Windows 2008 Failover Clustering: Using the Windows Server and Windows Cluster Management Pack in Operations Manager 2007 SP1 to Monitor Failover Clustering

lynn lunik — Wed, 05 Aug 2009 21:30:00 GMT

Operations Manager 2007 SP1 provides a rich Toolset to manage, monitor, configure and report on Windows Servers. In this Blog entry I briefly reviewing capabilities of the Microsoft Windows Server and Microsoft Windows Cluster Management Packs focused on supporting a 3 Node Windows 2008 Failover Cluster configured with SQL 2008 Failover Cluster Services.

If you have note reviewed how these Windows 2008 Failover Cluster Nodes using SQL 2008 Failover Cluster Services were built and configured, you will find those Blog entries here:

Windows 2008 Failover Clustering: Configuring SQL 2008 for Failover Clustering - Part 1 of 3

Windows 2008 Failover Clustering: Configuring SQL 2008 for Failover Clustering - Part 2 of 3

Windows 2008 Failover Clustering: Configuring SQL 2008 for Failover Clustering - Part 3 of 3

Additionally, if you have have interest in other Blog entries focused on SC Operations Manager 2007 SP1, you will find them here, or, other Blog entries on Windows 2008 Failover Clustering you will find them here.

Figure 1 - As I begin, I will orient you to this Lab Environment by reviewing the Hosts as seen on the Management Consoles of this Windows 2008 Active Directory Domain Controller (b01-dc01.corp.itpslab.local).

Figure 2 - Using the 'DNS Manager' I observe 3 Cluster Nodes (b01-node-1, b01-node-2 and b01-node-3), along with a 'Cluster Name Object (CNO)' titled 'app-cluster-01.corp.itpslab.local'. The CNO comprises the 'Application Cluster' titled 'app-db-01.corp.itpslab.local' on which our SQL 2008 Failover Cluster Services are maintained.

Figure 3 - The System Center Operations Manager 2007 SP1 Server is a Host named 'b01-mg01.corp.itpslab.local'.

Figure 4 - I Login to the SC Operations Manager 2007 SP1 Server and open the Operations Manager 2007 SP1 Console.

Figure 5 - Selecting the 'Computers' View from the Operations Manager 2007 SP1 Console provides and overview the Hosts included in this Lab Configuration (those with an Operations Manager SP1 Agent installed). The 3 Cluster Nodes are Physical Computers, while 'app-cluster-01.corp.itpslab.local' and 'app-db-01.corp.itpslab.local' are 'Virtual' and configured by the Cluster Service as Failover entities.

Figure 6 - In the Operations Manager 2007 SP1 Console I select the 'Microsoft Windows Server' Management Pack (current through August 2009) and then select the 'Windows Server State' View. This View provides detailed information about each Windows Server including IP Address, DNS Name and Active Directory SID information. Additionally, the other 'Views' are exposed such as the Dashboard Views like 'Disk Health', 'Network Adapter Health', 'Operating System Health' and many others.

Figure 7 - Using the Operations Manager 2007 SP1 Console and highlighting the 'Health Monitoring' leaf of the 'Microsoft Windows Server' Management Pack I select the 'Disk Health' Dashboard View. Consolidated detail of Disks by Name, Disk Capacity and specificity of Disk being either Local Disk or SAN Disk is provided. Each of the LUNs on the Cluster Nodes are detailed here.

Figure 8 - Selecting the 'Network Adapter Health' Dashboard View in the 'Microsoft Windows Server Management Pack' provides critical information on the Network Adapters supporting the Cluster Nodes. Recall, a Windows 2008 Failover Cluster requires 2 NICs for proper functioning.

Figure 9 - The 'Operating System Health' Dashboard View in the 'Microsoft Windows Server Management Pack' provides summary detail on the 'Operating System Version', 'Service Pack', 'Build', 'Serial Number' and other pertinent details regarding the OS.

Figure 10 - The 'Microsoft Windows Cluster' Management Pack includes a Dashboard View title 'Cluster Service' View that provides a snapshot of the 'Health' of the Cluster Service on each Cluster Node.

