Archive for the ‘MP Authoring’ Category

MP University Webinar

July 10, 2015 Leave a comment

If you are into MP authoring, want to learn more about MP authoring, I would highly recommend signing up and attending this webinar! Some of the best minds at MP authoring will be showing how they author management packs. MP University Wed August 12, 8am to 3 pm central. There are only 100 slots so sign up now! (not sure if this link will work or not)


Below is text I totally stole from about the event as well as bios on the folks that will be presenting.


Please join the SCOM gurus from Infront Consulting Group, Silect Software, and Microsoft on August 12, for a FREE full day event on authoring Management Packs.

View the invitation here, and if you register before July 14, you will be entered into the draw twice.

Our speakers come with extensive knowledge and experience in the IT field.

Brian Wren

Brian Wren

Brian Wren worked at Microsoft Consulting Services for 13 years specializing in management technologies including designing and building management packs for a variety of customers.  For the last five years, he has worked with the documentation team at Microsoft completing the Management Pack Authoring Guide, Management Pack Development training on Microsoft Virtual Academy, and various samples in the TechNet Gallery.  He can be reached at bwren@microsoft.comand on Twitter

Freddy Mora Silva

Freddy Mora Silva

Freddy Mora Silva is Senior Software Developer at Infront Consulting Group, a global IT consulting firm specializing in the System Center suite of technologies, responsible for designing and developing SCOM Management Packs for diverse monitoring scenarios, which also includes customs reports.

Freddy is an accomplished software developer professional with more than 25 years of experience in this area, specializing in object-oriented programming, design and analysis with extensive experience in software design including requirement definition, prototyping, proof of concept, design, interface implementation, testing and upgrading maintenance.

Before joining Infront in January of 2015, Freddy worked as a Microsoft vendor, for seven years, where he collaborated in most of Microsoft’s different technologies and core Management Packs, from the 2007 versions and onward.

You can check his blog posts here:

Freddy completed a Business Administration Degree in an Ecuadorian University, and was always interested in the technology field, thus he decided to acquire knowledge by following courses and practices up to a professional level that allow him to deliver top notch quality products during his career.

In his free time, Freddy enjoys attending to soccer games and traveling with his family.

Mike Sargent

Mike Sargent is a Senior Developer with Silect Software.  Over the past 12 years Mike has been involved in developing MP Studio and MP Author, amongst other special projects.

Kevin Holman

Kevin Holman

Kevin is currently a Dedicated Premier Field Engineer with Microsoft, supporting System Center Operations Manager for our largest enterprise clients.  He has also held roles in the Microsoft sales organization, as a Technical Specialist in Windows Server and System Center.   He has been in the technology industry for 20 years, previous to Microsoft as a Platforms Engineer for EDS (now HP) in Plano, TX.   He is very active in the OpsMgr community, both online and in local System Center users groups, and he recently completed being the Technical Editor for the SCOM 2012 Unleashed Book.  He also maintains the most read System Center blog on, at  He currently lives with his wife and newborn twins in Allen, TX.

Jonathan Almquist

Jonathan Almquist

Jonathan Almquist is a Principal Consultant with Infront Consulting Group. He has worked in the IT industry since the late 90’s, with a primary focus on the Operations Manager product since 2005. Jonathan has provided consulting services to many well known fortune 500 companies, serving in all areas of infrastructure design and implementation, to development and integration projects. In his free time, he enjoys cycling and spending time with his two sons.


Event Parameters refresher

October 2, 2013 1 comment

Well I’ve finally had the opportunity to use Event parameters in a MP, and it was quite easy. The request was to send an alert when a specific statement was written to an event log event description. Using these two resources it was quite easy, Kevin Holman’s article on this a few years ago, and Stefan Stranger’s article. One bump I ran into was using LogParser Tool on an event log that was not one of the standard 3 event logs (i.e. Security, Application, System) It was a log several deep in the UI. I was not sure how to tell LogParser to get this log, so I worked around this problem by exporting the specific event log I wanted to query, to a file, and just queried the file. Worked like a champ.

I also found an interesting way to get event parameters using PowerShell on Jonathan Horner’s bog.

When Is an event source not the right source?

August 8, 2013 1 comment

Lets face it, if you have been an Operations Manager Admin for longer than a few months you have made your fair share of Event related Alerting. The monotony in creating another batch of said rules started to creep in on me yesterday when something very unusual happened, and it did not work. I was asked to create a rule to alert on the following event in event viewer. Screen shot is from my lab system.


The specifics of this System Log Event are in a screen shot above. Needless to say this is an important event to look for. So I am looking at the System Log for Event ID 1020 with a source of DHCP-Server. To dispense with the issue post hast, I create the rule in the OpsMgr Authoring tab so that Management will be happy the problem is taken care of and I can go back later and create the rule using the normal Authoring tools so I can see a nice rule name and not the ugly GUID name that the console makes.

It seems that this event is created every hour, by the DHCP Service, not sure why every hour, but it is what it is, so I create the rule, and continue working on other issues till the hour passes, and the event is written but no alert is generated.  How odd, the other three rules I had just made before that one had worked flawlessly, what’s going on? So I get a dump of rules that are running on the DHCP server to make sure the rule made it to the server, and it is there. The next thing I check is making sure everything in the rule is correct, Event ID number is 1020, the Source is DHCP-Server. Well everything looks good, perhaps the agent was taking a nap, and I have the agent restarted, and the agent cache cleared, to make sure that everything is loaded and good to go for the next hour. The next hour the same results. Now its officially lab time, to see what the hell is going on.

Cutting to the chase, as I recreated the rule in the lab and did the same things above in my lab till I finally looked at the Event closer. I copy the text of the event from event viewer and paste it into notepad so I can get a better look at what is truly in the event. Right after I hit paste, I notice that something looks very different with the source name.



DHCP-Server shown in event viewer does not equal Microsoft-Windows-DHCP-Server what is in the event log details.


I change the rule and the next hour when the event fires off the alert showed up in the console. The intention of this post is to help save others time.