MOM Management Packs

To intelligently filter and analyze the event and performance data that has been collected, Microsoft Operations Manager 2005 requires an understanding of the system or application being monitored. This knowledge is transferred to Microsoft Operations Manager 2005 via the installation of a Microsoft Operations Manager 2005 Management Pack for each of the applications being monitored. Microsoft has a policy to produce Management Packs for all its enterprise products and has produced a Management Pack for Windows SharePoint Services 3.0, plus another to monitor the additional capabilities that SharePoint Server 2007 provides.

Many third-party software and hardware vendors have produced Microsoft Operations Manager 2005 Management Packs for their own products. Management packs can also be customized, extended, or created from scratch by users to tailor monitoring to their own unique scenarios. In the following sections, we'll discuss each of the key components of a Management Pack.

Rules

A Management Pack contains a collection of rules that define which events and performance counters are most relevant to monitor for a given application. These rules filter out the unimportant information and bring out the most valuable and actionable data points. There are three types of rules: Event Rules, Alert Rules, and Performance Rules.

• Event Rules Event Rules define how Microsoft Operations Manager 2005 should react to events that have been logged on managed computers. For example, if an event occurs that matches a set of criteria, it might be appropriate to display an alert in the Operator Console; ignore the event as unimportant; or display a warning only if the event occurs multiple times. If an expected event is missing and does not occur at all, this might also be important to capture. Event Rules and Alert Rules can also generate alerts if a series of related events occurs over a period of time that, if taken together as a group, has a greater significance than each event individually.

• Alert Rules Alert Rules can be useful to ensure that the operator's attention is drawn to the most important events. Alert Rules can scan or filter the alerts that are being generated by the Event Rules, and they can perform a specific action only if, for example, a critical alert has been sent. The Alert Rule could, for example, send an e-mail message to a specific operator to ensure the operator sees the alert quickly.

• Performance Rules Performance Rules monitor performance counters and generate alerts if threshold values are exceeded. Additionally, they can collect data for historical performance reporting and analysis.

Alerts

Alerts are generated when a rule recognizes an event occurring that requires either the attention of an administrator or an automated task to be executed to resolve the problem. An alert can be sent to the administrator via a number of channels, including the Operator Console, an e-mail, or a message sent to a pager or similar device, depending on the nature of the emergency.

Knowledge

In addition to alerts or warnings about an impending problem or failure, the Management Packs allow Microsoft Operations Manager 2005 to serve up guidance about probable causes, possible solutions, and best practices written by the Microsoft product teams to help resolve the problem. This provides operators with a detailed understanding of system status from across their IT environment, and it assists with both reactive and proactive maintenance. Once the IT staff gains experience with the issues or problems they commonly encounter in their own IT environments, they can extend the Management Pack knowledge with advice specific to their enterprise.

Tasks

Tasks provide a way to execute commands from the Microsoft Operations Manager 2005 central console that take effect on the remote server being monitored. This allows Microsoft Operations Manager 2005 operators to immediately take action in response to an event without needing to visit the remote server separately. The Management Pack defines which tasks are most appropriate for the target managed computer.

Views

Views provide a filtered, targeted selection of the event and performance data from the monitored servers, enabling administrators to quickly understand the health of servers or server groups.

Note 

Regardless of the size of your enterprise, it is important to plan a deployment of Microsoft Operations Manager 2005 in advance. For further resources to assist with planning a Microsoft Operations Manager 2005 deployment, visit the Microsoft Microsoft Operations Manager 2005 Web site at http://www.microsoft.com/mom.