Figure 11 - Next, I select the 'Diagram' View in the 'Microsoft Windows Cluster' Management Pack. The Diagram View capability within SC Operations Manager 2007 SP1 includes the ability to 'Drill Down' into granular detail on the Object in focus to garner additional information about the Object. Follow these steps as I review the Objects that comprise the Application Cluster titled 'app-cluster-01.corp.itpslab.local'.

Figure 12 - Selecting the 'Healthy' Object in the 'Microsoft Windows Cluster' Management Pack 'Diagram' View provides detail on all the Objects comprising the Application Cluster.

Figure 13 - Observe the original 'Windows Cluster' and 'Application Cluster' on the left of the Screen throughout the following Screen Captures. I recognize this Screen Capture is impossible to read legibly without viewing the 'large version' (availble by 'clicking' the 'small version') but need to note the 1) 3 Cluster Nodes, 2) Cluster Group, 3) Public and Private NICs and 4) SQl 2008 Failover Cluster Services visible on this 'Diagram' View in the SC Operations Manager 2007 SP1 Console.

Figure 14 - I move up the 'Diagram' View to the 'Clustered DTC Service' to further 'expand' the Object. Each Object on this 'Diagram' View expands in similar fashion. I can quickly tell the 'Health' of each respective Object.

Figure 15 - The 3 Cluster Nodes visible in the 'Diagram' View permit me to 'drill down' into each of the Objects that comprise that 'Collective Object'. Observe the detail available in Cluster Node 1 (b01-node-1.corp.itpslab.local) through this 'drill down' process.

Figure 16 - The 'Microsoft Windows Cluster' Management Pack' 'Diagram' View Objects are comprise of other Objects monitored by SC Operations Manager 2007 SP1. This 'Server' Object includes 'Disk', 'Database', 'NIC' and 'Service' Object (to name a partial list). The 'Health Status' of each Object is evident based upon the Icon next to the Object.

Figure 17 - Moving back to another 'View' in the 'Microsoft Windows Cluster' Management Pack' I observe the Dashboard View titled 'Windows 2008 Networks' that comprise all Operating System Network 'Objects'. Each Cluster Node includes both Physical and Virtual Network IP Addresses issued by the Cluster Service during Cluster Service and Application configuration.

Figure 18 - A quick way to view 'Cluster Node Status' is the 'Microsoft Windows Cluster' Management Pack' 'Cluster Node Status' View.

Figure 19 - Since Cluster Nodes are comprised of 'Resource Groups' a worthwhile 'View' titled 'Windows 2008 Resource Group State' View is available in the 'Microsoft Windows Cluster' Management Pack'.

Figure 20 - Moving to Cluster Node 1 (b01-node-1.corp.itpslab.local) I observe the status of 'Disk Drives', 'Applications and Services' and 'Network Connections' specific to 'b01-node-1.corp.itpslab.local'. All 'Resources' are Online and functioning. Examine the response from SC Operations Manager 2007 SP1 when I take a single Node of the Cluster into a 'Paused' State (b01-node-3.corp.itpslab.local).

Figure 21 - In the 'Failover Cluster Management' MMC I select Cluster Node 3 (b01-node-3.corp.itpslab.local) and then, 'Pause' to pause the Cluster Node. The response from 'SC Operations Manager 2007 SP1' gives us Feedback on the status of Cluster Node 3.

Figure 22 - In the 'SC Operations Manager 2007 SP1 Console' I observe an 'Alert' with a Severity of 'Warning' indicating the 'Cluster Node is not Online' for Cluster Node 3 (b01-node-3). This is one of the responses 'SC Operations Manager 2007 SP1' makes in regards to a Failover Cluster Node being 'Offline'.

Figure 23 - In the 'Failover Cluster Management' MMC I select 'Resume' from the Properties of Cluster Node 3 (b01-node-3.corp.itpslab.local). I will move back to the 'SC Operations Manager 2007 SP1 Console' to observe the 'Alert' remedied and 'Cleared'. I can use the 'Reporting' functions in 'SC Operations Manager 2007 SP1' to review 'Most Frequent Alerts'.

