Configure the SCOM Connector

The SCOM Connector establishes communication between the SCOM server and the SCOM integration in Moogsoft AIOps.

The Connector performs the following actions:

  • Collects data: Retrieves events and alerts from an entity on a time schedule you define. For example, every 60 seconds.

  • Normalizes data: Formats, cleanses, filters, and normalizes the data it retrieves and turns it into an event.

  • Emits events: Sends the normalized event to the SCOM LAM.

  • Updates the source: Moogsoft AIOps can update an entity with information it collects from SCOM. If you want to close the entity, you can send the Microsoft SolutionPak with Moogsoft AIOps a message to indicate you are changing the status of an alert within SCOM from "Resolved" to "Closed".

Process Workflow

To gather alarms from a SCOM server and publish them to Moogsoft AIOps, the SCOM Connector performs the following:

  1. Reads the SCOMConnectorConfig.json file and uses the configuration to connect with the SCOM server.

  2. Retrieves new or updated events/alerts from the SCOM server.

  3. Parses the event/alert data into a JSON object.

  4. Sends the JSON data to the SCOM LAM, which publishes the alert/events to Moogsoft AIOps.

  5. Accepts an HTTP POST request from the moobot regarding the status change in events/alerts.

  6. Updates the event/alert status on the SCOM server.

Before You Begin

The SCOM Connector has been validated with SCOM 2012, SCOM 2016, and SCOM 2019. Before you install and configure the connector, ensure you have met the following requirements:

  • You have enabled Internet Information Services 6.0 or later to view the Status GUI.

  • You have Administrator privileges to the SCOM server.

  • You have uninstalled any versions of the SCOM Connector you had previously installed.

  • You have opened a port for the SCOM Connector to receive connections from Moogsoft AIOps. You use this port to configure the Connector URL. The default is 8085.

  • You have opened ports 5723 and 5724 for the SCOM server to receive connections from the SCOM Connector.

  • If communications between the SCOM Server and Moogsoft AIOps the server must pass through a proxy, ensure you know the proxy details including IP address, port, and required user credentials.

If you are configuring a distributed deployment refer to Configure SCOM for HA first. You will need the details of the server configuration you are going to use for HA.

Install the SCOM Connector

See Microsoft SCOM for instructions on how to download and install the connector on your SCOM server.

Note that if you want to install multiple SCOM connectors, you must point each of them to a different management group.

Edit the configuration file

Edit SCOMConnectorConfig.json to control the behavior of the SCOM Connector. You can find the file in the SCOM connector directory you have downloaded.

Some properties in the file are commented out by default. Before making any changes to the file, stop the service of the SCOM Connector you want to configure. After saving the changes, allow 3-4 minutes before restarting.

The configuration file consists of the following sections:

  • SCOM Servers: Details of the SCOM Servers you added during installation in this section.

  • Moog Servers: Details of the Moog Servers you added during the installation and any proxies you have configured in this section.

  • Other configurations: All of the other configurations are here. Some configurations are only for informational purposes and we do not recommend changing them.

    The configurable properties are as follows:

    Property

    Description

    AlertPollCycleTime

    The time period for polling the SCOM Connector to fetch alerts from SCOM. Defaults to 45 seconds.

    In case of a long communication failure, the SCOM Connector will fetch alerts only up to 10 times this property's value, as long as the duration from the last poll time is greater than 10 times the property's value.

    IsActiveEventPolling

    Determines whether the SCOM Connector fetches events. Defaults to False.

    EventPollCycleTime

    Time period for polling the SCOM Connector to fetch events from SCOM. Defaults to 45 seconds. The last poll time on which the SCOM Connector polled the SCOM Server is stored in SCOMConnectorInstaller/Configs/SCOMLastPollTime.json. After a communication failure, the SCOM Connector resumes fetching events from the last poll time saved in this file.

    AmountOfTimeouts

    The number of attempts to try to reconnect with the SCOM Servers after a timeout. If set to -1, the SCOM Connector continuously retries to connect with your SCOM servers. Entering a positive integer causes the SCOM Connector to make the specified number of attempts, and if it is unsuccessful in reconnecting, an alert is sent to Moogsoft AIOps.

    LowerTimeoutBound, and

    The period, in seconds, after which to begin an attempt to reconnect.

    UpperTimeoutBound

    The period, in seconds, after which an attempt to reconnect ends.

    Connector Name

    Name of the connector service.

    ConnectorDescription

    Description of the connector service.

    ConnectorDisplayName

    Display name of the connector service.

    MaxPollRetryAttempt

    Number of retry attempts when the SCOM Connector fails to poll data from the SCOM Server..

    WinAuthOverrid

    Determines whether to enable Windows authentication for accessing the SCOM Server. If the SCOM and SCOM Connector are on the same machine, setting this to True overrides Windows Authentication. Defaults to False.

    AuthTokenRequired

    Determines whether an authentication token is required for SSL.

    AuthTokenCode

    The authentication token to apply in the body. Only configure this if you have configured your SCOM LAM with an auth_token.

