Thank you for the response Henrik. I was attempting to base it off the component because (from what I can tell) within the Silect MP Author tool, you must browse and select an actual "component" and you cannot simply select a key and click OK. I haven't tried to change that much from within MP Author, but I will certainly give your idea a shot about TRUE/FALSE on the existence of the key and fall back to making sure the "component" value does not equal zero. Thank you again.
Geoff From: [email protected] [mailto:[email protected]] On Behalf Of Henrik Andersen Sent: Tuesday, April 28, 2015 12:24 PM To: [email protected] Subject: [msmom] SV: RegKey Discovery Oddity: Hi!, I don't think it's wise to base the discovery on something to 0(zero) Because the <AttributeName>Component</AttributeName> will most likely be zero if the key is not present. If I was you, I would base the discovery on something like the existence of the key or the value to be non-zero. Something like this: <AttributeName>DummyPresent</AttributeName> <Path>Software\CustomKey\Application</Path> <PathType>0</PathType> <AttributeType>0</AttributeType> </RegistryAttributeDefinition> </RegistryAttributeDefinitions> <Frequency>300</Frequency> <ClassId>$MPElement[Name="Custom.Class"]$</ClassId> <InstanceSettings> <Settings> <Setting> <Name>$MPElement[Name="Windows!Microsoft.Windows.Computer"]/PrincipalName$</Name> <Value>$Target/Property[Type="Windows!Microsoft.Windows.Computer"]/PrincipalName$</Value> </Setting> <Setting> <Name>$MPElement[Name="System!System.Entity"]/DisplayName$</Name> <Value>$Target/Property[Type="Windows!Microsoft.Windows.Computer"]/NetbiosComputerName$</Value> </Setting> </Settings> </InstanceSettings> <Expression> <SimpleExpression> <ValueExpression> <XPathQuery Type="Boolean">Values/DummyPresent</XPathQuery> </ValueExpression> <Operator>Equal</Operator> <ValueExpression> <Value Type="Boolean">true</Value> </ValueExpression> </SimpleExpression> Otherwise it will properly work if your Component-regkey instead is non-zero when the class is supposed to be discovered.. Then your <SimpleExpression> <ValueExpression> <XPathQuery Type="Integer">Values/Component</XPathQuery> </ValueExpression> <Operator>Equal</Operator> <ValueExpression> <Value Type="Integer">0</Value> </ValueExpression> </SimpleExpression> </Expression> Should be NotEqual instead of equal. /Henrik Fra: [email protected]<mailto:[email protected]> [mailto:[email protected]] På vegne af Orlebeck, Geoffrey Sendt: 28. april 2015 20:27 Til: '[email protected]' Emne: [msmom] RegKey Discovery Oddity: I have a discovery based on the existence of a registry key: "HKLM\Software\CustomKey\Application" which contains a single DWORD (32-Bit) Value defined as "Component" with value set to "0". I manually created that key on 3 servers as part of a test, no application or anything is automatically creating that structure or key value. However, I imported the MP into our SCOM 2012 R2 environment and a server that does not have that registry key has started reporting errors about the services not running. Inside Health Explorer for the server, it shows this discovery and all the monitors I setup based on it. Again, the registry key doesn't exist on the server and neither do any of the services I am attempting to monitor. Is there any known issue using the above strategy? I created this discovery via Silect's "MP Author" tool. I'm including the XML output in case it shows where I've gone wrong. Thank you. <?xml version="1.0" encoding="utf-16"?> <Discovery ID="Discovery.For.Customer.Target.AppName.Component" Comment="<Silect><Op>Created</Op><User>DOMAIN\User</User><Previous/><LastModified>2015-04-28 15:25:00Z</LastModified></Silect>" Enabled="true" Target="Windows!Microsoft.Windows.Computer" ConfirmDelivery="false" Remotable="true" Priority="Normal"> <Category>Discovery</Category> <DiscoveryTypes> <DiscoveryClass TypeID="Customer.Target.AppName.Component"> <Property TypeID="System!System.ConfigItem" PropertyID="ObjectStatus" /> <Property TypeID="System!System.ConfigItem" PropertyID="AssetStatus" /> <Property TypeID="System!System.ConfigItem" PropertyID="Notes" /> <Property TypeID="System!System.Entity" PropertyID="DisplayName" /> </DiscoveryClass> </DiscoveryTypes> <DataSource ID="DS" TypeID="Windows!Microsoft.Windows.FilteredRegistryDiscoveryProvider"> <ComputerName>$Target/Property[Type="Windows!Microsoft.Windows.Computer"]/NetworkName$</ComputerName> <RegistryAttributeDefinitions> <RegistryAttributeDefinition> <AttributeName>Component</AttributeName> <Path>SOFTWARE\CustomKey\Application\Component</Path> <PathType>1</PathType> <AttributeType>2</AttributeType> </RegistryAttributeDefinition> </RegistryAttributeDefinitions> <Frequency>86400</Frequency> <ClassId>$MPElement[Name="CUSTOMER.Target.AppName.Component"]$</ClassId> <InstanceSettings> <Settings> <Setting> <Name>$MPElement[Name="Windows!Microsoft.Windows.Computer"]/PrincipalName$</Name> <Value>$Target/Property[Type="Windows!Microsoft.Windows.Computer"]/PrincipalName$</Value> </Setting> </Settings> </InstanceSettings> <Expression> <SimpleExpression> <ValueExpression> <XPathQuery Type="Integer">Values/Component</XPathQuery> </ValueExpression> <Operator>Equal</Operator> <ValueExpression> <Value Type="Integer">0</Value> </ValueExpression> </SimpleExpression> </Expression> </DataSource> </Discovery> Confidentiality Notice: This is a transmission from Community Hospital of the Monterey Peninsula. This message and any attached documents may be confidential and contain information protected by state and federal medical privacy statutes. They are intended only for the use of the addressee. If you are not the intended recipient, any disclosure, copying, or distribution of this information is strictly prohibited. If you received this transmission in error, please accept our apologies and notify the sender. Thank you. Confidentiality Notice: This is a transmission from Community Hospital of the Monterey Peninsula. This message and any attached documents may be confidential and contain information protected by state and federal medical privacy statutes. They are intended only for the use of the addressee. If you are not the intended recipient, any disclosure, copying, or distribution of this information is strictly prohibited. If you received this transmission in error, please accept our apologies and notify the sender. Thank you.