Figure 24 - Moving back to the 'SC Operations Manager 2007 SP1 Console' I observe in the 'Active Alerts' View that no Active Alerts are present. The 'Warning' Alert from the prior Figure was configured to 'automatically resolve' if the condition (the Cluster Node being 'Offline') remedies through either Manual Intervention or Programmatic Action.

Figure 25 - Selecting the 'Computers' View in the 'SC Operations Manager 2007 SP1 Console' provides the 'Health State' of Cluster Node 2 (b01-node-2.corp.itpslab.local). I will use the 'Failover Cluster Management' MMC to 'Move' the SQL 2008 Failover Clustering Services to Cluster Node 2 (b01-node-2.corp.itpslab.local) and then view the response (if any) from the 'SC Operations Manager 2007 SP1 Console'.

Figure 26 - In the 'Failover Cluster Management' MMC I select the 'SQL Server (MSSQLSERVER)' Service, then 'Right Mouse Click' and select 'Move this Service or Application to Another Node' and select '2 - Move to Node b01-node-2'.

Figure 27 - Upon receipt of the 'Please Confirm Action' dialogue windows in the 'Failover Cluster Management MMC' I select 'Move SQL Server (MSSQLSERVER) to b01-node-2' to proceed.

Figure 28 - After just a moment including the 'Status' for the 'Server Name', 'Disk Drives' and 'Other Resources' being marked 'Offline', those same Resources come 'Online' associated with 'b01-node-2.corp.itpslab.local'. Next, I move to see if the 'SC Operations Manager SP1 Console' reflects any changes. One of the great features of SC Operations Manager 2007 SP1 is the ability to 'Monitor' anything that occurs on a Windows Server. I could easily setup an 'Event Monitor' that offers an 'Informational Alert' when the Cluster Node Failover Action occurs in an environment. I have not for this Blog entry as I would like to see the outcome of such Action in the 'SC Operations Manager 2007 SP1 Console'.

Figure 29 - Coincidentally (I believe), the 'Health State' of 'b01-node-2.corp.itpslab.local' shows in 'Warning State' (Yellow). I investigate by opening the 'Health Explorer' to determine if this 'Warning State' is associated with the Cluster Move just transacted.

Figure 30 - The steps to view the 'Health Explorer' for this Cluster Node include selecting the 'Computer Object' in the 'Computer View', 'Right Mouse Clicking' the Computer Object, selecting 'Open', then 'Health Explorer' from the Drop Down Menu.

Figure 31 - After a few minutes of observing the 2 Monitors showing 'Yellow Warning' and 'Red Critical' I surmise that neither Monitor is related to the prior transaction of Moving the Service from Cluster Node 1 (b01-node-1.corp.itpslab.local) to Cluster Node 2 (b01-node-2.corp.itpslab.local).

Figure 32 - I spend a few moments 'Resetting the Health' the 2 Monitors previously changing the 'Health State' of this Cluster Node and the 'Entity Health' returns to 'Green Healthy'. Summary - moving the Services from Cluster Node 1 (b01-node-1.corp.itpslab.local) to Cluster Node 2 (b01-node-2.corp.itpslab.local) had no observable effect on Health Explorer in the 'SC Operations Manager 2007 SP1 Console'. I did, however, observe and remedy 2 non-related conditions that changed the 'Entity Health' to a 'Red Critical' color.

Figure 33 - I move next to the 'Windows Cluster' Management Pack and select 'Windows 2008 Resource Group State' View. This View allows me to then select the Application Cluster (app-cluster-01.corp.itpslab.local) and the Resource Group for SQL 2008 Failover Clustering titled 'SQL Server (MSSQLSERVER)'. A 'Double Click' of the 'Resource Group Object' yields validation the associate between the Clustered Service (SQL Server (MSSQLSERVER)) and Cluster Node 2 (b01-node-2.corp.itpslab.local).

Figure 34 - Finally, I double check the 'Active Alerts' View in the 'SC Operations Manager 2007 SP1 Console' to validate no 'Alerts' are present. As the final action for this Blog entry I will review taking the 'Service Offline' and the response from the 'SC Operations Manager 2007 Console'.

