Create Linux VM Using Powershell in Azure

Create Linux VM Using Powershell in Azure

• Azure is the leading Cloud Platform today.
• Lot of Customers are having a Hybrid setup with Cloud.
• So With power shell now so famous lot of companies have deployed Azure CLI 2.0 to extend thier powershell skill in Cloud.
• In Order to Create a Linux VM in cloud using powershell and CLI2.0 installed on you system use this command

az vm create -n LINUX01 -g LinuxGroup --image UbuntuLTS

• This will create the Linux Machine called "LINUX01" with Ubuntu OS

Connect to Specific Azure Subscription using Powershell

Connect to Specific Azure Subscription using Powershell

• Organizations have mutiple Subscriptions, One for DEV,One for ACC and One for PROD.

• So there are times where you want to connect to particular Subscription.

• You have to use the command Set-AzureRmContext with SubscriptionID followed by the unique Subscription ID for the Subscription

Set-AzureRmContext -SubscriptionID <YourSubscriptionId>

How to Create Custom Event ID monitoring using SCOM 2012 R2 - Step by Step

How to Create Custom Event ID monitoring using SCOM

• Many Times we get request to create new Event ID monitors which are not default available.Today we will create those Event  ID monitors to Monitor Custom Event ID.

• First Install the System Center Operations Manager 2007 R2 Authoring Console.This is the Tool that will help you create Custom Monitoring and very effective tool for developing Managements pack

Step by Step:

Once you Install the Tool open it and click on the Icon Below and select New Management Pack and give a name

• Then Click on "Health Model Tab" and right hand side click New-->Alerting-->Windows Event
• This will Open the Windows Event ID Custom Monitoring Pane

• Now give it a Name "Event ID 7040 Monitoring"

• Then Click on Target and Select "Browse All Classes"
• Now Check "List" and Search for "Windows Computers" and Select it

• In Category select "Alerts" and Click Next
• Now in The Log Name Give a Event Log where the event is logged. In our Case we Select "System". Then click Next

• Now Enter the "Event ID" and "Event Source" and Click Next

• Give the Alert the Name you want and click Finish

• Now Save the MP in Top and Import it in your Environment to Monitor this Event ID

Import Management Pack using Powershell SCOM 2012 R2

Importing Management Pack using Powershell SCOM 2012 R2:

• Inoder to Import the MP using Powershell use the below command

Import-SCOMManagementPack -FullName "C:\Test.mp"

• This will import the MP.

Delete SCOM management Packs using Powershell in SCOM 2012 R2

Delete SCOM management Packs using Powershell

• SCOM has a very powerful Command shell which is a subset of Powershell
• Most of the time we have to delete lot of old management packs and when there are more than 20 to delete, you have to select 1 by 1 and delete.
• But there is a easier way to do it with Command Shell
• Use command "Get-SCOMmanagementpack | where{$_.displayname -like "*Windows*"}|Remove-SCOMManagementPack"
• This will delete all the management pack which matches the word windows

Log File Monitoring in Azure using Microsoft Operations Manager Insight

Log File Monitoring in Azure using Microsoft Operations Manager Insight

• Log File Monitoring using  Microsoft Operations Manager Insight is bit tricky. You should have ths knowledge of developing the management pack. But we will help you.
• Inorder to send the data to  Operational Insight, you need to reference "Microsoft.IntelligencePacks.Types" MP. You also need to reference "System.ApplicationLog.Library".

The collection rules has 3 parts: 

1)  A data source reading the log (In example its picking up every single line from it, matching wildcard “*” – but you can use this to filter what in each of your logs is ‘interesting’/worth collecting).

         <DataSource ID="LogDS" TypeID="AppLog!System.ApplicationLog.GenericLog.FilteredEventProvider"> 

            <LogFileDirectory>c:\Logs\</LogFileDirectory> 

            <LogFilePattern>Test*.log</LogFilePattern> 

            <LogIsUTF8>false</LogIsUTF8> 

            <Expression> 

              <RegExExpression> 

                <ValueExpression> 

                  <XPathQuery Type="String">Params/Param[1]</XPathQuery> 

                </ValueExpression> 

                <Operator>MatchesWildcard</Operator> 

                <Pattern>*</Pattern> 

              </RegExExpression> 

            </Expression> 

          </DataSource> 

2) A condition detection used to MAP fields to the ‘event’ shape that OpInsights Log Management expects, 

<ConditionDetection ID="Mapper" TypeID="SystemLibrary7585010!System.Event.GenericDataMapper"> 

            <EventOriginId>$Target/Id$</EventOriginId> 

            <PublisherId>$MPElement$</PublisherId> 

            <PublisherName>GenericLog</PublisherName> 

            <Channel>$Data/EventData/DataItem/LogFileName$</Channel> 

            <LoggingComputer>$Target/Property[Type='MicrosoftWindowsLibrary7585010! Microsoft.Windows.Computer']/PrincipalName$</LoggingComputer>

            <EventNumber>0</EventNumber> 

            <EventCategory>3</EventCategory> 

            <EventLevel>0</EventLevel> 

            <UserName></UserName> 

            <Description>$Data/EventData/DataItem/Params/Param[1]$</Description> 

            <Params /> 

        </ConditionDetection> 

3)A write action to send this data to the cloud:

   <WriteAction ID="HttpWA" TypeID="IPTypes!Microsoft.SystemCenter.CollectCloudGenericEvent" /> 

Complete Rule Code:

