Exchange 2010 Monitoring with SCOM 2012 - Correlation Service Issue

We are running SCOM 2012 RTM and would like to use the Exchange 2010 Monitoring MP.

I've installed the MP and Correlation Service as per the installation instructions for SCOM 2007 (no specific SCOM 2012 Installation Guides are available)

the problem is that the Correlation Service isn't working, so we aren't getting any alerts.

When attempting a manual start of the correlation service, I receive the following message:

"The Microsoft Exchange Monitoring Correlation Service on Local Computer started and then stopped. Some services stop automatically if they are not in use by other services or programs"

I've tried setting the service's log on account as both the SCOM Data Warehouse Read Account, Local System, and a Domain Admin user, with the same result for all.

What might be going wrong here?

April 30th, 2012 12:50pm

I think, I could be wrong, the latest correlation engine will not work with 2012.  There is supposed to be a new Exchange 2012 MP available sometime in the future that is going to fix issues with the correlation engine and add some much needed attention to the Exchange 2010 MP in general.  Again, I could be wrong, but I think I recall hearing that the current MP will not work in 2012 environments primarily because of the correlation engine.
Free Windows Admin Tool Kit Click here and download it now
April 30th, 2012 3:03pm

thanks for the reply Blake.

I've got the Service running now, setting the log on user as Local Service. however there's still no alerts being generated.

Maybe you're right about the compatibility with SCOM 2012, i can't find anything useful online suggesting one way or the other. 

April 30th, 2012 3:09pm

Well now that the service is running, it's going to talk to the SDK (this may have changed in SCOM12) and built out it's own instance space so that it can manipulate that for root cause analysis.  Depending on how LARGE your E2K12 environment is, this could take some time.

Just let it cook in and you will more than likely start to see alerts rolling in for Exchange 2010.  You just want to look at the application log for the events the correlation engine logs.  It will tell you that it's trying to connect to the RMS, if it can't, it will tell you it's going to retry in 30 seconds.  Then you might see warnings from it about unable to process state for 33 monitors out of 150 etc.  Or you will see an informational saying it connected to the RMS and all is good.

Free Windows Admin Tool Kit Click here and download it now
April 30th, 2012 3:47pm

thanks for the info Blake. SCOM has detected the Exchange servers and their roles (only 5 servers currently in our environment), and they show up in the Exchange 2010 Monitoring space in the SCOM console

however as per your suggestion I've checked the application event log on the RMS and can see the following error:

MSExchangeMonitoringCorrelation EventID 714:

Cannot connect to Operations Manager Root Management Server.

Error: The credentials used to connect to Operations Manager Root Management Server 'localhost' are invalid.  Error message: The user NT AUTHORITY\LOCAL SERVICE does not have sufficient permission to perform the operation.

So, Local Service is no good for connecting to SCOM. is it possible to grant Local Service the correct permissions? if not then which account should I be using?

Thanks

April 30th, 2012 4:12pm

I don't have 2012 deployed with the Exchange 2010 MP, so I can't tell you.  

Having said that in SCOM 2007 R2 when you install the correlation engine MSFT suggests that you put it on your RMS.  If you put it on the RMS there is a config file that has a connection string in it which by default is set to local host (which if on the RMS would be that local host).

Now you are not on 2007 R2, so I suspect (guessing) the correlation engine has to be on a management server that is hosting the role that the SDK occupies.  If you only have a simple deployment where you have one management server with all the SCOM 2012 roles, then it seems to me this shouldn't be an issue, if you have multiple servers with different roles, then edit the config file to point to the FQDN of the server hosting the SDK role and bounce the correlation engine.

Again, if one management server, with all the roles on that box, then maybe change the correlation engine to use one of your SCOM service accounts that has higher levels of access, bounce it and see if it can now connect.

I haven't had to set this up yet, so these are just basic troubleshooting guesses.

