When CPU and memory resource consumption are running at or near 100%, the first thing an administrator wants to check is what processes are running at the time the excess resource consumption took place. The problem is that by the time you can get to a machine and retrieve a list of running processes, the condition has improved and the evidence gone.

This problem can be easily overcome in Operations Manager or Essentials 2007 using a new feature called a diagnostic to automatically perform data collection tasks at the time a condition is encountered. However, you will not find the appropriate diagnostic in place out of the box.

The diagnostics in this sample Retrieve Running Processes MP (link provided at the end of this article) , which automatically retrieve a list of running process the moment the alert threshold is breached, ensure the offending process information is captured. Simply download and import into your environment to make immediate use of this feature (no configuration required).

If you are looking in the Management Packs area of the Administration name, you will see the name of this sample MP is named Custom Diagnostics and Recoveries, which is so named so as to allow you to save your own diagnostics you create to this MP. The monitors shown in figure 1 represent the monitors in the Windows 2003 Base OS Management Pack that will alert when CPU and/or memory utilization break MS recommended thresholds.

How it Works

This management pack creates a diagnostic on each of the five monitors in the Windows 2003 Base OS Management Pack (shown in figure 1) that automatically dumps a list of running processes on the target machine when the threshold of the monitor is breached. The output can then be viewed in the Health Explorer for the target machine for the monitor in critical condition, as shown in figure 2. The settings of the diagnostic itself can be seen on the Diagnostics and Recoveries tab of the monitor.

Figure 1 - Monitors affected by diagnostics in the Retrieve Running Processes Sample MP. 

Figure 2 - Output of the Retrieve Running Processes Diagnostic

Settings of the Dump Process Diagnostic

The dump process diagnostic is configured with the following characteristics:

• Executes when the monitor is in a critical state
• Executes automatically
• Executes tasklist.exe to dump the list of running processes.

Figure 3 - Retrieve Running Processes Diagnostic Settings(1)

Figure 4 - Retrieve Running Processes Diagnostic Settings(2)

Conclusion

Hopefully this has increased your awareness of the usefulness of diagnostics in Operations Manager 2007. Download the Retrieve Running Processes Sample MP HERE:

Have a cool script, MP or other System Center Solution you’d like to share? Submit an entry in the System Center Solutions Contest for a chance to win an Xbox, Zune 2 and other great prizes! Visit the System Center Virtual User Group website for more information today!