How to create SNMP Probe Based Two-State Monitor in SCOM?

Let’s say for example that you need to monitor value of specific performance counter on SNMP-enabled device and raise an Alert when it is above the configured threshold. In order to do that, SNMP Probe Based Monitor should be used.

To create such monitor, procedure is pretty straightforward. Click on the Authoring tab in the Operations Console, and open Monitors in the Navigation Pane. After that, open Actions -> Monitor -> Create a Monitor -> Unit Monitor -> SNMP -> Probe Based Detection -> Simple Event Detection -> Event Monitor – Single Event and Single Event.

I will not go into more details on how to create the monitor. Just follow the Create a unit monitor wizard and make sure that the appropriate community string and the object identifier (OID) is entered, as well as expressions for the unhealthy/healthy conditions.

Once you have finished the wizard and successfully created the monitor, you might notice that it doesn’t work as expected.

By default, Create a unit monitor wizard creates SNMP Probe Based Monitor which treats any collected value as string. As a result, an Alert is raised even in conditions when value is actually below the configured threshold. This is because result of string comparison differs from the comparison of numeric values. To give you an example, if you have configured monitor to raise an Alert when the collected value is greater than “30” (numeric), an Alert will also be raised if the collected value is “4”,”5”,”6”, etc. String value of “4” is greater than string value of “30” which is not the case with numeric values.

Problem resolution

In order to solve this problem, you need to dive into XML. In XML editor (XML Notepad for example), open the Management Pack in which SNMP Probe Based Monitor is stored.

Look after the text similar to the following:

<FirstExpression>

            <SimpleExpression>

              <ValueExpression>

                <XPathQuery Type=”String”>/DataItem/SnmpVarBinds/SnmpVarBind[1]/Value</XPathQuery>

              </ValueExpression>

              <Operator>Greater</Operator>

              <ValueExpression>

                <Value Type=”String”>30</Value>

              </ValueExpression>

            </SimpleExpression>

</FirstExpression>

… and replace the XPathQuery Type and Value Type to the appropriate data type. In our case, it is Integer:

<FirstExpression>

            <SimpleExpression>

              <ValueExpression>

                <XPathQuery Type=”Integer”>/DataItem/SnmpVarBinds/SnmpVarBind[1]/Value</XPathQuery>

              </ValueExpression>

              <Operator>Greater</Operator>

              <ValueExpression>

                <Value Type=”Integer”>30</Value>

              </ValueExpression>

            </SimpleExpression>

</FirstExpression>

 

Don’t forget to perform the same change for the <SecondExpression> definition also.

Save changes in XML file and import the Management Pack into the SCOM.

For more information about the ExpressionType and data types used in Operations Manager, refer to the following article: http://msdn.microsoft.com/en-us/library/ee692979.aspx