Free Windows Admin Tool Kit Click here and download it now
April 30th, 2012 4:22pm

Ah, you have to point this bad boy to the RMS Emulator:

Setting the RMS Emulator 
Im not perfectly sure how SDK Events are handled in 2012 but taking the secure route, I want to redirect the Correlation Engine to the RMS Emulator. 
By default the Correlation Engine will connect to localhost in case you installed the engine on the RMS Emulator, no need to make any changes.
UPDATE: I got confirmation from Microsoft that you have to make the correlation engine connect to the RMS Emulator!

Whats an RMS Emulator? Basically, there is no RMS in 2012, but for compatibility reasons one server can be defined as the RMS Emulator which you need for rules and monitors targeting the Root Management Server class.

Which server is the RMS Emulator? Usually the first Management Server in the Management Group, but lets go back and double check. 
2012 Shell: 
Get-SCOMRMSEmulator

http://www.systemcentercentral.com/BlogDetails/tabid/143/IndexID/92140/Default.aspx

Peep that write up on SCC I think it will help you with your issue.

April 30th, 2012 4:27pm

Hi!

thanks a lot for the guide, I've run through it but still can't get the service to work.

here's the process i've gone through so far:

-install Exchange 2010 MP from .msi

-installer throws an error when it can't start the correlation service

-go into services.msc. change run as account to Local Service

-return to installer (still showing error) - hit retry to start the service.

-finish installer. return to services.msc and stop the correlation service

-change the RMS server name from localhost to the RMS' FQDN

-copy MOmBidldr.dll to exchange\v14\bin directory

-import the Management Packs into SCOM

-change correlation service run as account to SCOM Service account

-start the correlation service

now, there's only one error showing in the application event log. however the contents are pretty useless:

The description for Event ID 4999 from source MSExchange Common cannot be found. Either the component that raises this event is not installed on your local computer or the installation is corrupted. You can install or repair the component on the local computer.

If the event originated on another computer, the display information had to be saved with the event.

The following information was included with the event: 

4404
E12
c-RTL-AMD64
14.02.0071.000
M.E.Monitoring.CorrelationEngine
M.EnterpriseManagement.OperationsManager
M.E.C.TypeSpaceCache.GetType[T]
M.E.Common.ObjectNotFoundException
90b4
06.01.7221.049
False

the message resource is present but the message is not found in the string/message table

obviously a placeholder for missing event data.

Other things checked:

-found a post stating that the run as account for the correlation service must match the SDK account - however this doesnt seem to apply to SCOM2012 as there is no SDK account.

Where can i go from here?

surely i'm not the first person to try using Exchange 2010 MP with SCOM 2012??

Free Windows Admin Tool Kit Click here and download it now
May 8th, 2012 10:25am

MSExchange Common 4999 is a mailbox database issue - though i've not seen anything mentioning the Correlation Service needing a connection to any mailbox databases. is this a red herring? there's no other information as to why 'the service started and then stopped'. I've been on this problem all day and Google has run out of options.

Is there anyone out there who's successfully got this working?? please help me, i'm at my wits end!

May 8th, 2012 3:02pm

another update on this.

after uninstalling then reinstalling the exchange 2010 management pack and correlation service, i finally got the service to start and to stay running.

However, as soon as import the management packs into SCOM, the correlation service stops, and won't start again. the only event log is the MSExchange common 4999 as mentioned previously.

Any Ideas? Anyone?

Free Windows Admin Tool Kit Click here and download it now
May 15th, 2012 3:22pm

I had issues with the corellation engine after upgrading scom 2012 to R2.

The MomBidLdr.dll version changed in the SCOM directories, and needs to be updated in the:

C:\Program Files\Microsoft\Exchange Server\v14\Bin directory.

That seemed to stop the errors for me.

March 5th, 2014 3:53am

another update on this.

after uninstalling then reinstalling the exchange 2010 management pack and correlation service, i finally got the service to start and to stay running.

However, as soon as import the management packs into SCOM, the correlation service stops, and won't start again. the only event log is the MSExchange common 4999 as mentioned previously.