    Version

    The version of the installed SCOM Connector.

    MaxPayloadSizeInMB

    Alerts are sent in batches. This value represents the maximum payload size the Connector can send to Moogsoft AIOps; this should match your Nginx configuration. By default, Nginx has a client_max_body_size of 1mb.

    PollCriteriaDateFormat

    Time format to use for polling data from the API. Moogsoft recommends setting this value to "dd/MM/yyyy HH:mm:ss".

    IsPrimary, SCOMConnectorRestUrl and SiblingConnectorUrl

    For informational purposes only; do not edit.

Example

An example SCOM Connector configuration is as follows:

{ "ScomServers": [ 
        { 
                "ScomAddressHost": "WIN-9R4CQNMLGCS", 
                "Domain": "moogsoftadmin.com", 
                "UserId": "administrator", 
                "Password": "5wZmZrCfMPH2PJ5/gQmFLg==", 
                "Guid": "4271cd94-b7c8-4385-8cdb-be2aa7b954e0", 
                "Priority": 1 
        } ], 
        "MoogServers": [ 
        { 
                "MoogUrl": "https://mandeepmoog63/events/scom_lam_microsoftscom1", 
                "MoogIp": "", 
                "MoogPort": "", 
                "MoogAddressDisplay": "https://mandeepmoog63/events/scom_lam_microsoftscom1", 
                "MoogPublicKey": "C:\\server.crt", 
                "IsSslEnabled": true, 
                "IsProxyRequired": false, 
                "ProxyUsername": "", 
                "ProxyPassword": "", 
                "MoogProxyIP": "", 
                "MoogProxyPort": "", 
                "Url": "", 
                "IsConnected": false 
        }, 
        { 
                "MoogUrl": "", 
                "MoogIp": "10.142.24.82", 
                "MoogPort": "48003", 
                "MoogAddressDisplay": "10.142.24.82:48003", 
                "MoogPublicKey": "C:\\server.crt", 
                "IsSslEnabled": true, 
                "IsProxyRequired": true, 
                "ProxyUsername": "proxy", 
                "ProxyPassword": "MIg1FG7XrUWys9N/FSgQQQ==", 
                "MoogProxyIP": "10.142.24.92", 
                "MoogProxyPort": "808", 
                "Url": "", "IsConnected": false 
        } ], 
        "IsPrimary": true, 
        "SCOMConnectorRestUrl": "http://10.142.24.165:2373", 
        "SiblingConnectorUrl": "http://10.142.24.164:2373", 
        "IsActiveAlertPolling": true, 
        "AlertPollCycleTime": 45, 
        "IsActiveEventPolling": false, 
        "EventPollCycleTime": 45, 
        "AmountOfTimeouts": -1, 
        "LowerTimeoutBound": 10, 
        "UpperTimeoutBound": 360, 
        "ConnectorName": "SCOMConnectorv5", 
        "ConnectorDescription": "SCOM Connector", 
        "ConnectorDisplayName": "SCOMConnectorv5", 
        "HAServiceName": "SCOMConnectorha", 
        "MaxPollRetryAttempt": 3, 
        "WinAuthOverride": false, 
        "AuthTokenRequired": false, 
        "AuthTokenCode": "", 
        "Version": "4.3 (Advanced)",
        "MaxPayloadSizeInMB": 10.0, 
        "PollCriteriaDateFormat": "MM/dd/yyyy HH:mm:ss" 
}

Upgrade the SCOM Connector

To upgrade the SCOM connector to the latest version:

  1. Take a backup of the following SCOM configuration files:

    • SCOMConnectorInstaller/Configs/SCOMConnectorConfig.json.

    • SCOMConnectorInstaller/SCOMConnector.exe.config.

    Additionally, if you have configured the SCOM Connector for high availability, take a backup of these files:

    • SCOMConnectorInstaller/Configs/MCMServiceConfig.json. You must save this file on both the machines where the Primary and the Secondary SCOM Connectors are installed.

    • SCOMConnectorInstaller/Configs/MCMService.exe.config. You must save this file on both the machines where the Primary and the Secondary SCOM Connectors are installed.

  2. Uninstall the existing connector using the UninstallSCOMConnector utility.

  3. Delete the SCOMConnectorInstaller folder or copy it to another location.

  4. Unzip the new release of the SCOMConnectorInstaller folder.

  5. Install the connector using the installer from the newly delivered connector installer folder.

  6. Host the status page from the newly delivered connector installer folder. See the 'Host the Status Page on IIS' section below for details.

  7. If you need to make any configuration changes, edit the newly created configuration file. You can refer to the backed up configuration file, but do not replace the newly created configuration file with it.

Host the Status Page on IIS

The status page displays status information for the SCOM Connector, SCOM Server, and the SCOM LAM. If you have installed multiple connectors, you need to host separate status pages for each of them.

See the IIS documentation for information on IIS components.

  1. Navigate to ScomConnectorInstaller\WebUI\Index.html and change the REST server's port from 8085 to the port given in the Connector URL field of the installer.

