Find which MOM rules use a script.

In MOM 2000 there is no ability to quickly find which rules use the script.

I found a script in MOM/Rules/Advanced/Scripts/  ( or alternatively in DB one point Script table) and my question was which rules run the script.

Use [OnePoint].[dbo].[ProcessRuleToScript] table to find the rules.

 

select * from [OnePoint].[dbo].[ProcessRuleToScript]

where Idscript=‘5c4a58cf-709c-4a1f-895a-0aec79ff55a9′(this GUID is just example)

 

select * from [OnePoint].[dbo].[ProcessRule]

where idProcessRule in

(

select idProcessRule from [OnePoint].[dbo].[ProcessRuleToScript]

where Idscript=‘5c4a58cf-709c-4a1f-895a-0aec79ff55a9’

)

The SQL gives names of rules, but I wasn’t able to find where ProcessingRulePath is stored, so I had to manually expand rules tree to find rules in MOM MMC console

MOM error- “BounceService: Service start of OnePoint failed. Error: 10”

Today our MOM 2000  stopped working. Looking on MOM Esrver local eventlog we found that every few minutes OnePoint  starts , than we have message “BounceService: Service start of OnePoint failed. Error: 10” and it stops.

Attempt to start OnePoint manually didn’t succeeded.
I was able to find workaround based on info from article http://www.huntland.co.uk/Downloads/MOM/ServiceBounceAsync.html

To start OnePoint service I had to disable rule for “Agents Consolidators or Data Access Servers”
(full path is Microsoft Operations Manager/Rules/Processing Rules Groups/Microsoft Operations Manager/Agents Consolidators or Data Access Servers/Performance Processing Rules/OnePoint service handle count > 10,000 (handle leak) – Bounce Service)
and rule for “Consolidator”
(full path is Microsoft Operations Manager/Rules/Processing Rules Groups/Microsoft Operations Manager/Consolidator/
Threshold Process-Private Bytes-OnePointService Consolidator – Bounce Service)
 
We will need to enabled them later and see what happened.

MOM Notes

We are  using MOM 2000 for monitoring the application.

Below are a few links that I found useful :
How to delete orphaned server/s records from “OnePoint” Database in particular shows that in OnePoint
 database Event.idGeneratedBy =computer.idComputer  , which is useful for queries per computer.

We periodically have a long delay(sometimes up to 30 min) before events from computers appear in MOM.
I noticed that delay disappeared after a message “A rule has generated 50 alerts in the last 60 seconds… In order to avoid excessive load on the consolidator, this rule will be temporarily disabled”. 

Event Type: Warning
Event Source: OnePoint Operations
Event Category: None
Event ID: 21251
Date:  10/12/2007
Time:  11:47:02 PM
Description:
A rule has generated 50 alerts in the last 60 seconds.  Usually, when a rule generates this many alerts, it is because the rule definition is misconfigured.  Please examine the rule for errors, and also consider creating an event consolidation rule for events that may match the rule.

In order to avoid excessive load on the consolidator, this rule will be temporarily disabled until 10/12/2007 23:57:02.

Rule description:
Rule Id:      {05ED1868-F50D-11D3-AB6D-0090275A4C62}
Group Id:     {064902E1-AA35-4B79-987D-4748E59FF534}
Name:         Operations agent attempted to process responses
Provider Id:  {F6DA1507-12AF-11D3-AB21-00A0C98620CE}
Provider: Application
Criteria:
Event Number == 21252
Source Name == OnePoint Operations
Type:         Event Processing Rule

 MOM 2000 Generates Numerous Entries About Event ID 21252 suggests to find a rule by using search within the MOM Administrator Console to find the rule that is generating the events  or use SQL, e.g.
   Select * from processrule where idprocessrule=’05ED1868-F50D-11D3-AB6D-0090275A4C62′

Search showed that the rules is located under “Microsoft Operations ManagerAgents, Consolidators, or Data Access Servers”.

There are other related links that I used to investigate delay

Suppression of 25261 errors – exposed under: Information Services/Internet Information Services 6.0/Core Services/World
Wide Web Pulishing Service\Event Rules All HTTP 400 errors 

MOM Event ID’s 22061 and 22062

How to check for an event storm by using MOM 2005 Reporting

The Consolidator’s incoming communications queue is full.  

OnePoint Free Data Space Percentage thread suggests to shorten your periods between grooming intervals.You’ll find this in the Global Settings of the MOM Administrator Console.