Collecting Windows process performance counters using SCOM 2007 R2

I’ve been working on collecting the processor and memory usage of particular processes; namely IIS worker processes and bespoke application processes using SCOM. Below is a copy of the scripts i’ve knocked up and how to implement them in SCOM.

How it works

Application monitoring

The script accepts the following arguments: applications executable path, additional argument and resource threshold e.g 90 would indicate 90% CPU.

The first argument is used to get the process id of that particular process; the process id is used to get the processor and memory utilisation of that process. The script takes 3 samples, 15 seconds apart, then takes the average. This value is passed back to SCOM for performance graphing.

Application Pool monitoring

The script accepts the following arguments: application pool name and the resource threshold.

The application pool name in my implementation is passed to the script by SCOM using the IIS management pack application pool target properties. The sampling of the performance data is done in the same way as above.

Scripts

A copy of the script that captures application processes can be found: Processor script: here (you’ll need change the extension to test it or just copy and paste it into the SCOM rule wizard) (updated: 23/01/2013 redefined wql query to be more focused) and memory script: here.

A copy of the script that captures application pool processes can be found: here (you’ll need change the extension to test it or just copy and paste it into the SCOM rule wizard)

SCOM

To utilise these scripts within SCOM follow the steps below:

Application monitoring

  • Create a management pack; I went for:
CompanyName.Application.Monitoring
  • Create a group for a one or more computers (this is more important for the application monitoring than the application pool monitoring; application pool monitoring is scoped by SCOM.)
  • Get the command line path for the process you wish to monitor;
wmic process get commandline, name | clip
  • Open the SCOM operations manager console
    • authoring
      • rules
right click 'create a new rule'
  • Select probe based
script [performance]
  • Destination management pack:
'the one you created in the first step'
  • Next
  • Name the rule:
'Collect [component] utilisation of [application]'
  • Rule Category:
'Performance Collection'
  • Rule target:
'Windows Computer'
  • Rule is enabled:
'uncheck'
  • Next
  • Schedule:
'leave at 15 minutes'
  • script
    • filename:
    '[name of the script.vbs]'
    • Timeout: [how long should it run in BAU]
    • Script: [copy and paste from: here or here]
    • Parameters:
Command line path of the application; you collected this in
the third step and the component threshold e.g. 128
equals 128MB
  • Next
  • Object:
MyCustomPerformanceCounters
  • Counter:
[the one you're collecting in the script e.g. WorkingSet | PrivateBytes]
  • Instance:
I've gone for the name of the application here
  • Value:
$Data/Property[@Name='<you pass this to the property bag in your script>']$
  • Create
  • The rule has been created in a disabled state; i’d recommend you create a group as per step 2 and add the computer or computers which the process you’re monitoring is installed on. Then create an override for the group you’ve created; in the override enable the rule.
  • To view the rules output, create a performance view that is scoped to the object: MyCustomPerformanceCounters.

Application Pool monitoring

  1. Create a management pack; I went for
CompanyName.ApplicationPool.Monitoring
  • Create a group if you want to scope the application pool monitoring to a particular group of servers
  • Open the SCOM operations manager console
    • authoring
      1. rules
        • right click
'create a new rule'
  • Select probe based
script [performance]
  • Destination management pack:
'the one you created in step 1'
  • Next
  • Name the rule:
'Collect [component] utilisation of [application pool]'
  • Rule Category:
'Performance Collection'
  • Rule target:
'IIS 2003 Application Pool or IIS 7 Application Pool '
  • Rule is enabled:
'uncheck' you may want to leave this checked
if you plan to monitor every application pool in your environment
  • Next
  • Schedule:
'leave at 15 minutes'
  • script
    • filename:
    '[name of the script.vbs]'
    • Timeout: [how long should it run in BAU]
    • Script: [copy and paste from: here]
    • Parameters:
$Target/Property[Type="MicrosoftWindowsInternetInformationServices
CommonLibrary6066580Microsoft.Windows.InternetInformationServices.
ApplicationPool"]/PoolID$ Component threshold e.g. 128 equals 128MB
  • Next
  • Object:
MyCustomPerformanceCounters
  • Counter:
[the one you're collecting in the script e.g. WorkingSet]
  • Instance:
$Target/Property[Type="MicrosoftWindowsInternetInformationServices
CommonLibrary6066580!Microsoft.Windows.InternetInformationServices.
ApplicationPool"]/PoolID$
  • Value:
$Data/Property[@Name='<you pass this to the property bag in your script>']$
  • Create
  • If you created the rule in a disabled state you need to create an override as per step 6 above.
  • To view the rules output, create a performance view that is scoped to the object: MyCustomPerformanceCounters.

2 comments

  1. LeITchronicle Admin

    Hi,
    First of all, Many Kudos and Thanks for this great post,
    I was wondering if this will be useful for me to use, i’m hoping this would allow me to forgo monitoring of each w3wp.exe instance (who are multiple in my environment) and instead focus on getting data for the named app pools, i’m also trying to adapt the “GetAppPoolResourceUsage” script to obtain “HandleCount” and a multitude of other counters, if i understand the script, all i need to do is change the name of the performance counter i want and the threshold logic in the following part (starts at line 42):

    For Each oPerformanceCounter in arrPerformanceCounterCollection
    If oPerformanceCounter.IDProcess = oProcess.ProcessID Then
    For iIncrement = 0 to iPerformanceCaptures
    oRefresher.Refresh ‘Refresh the counter values in the
    iCPUTotalAveraged=CInt(iCPUTotalAveraged)+CInt(oPerformanceCounter.PercentProcessorTime) ‘Amount of CPU time used by the process
    If iIncrement < 2 Then
    wscript.sleep 60000 'Sixty seconds
    End If
    Next
    End If
    "

    right?

  2. heathen1878

    Hello,

    It is a while since I’ve looked at that script, my comments in the script are rubbish but yes the oPerformanceCounter object references the Win32_PerfFormattedData_PerfProc_Process class so any properties within that class can be referenced.

    The threshold data is passed in via SCOM when the rule runs.

    Hope that helps

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Google photo

You are commenting using your Google account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s

This site uses Akismet to reduce spam. Learn how your comment data is processed.