Figure 35 - Selecting the 'SQL Server (MSSQLSERVER)' Service in the 'Failover Cluster Management Console' I select 'Take this Service or Application Offline' from the 'Actions Pane' (upper right corner). Again, I want to observe the response the 'SC Operations Manager 2007 SP1 Console' provides in response to this event.

Figure 36 - After the 'Please Confirm Action' dialogue windows pops up with selection choices, I select 'Take SQL Server (MSSQLSERVER) Offline'.

Figure 37 - I observe the 'Server Name', 'Disk Drives' and 'Other Resources' marked as 'Offline' in the 'Failover Cluster Management Console'. Next, I move the 'SC Operations Manager 2007 Console' to view the Alert Status.

Figure 38 - Selecting the 'Active Alerts View' in the 'SC Operations Manager 2007 SP1 Console' I observe a 'Critical Alert' with a 'Name' titled 'Cluster Resource Group Offline or Partially Offline' for 'app-cluster-01.corp.itpslab.local' (the SQL 2008 Failover Cluster Name). Also notice in the 'Alert Details' that 'SC Operations Manager 2007 SP1 Console' provides the ability to 'Bring Online' the Service using the 'Recovery' configured as part of the 'Microsoft Windows Cluster Management Pack' Monitor for this Alert.

Figure 39 - Next, I select the 'Windows 2008 Resource Group State View' in the 'Microsoft Windows Cluster Management Pack' in the 'SC Operations Manager 2007 SP1 Console'. As expected, a 'State' of 'Critical' is showing for 'app-cluster-01.corp.itpslab.local' for the 'Resource Group' titled 'SQL Server (MSSQLSERVER)'. Validation that SC Operations Manager 2007 SP1 incorporates detiled monitoring of Service Health as part of the 'Microsoft Windows Cluster Management Pack'.

Summary: In this Blog entry I review some of the Monitoring, Health Status Reporting and Alerting capabilities of using the Microsoft Windows Server and Microsoft Windows Cluster Management Packs to maintain a Windows Server 2008 Failover Cluster running SQL 2008 Failover Cluster Services. I offer details on how System Center Operations Manager 2007 SP1 provides a suitable Operational Management Platform for supporting Windows 2008 Failover Clustering and SQL 2008 Failover Clustering.

Free Video Lessons on Windows 2008 SP2 Failover Cluster Nodes for Highly Available File Services- http://www.exchangesummit.net

Lynn Lunik
Independent Security Consultant
Windows(R) Platform
IT Pro Secure Corporation
and
exchangesummit.net
http://itprosecure.com and http://www.exchangesummit.net
blog <at> itprosecure.com

Security Audit Events for Windows 2008 and Windows Vista

lynn lunik — Sat, 19 Apr 2008 09:39:00 GMT

I field numerous questions from Clients regarding Security Audit Event values when configuring Security Settings and SC Operations Manager 2007 Monitors and Rules. Finally, a single Worksheet has been generated by Microsoft which begins to document Security Audit Events instead of referencing 3 or 5 'Security Guides' that partially reference specific Audit Event values.

Several observations regarding this Security Audit Event Worksheet are appealing. Specifically, the ability to use the Excel Worksheet 'Data Filter' capability to isolate a single Event ID by Number. Also, when writing detailing SCOM2k7 Monitors we can focus on generating a legible Event Description detail. If you have not seen the complete listing of Windows 2008 Materials from Microsoft Press you will find a searchable list here.

Security Audit Events for Windows 2008 and Windows Vista

The Security Audit Event Worksheet displays Events by Category, Sub-Category, Event ID, Message Summary and Minimum Operating System.

The 'Complete Event Message' Tab details reference detail useful when generating SCOM2k7 Monitors.

Lynn Lunik
Independent Security Consultant
Windows(R) Platform
IT Pro Secure Corporation
and
exchangesummit.net
http://itprosecure.com and http://www.exchangesummit.net
blog <at> itprosecure.com

Search results matching tags 'SC Operations Manager 2007' and 'Windows 2008'

Windows 2008 Failover Clustering: Using the Windows Server and Windows Cluster Management Pack in Operations Manager 2007 SP1 to Monitor Failover Clustering

Security Audit Events for Windows 2008 and Windows Vista