When in-place upgrading Windows Server 2012 Server to a newer version, SCOM agents can encounter a common issue: duplicate monitors for logical disks and IIS components.
Understanding and Resolving SCOM Duplicate Monitors in In-Place Upgraded Environments
A few days ago, one of our customers has contacted us telling they have realised that there was a second monitor named “Windows Server 2012 Logical Disk Monitor” for the same logical disk in one of their Windows Server 2016 Servers. The first question I asked was “Is the server in-place upgraded?” because that was a case I had seen previously. The answer was “Yes” which I was expecting.
SCOM’s health and class model is great which enables objects dynamically being added or deleted, making it more powerful against its components, but it can also cause issues if not carefully managed. This problem occurs because of the discovery model and management pack change in past years. Let’s explain it a bit more in detail.
How it Happens
Previously, Microsoft was releasing versioned management packs for Operating Systems like Windows Server 2008, Windows Server 2012 etc. In 2019, they released an agnostic Operating System Management Pack named “Windows Server Operating System 2016 and 1709 Plus” which would be valid for Operating Systems Windows Server 2016 onward as the name states. Since this was the only available management pack for new versions, SCOM Admins immediately imported it to their environments. For those servers running on Windows Server 2012 or Windows Server 2016+ there were no issues at all, and all monitors worked fine. The problem started occurring when admins started in-place upgrading those Windows Server 2012 Servers.
As you know SCOM updates or deletes a discovered object only in 4 conditions.
- Discovery returns a different value from the existing one (update)
- Discovery does not return a value for the discovered object (object does not exist anymore) (delete)
- Discovery is overridden to “Enabled -> False” (delete)
- Management Pack is deleted. (delete)
And note that discovery named “Discover Windows Logical Disks” within the Windows Server 2012 Operating System (Discovery) Management Pack is directed to the Windows Server 2012 Operating System.
After the in-place upgrade, the server is now Windows Server 2016 or above meaning there is no object called “Windows Server 2012 Operating System” for this server. This results in the discovery mentioned above not being run anymore to update or delete the existing logical disks from the previous version.
In the meanwhile, a new management pack, which includes discoveries for Windows Server 2016+ Operating Systems starts running and creating corresponding objects including logical disks which causes you to end up with two monitors for the same logical disks.
As a conclusion you end up with 2 monitors for the same logical disk objects.
Solution
The solution is simple. Disabling the “Discover Windows Logical Disks” discovery for “Windows Server 2016 and above Operating Systems” (Override the object discovery -> For all objects of another class) as below and run Remove-SCOMDisabledClassInstance cmdlet using Operations Manager Shell
Same goes for IIS servers as well. In-place upgraded servers having IIS installed ends up duplicate monitors for almost every component under IIS like websites and application pools. This can cause loads on servers having several websites or application pools where monitoring objects would be doubled.
The reason and solution is exactly the same. If you have such servers and objects, disable “IIS 8 Server Role Discovery” which is targeted to Windows Server 2012 Computer for “Windows Server 2016 and above Computer” (Override the object discovery – For all objects of another class) and run Remove-SCOMDisabledClassInstance cmdlet using Operations Manager Shell
Good luck and enjoy monitoring your critical systems!