  2. Create a virtual directory in IIS Manager and create an Alias field with a name for the status page.

  3. Set the Physical Path to the WebUI folder, appending an extra "\" to the end of the path.

  4. You can now open the virtual directory you have created to view the status page.

View the statuses

The Status page displays the following information:

  • The number of events and alerts the SCOM Connector has processed and sent to Moogsoft AIOps is shown in the Total Alerts Processed field.

  • The status of the connected Moogsoft AIOps SCOM LAMs is shown in the MOOG Server Status section.

  • The status of the SCOM Server currently fetching events from the SCOM Connector (typically the server with the highest priority) is shown in the SCOM Server Status section.

You can also open this page by entering http://localhost/<aliasname> in a browser on the machine where the SCOM Connector is installed. If you have administrative privileges, you can also open the page in the same domain as the SCOM server and connector.

Configure the Moogsoft AIOps Moobot

The Moobot sends the update about the status change in alerts/events to the SCOM Connector. The SCOM Connector then updates the changes to alerts/events on SCOM server.

  1. In $MOOGSOFT_HOME/config/moolets/alert_manager.conf, configure these properties as follows:

    {
        name                : "AlertMgr",
        classname           : "CEmptyMoolet",
        run_on_startup      : true,
        persist_state       : false,
        metric_path_moolet  : false,
        standalone_moolet   : true,
        moobot              : "AlertMgr.js",                
        event_handlers      : [ "AlertClose" ]
    }
  2. In $MOOGSOFT_HOME/bots/moobots/AlertMgr.js, configure the closeAlert and updateCustomInfo functions as follows:

    function closeAlert(alert)
    {
        var NAME = MOOBOT_NAME + "closeAlert::";
    
        //
        // Post change to remote service
        //
        if (alert.evaluateFilter("agent == 'SCOM'")) {
            var alertId = alert.value("alert_id");
            var customInfo = alert.getCustomInfo();
            var scom_connector = customInfo.MoogConnector.ConnectorAddress;
            var url = scom_connector + "/event_post/";
            var uuid = alert.value("external_id");
    
            var payload =
            {
                 id: uuid,
                 externalId: alert.value("agent_location"),
                 description: alert.value("description"),
                 detail: 'Closed'
            };
    
            var rc = rest.sendPost(url, JSON.stringify(payload));
    
            if (rc && rc.success) {
                logger.debug(NAME + "SCOM Connector - "+ scom_connector +" - accepted resolution request for alert " + alertId + " with uuid " + uuid );
                updateCustomInfo(alert, "successful");
            } else {
                logger.warning(NAME + "SCOM Connector - "+ scom_connector +" - rejected the resolution request for alert " + alertId  + " with uuid " + uuid );
                logger.warning(NAME + "SCOM Connector response for uuid " + uuid + " : " + JSON.stringify(rc.response));
                updateCustomInfo(alert, "failed");
            }
        }
    }
    
    function updateCustomInfo(alert,status) 
    {    
        // Update custom_info with relevant data.     
        var customInfo = {};     
        customInfo.closedAtSource = status;            
        moogdb.setAlertCustomInfo(alert.value("alert_id"),customInfo,true);
    }
  3. Open $MOOGSOFT_HOME/config/moog_farmd.conf and add the following property:

    include    :    "alert_manager.conf"
  4. Restart Moogfarmd:

    service moogfarmd restart

Configure SCOM Connector logging

You can configure the SCOM Connector logging in the SCOMConnector.exe.config file. Before making any changes, stop the SCOM Connector service. After saving the changes, allow 3-4 minutes before restarting the service.

The table below describes the configurable properties in the SCOMConnector.exe.config file.

Field

Description

Logging type

  • The file logging setting is in the <appender name="RollingFileAppender" type="log4net.Appender.RollingFileAppender"> section. Defaults to enabled.

  • The event logging setting is in the <appender name="EventLogAppender" type="log4net.Appender.EventLogAppender" > section. Defaults to enabled.

Logging Level

  • Navigate to the <filter> section of the file logging and event logging to configure the logging level.

  • Use <levelMin value= ""/> and <levelMax ""value=/> to set the levels, placing one of the following values within each tag: OFF, FATAL, ERROR, WARN, INFO, DEBUG, ALL.

  • The values entered here include messages from all the log levels, from the defined min level to the defined max level.

  • If OFF is entered in <levelMin value= ""/>, then no log messages will be added to log.

  • if ALL is entered in <levelMin value= ""/>, then the messages from all the log levels will be added in the log.

Start the Connector in Maintenance Mode

In Maintenance Mode, the Primary Connector is manually stopped for maintenance and the communication is handled by the Secondary Connector. After maintenance, the Primary connector starts and takes over the communication automatically.

To start the Connector in Maintenance Mode, enter the following into your browser, where <SecondaryConnectorIP> is the IP address of your secondary SCOM Connector:

http://<SecondaryConnectorIP>:port/set_isolation_mode/