      <Rule ID="MomUIGeneratedRuledc3f1e40e7d54c5a82e408523d686031" Enabled="true" Target="MicrosoftWindowsLibrary7585010!Microsoft.Windows.Computer" ConfirmDelivery="false" Remotable="true" Priority="Normal" DiscardLevel="100"> 

        <Category>EventCollection</Category> 

        <DataSources> 

          <DataSource ID="LogDS" TypeID="AppLog!System.ApplicationLog.GenericLog.FilteredEventProvider"> 

            <LogFileDirectory>c:\Logs\</LogFileDirectory> 

            <LogFilePattern>Test*.log</LogFilePattern> 

            <LogIsUTF8>false</LogIsUTF8> 

            <Expression> 

              <RegExExpression> 

                <ValueExpression> 

                  <XPathQuery Type="String">Params/Param[1]</XPathQuery> 

                </ValueExpression> 

                <Operator>MatchesWildcard</Operator> 

                <Pattern>*</Pattern> 

              </RegExExpression> 

            </Expression> 

          </DataSource> 

        </DataSources> 

       <ConditionDetection ID="Mapper" TypeID="SystemLibrary7585010!System.Event.GenericDataMapper"> 

            <EventOriginId>$Target/Id$</EventOriginId> 

            <PublisherId>$MPElement$</PublisherId> 

            <PublisherName>GenericLog</PublisherName> 

            <Channel>$Data/EventData/DataItem/LogFileName$</Channel> 

            <LoggingComputer>$Target/Property[Type='MicrosoftWindowsLibrary7585010!Microsoft.Windows.Computer']/PrincipalName$</LoggingComputer>

            <EventNumber>0</EventNumber> 

            <EventCategory>3</EventCategory> 

            <EventLevel>0</EventLevel> 

            <UserName></UserName> 

            <Description>$Data/EventData/DataItem/Params/Param[1]$</Description> 

            <Params /> 

        </ConditionDetection> 

        <WriteActions> 

         <WriteAction ID="HttpWA" TypeID="IPTypes!Microsoft.SystemCenter.CollectCloudGenericEvent" /> 

        </WriteActions> 

      </Rule>

Upgrade SCOM 2012 R2 agent using SCCM for latest UR upgrade

Upgrade SCOM 2012 R2 agent using SCCM for latest UR upgrade

• Follow the below command to upgrade SCOM agents using SCCM

msiexec /i path\Directory\MOMAgent.msi /qn /l*v %temp%\MOMAgentUpgrade.log

This will upgrade the agent using the latest UR4 or UR5  upgrade

Install SCOM 2012 R2 agent using SCCM or command line

Install SCOM 2012 R2 agent using SCCM:

Inorder to install SCOM agent using SCCM, we have to follow the belwo procedure. Please use the below command line script which you use to install the SCOM agent from command line or SCCM



%WinDir%\System32\msiexec.exe /i path\Directory\MOMAgent.msi /qn USE_SETTINGS_FROM_AD={0|1} USE_MANUALLY_SPECIFIED_SETTINGS={0|1} MANAGEMENT_GROUP=MGname MANAGEMENT_SERVER_DNS=MSname MANAGEMENT_SERVER_AD_NAME =MSname SECURE_PORT=PortNumber ACTIONS_USE_COMPUTER_ACCOUNT={0|1} ACTIONSUSER=UserName ACTIONSDOMAIN=DomainName ACTIONSPASSWORD=Password AcceptEndUserLicenseAgreement=1

USE_SETTINGS_FROM_AD={0|1}:

Indicates whether the management group settings properties will be set on the command line. Use 0 if you want to set the properties at the command line. Use 1 to use the management group settings from Active Directory.

USE_MANUALLY_SPECIFIED_SETTINGS=={0|1}:

If USE_SETTINGS_FROM_AD=1, then USE_MANUALLY_SPECIFIED_SETTINGS must equal 0.

MANAGEMENT_GROUP=MGname:

Specifies the management group that will manage the computer.


MANAGEMENT_SERVER_DNS=MSname:


Specifies the fully qualified domain name for the management server. To use a gateway server, enter the gateway server FQDN as MANAGEMENT_SERVER_DNS.


MANAGEMENT_SERVER_AD_NAME=ADname:

Use this parameter if the computer's DNS and Active Directory names differ to set to the fully qualified Active Directory Domain Services name.


SECURE_PORT=PortNumber:
5723

ACTIONS_USE_COMPUTER_ACCOUNT={0|1}:

Indicates whether to use a specified user account (0) or the Local System account (1).

ACTIONSUSER=UserName:

Sets the Agent Action account to UserName. This parameter is required if you specified ACTIONS_USE_COMPUTER_ACCOUNT=0.

ACTIONSDOMAIN= DomainName:

Sets the domain for the Agent Action account identified with the ACTIONSUSER parameter.

ACTIONSPASSWORD= Password:

The password for the user identified with the ACTIONSUSER parameter.

AcceptEndUserLicenseAgreement=1:

Used to specify that you accept the End User License Agreement (EULA).

Get-Process:How to capture the list of process running on the Computer using Powershell

How to capture the list of process running on the Computer using Powershell

• To list all process running on the computer use the Command

           Get-Process

          This will give you list of all the process running on your system.

• To count number of process running on the system,use

          (get-process).count

• To output the Process to textfile so that you can send email to your support team with details,use

         get-process | out-File -FilePath c:\temp\testpr.txt

         This will give you output to text file.

• If you want only to check if particular process is running, then use

          get-process | select-string "goog"