches, it generates an "Computer is up and running" notification. It would be more accurate if it was accompanied by a notification that said, "PC Monitor agent has started". The "up and running" notification by itself is a little misleading.
Maybe only a PCM newbie like me would make this mistake, but I found "up and running" notifications this morning. I went in to the Event logs to try to figure out why the computers had restarted, and why there wasn't a "shutting down" notification. What I found was that the agent had auto-updated; the computers were up the whole time.
Here are the notifications I'd like to have seen this morning:
PC Monitor Agent v2.4 is shutting down
PC Monitor Agent v2.41 is starting
Computer is up and running.
Then I'd know what actually happened, and why.
In fact, the "up and running" message could be eliminated entirely. Maybe I'm wrong about this, but as far as I can see, all it's really telling us is that the Agent has started and hasn't had time to see any bad stuff happen yet. The "agent is starting" message tells us that.
-
If all clients are Windows, can do the same thing as Paul suggests with REGEDIT...just export the MMSOFT key, edit, and reimport elsewhere.
Central admin via a console would be awesome. Central admin via Group Policy ADMs/ADMXs would be a quick, reliable, inexpensive way to achieve it, in the Windows world, anyway.
Could ALMOST do this with Group Policy Preferences if it wasn't for the "Count" entry in every setting that involves a listbox.
MMSoft: Eliminate "Count", and all-Windows shops that use GPP gain a ZERO DEVELOPMENT COST workaround for centralized configs until PCM becomes Enterprise-Ready. And even after PCM is Enterprise-Ready, we can then still use Group Policy Preferences to tweak it.
-
GREAT idea.
To make it even more useful, add an additional view where related alerts are grouped by source instead of by time. For example, what we might see in Dashboard 2.4 (I'm making all of this up!):
11:01 (E) CPU Usage 50% for PC Monitor Service
11:03 (i) Drive C: Backup Complete
11:03 (E) SomeOtherEvent
11:03 (W) SomeOtherEvent
11:04 (i) SomeOtherEvent
11:04 (i) CPU Usage less than 1% for PC Monitor Service
What I glean from your (Marius's) reply is that the 11:01 event would be changed from (E) to (i).
But to me, given Johnni's insightful contribution, I think it would be much more informative if the display looked like this:
CPU Usage for PC Monitor Service
(E) 11:01 20%
(i) 11:04 less than 1%
Drive C: Backup Complete
(i) 11:03
SomeOtherEvent
(E) 11:03
(W) 11:03
(i) 11:04
Therefore, don't change ANY event's level. Offer the option to group by event and report the LEVEL of the LATEST event.
-
GREAT idea.
To make it even more useful, add an additional view where related alerts are grouped by source instead of by time. For example, what we might see in Dashboard 2.4 (I'm making all of this up!):
11:01 CPU Usage 50% for PC Monitor Service
11:03 (i) Drive C: Backup Complete
11:03 SomeOtherEvent
11:03 (!) SomeOtherEvent
11:04 (i) SomeOtherEvent
11:04 (i) CPU Usage 11:03
(!) 11:03
(i) 11:04
Therefore, don't change ANY event's level. Offer the option to group by event and report the LEVEL of the event.
-
Woo-hoo...less than or equal 13 posts make me a "member" instead of a "newbie"!
-
In your upcoming Dashboard update, please use snaking columns instead of parallel columns (sorry, showing my age...a WordPerfect reference!)
IOW, where Dashboard v2.4 shows me--
Machine1 Machine2 Machine3
Machine4 Machine5 Machine6
--the human eye scan this a LOT faster:
Machine1 Machine3 Machine5
Machine2 Machine4 Machine6
-
On any computer, let us select all Ports that are currently listening.
On Windows boxes, if Windows Firewall is running, allow us to narrow that choice to all inbound ports open in Windows Firewall.
Event log usability enhancement on WP7
in Feature Requests
Posted
Currently, when I view an Event, then close it to return to the Events list, the list returns to the latest Event. This means that when I've scrolled down through (say) 20 "pages" of Events to get to the Event I want to view, I then have to scroll down those same 20 pages to get back to the next Event. This makes the Event log feature nearly useless unless it's a very recent Event.
When I close an Event, please return me to the same page from which I opened it.