Any Ideas? A

Free Windows Admin Tool Kit Click here and download it now
September 2nd, 2015 10:34am

My solution to this issue could be found here:

https://social.technet.microsoft.com/Forums/systemcenter/en-US/12802a01-5258-40df-9da4-9690fff53b18/exchange-2010-management-pack-for-scom-2012

Essentially you query the database with this:

Use OperationsManager SELECT * FROM dbo.ImageReference JOIN dbo.[Resource] on ([Resource].ResourceId = ImageReference.ImageId) LEFT JOIN dbo.[Category] ON [Category].CategoryTarget = [Resource].ResourceId LEFT JOIN dbo.[EnumType] ON [EnumType].EnumTypeId = [Category].CategoryValue JOIN dbo.MPElementView ON (ImageReference.ReferenceId = MPElementView.MPElementId) INNER JOIN dbo.[ManagementPack] ON dbo.ManagementPack.ManagementPackId = [ImageReference].ManagementPackId AND dbo.ManagementPack.ContentReadable = 1 WHERE dbo.[ImageReference].[ReferenceId] IN (select dbo.ManagedType.ManagedTypeId from dbo.ManagedType) and dbo.[Resource].ResourceType = 4 AND [EnumType].EnumTypeName IS NULL

If the issue is the NetApp DataOntap, like it was for me, then run the following:

UPDATE dbo.Category SET CategoryTarget='1469A3E7-BC77-3551-3AA7-290DBEA7C72D' where CategoryName='Cat.DataONTAP.Cluster.DataVserver.Volume.SMBShare.Image.Large'

UPDATE dbo.Category
SET CategoryTarget='6AF8CD6B-C876-E0D2-00C0-5EEB0F134729'
where CategoryName='Cat.DataONTAP.Cluster.NodeVserver.FCPAdapter.Image.Small'

This resolved my issue.

September 2nd, 2015 3:10pm

My solution to this issue could be found here:

https://social.technet.microsoft.com/Forums/systemcenter/en-US/12802a01-5258-40df-9da4-9690fff53b18/exchange-2010-management-pack-for-scom-2012

Essentially you query the database with this:

Use OperationsManager SELECT * FROM dbo.ImageReference JOIN dbo.[Resource] on ([Resource].ResourceId = ImageReference.ImageId) LEFT JOIN dbo.[Category] ON [Category].CategoryTarget = [Resource].ResourceId LEFT JOIN dbo.[EnumType] ON [EnumType].EnumTypeId = [Category].CategoryValue JOIN dbo.MPElementView ON (ImageReference.ReferenceId = MPElementView.MPElementId) INNER JOIN dbo.[ManagementPack] ON dbo.ManagementPack.ManagementPackId = [ImageReference].ManagementPackId AND dbo.ManagementPack.ContentReadable = 1 WHERE dbo.[ImageReference].[ReferenceId] IN (select dbo.ManagedType.ManagedTypeId from dbo.ManagedType) and dbo.[Resource].ResourceType = 4 AND [EnumType].EnumTypeName IS NULL

If the issue is the NetApp DataOntap, like it was for me, then run the following:

UPDATE dbo.Category SET CategoryTarget='1469A3E7-BC77-3551-3AA7-290DBEA7C72D' where CategoryName='Cat.DataONTAP.Cluster.DataVserver.Volume.SMBShare.Image.Large'

UPDATE dbo.Category
SET CategoryTarget='6AF8CD6B-C876-E0D2-00C0-5EEB0F134729'
where CategoryName='Cat.DataONTAP.Cluster.NodeVserver.FCPAdapter.Image.Small'

This resolved my issue.

  • Proposed as answer by Nakatomi2233 Wednesday, September 02, 2015 7:07 PM
Free Windows Admin Tool Kit Click here and download it now
September 2nd, 2015 7:06pm

This topic is archived. No further replies will be accepted.

Other recent topics Other recent topics