Differences between MCF in MOM 2005 and SCOM 2007

I wanted to go through and outline some of the changes we made for MCF since our last release. The things I really wanted to accomplish in redesigning MCF was to make it more integrated with SCOM 2007 than it was in MOM 2005, to make necessary performance improvements and maintain at least the same level of functionality as we had before, while keeping with the model-based approach of SCOM 2007.

Integration with SCOM 2007

With the significant changes that took place between these releases, we had an opportunity to integrate MCF more closely with the product than it was before. The first step here, was getting rid of resolution state as the mechanism to mark alerts for forwarding. Instead, the alert object has a special nullable field (ConnectorId) that represents the identifier of the connector that currently "owns" this alert.

There are a few ways to mark alerts for forwarding. In the UI, you can right-click on an alert and there will be a fly-out menu with available connectors so you can explicitly mark an alert for forwarding. Programmatically, the ConnectorId field on a MonitoringAlert object is settable and once set can be applied by calling the Update() method on the alert. Lastly, we have introduced a concept of connector subscriptions that are exposed via the UI and programmatically (MonitoringConnectorSubscription) that allow users to "subscribe" to a particular set of alerts by using criteria that should be marked for a particular connector.

Another aspect of more tight-knit integration is the fact that 100% of MCF functionality is available via the managed SDK. While we still ship with a web-service (using WCF) and a proxy to communicate with it, the recommendation is to use the SDK to do MCF functionality unless you are not running on windows; this provides a richer object model and a better programming experience. The namespace in the SDK that servers MCF functionality is Microsoft.EnterpriseManagement.ConnectorFramework and the main object the provides the root of much of the functionality is ConnectorFrameworkAdministration which can be retrieved off a ManagementGroup object via GetConnectorFrameworkAdministration().

The last aspect of integration is the fact that a connector is modeled in SCOM 2007. While we aren't planning on shipping anything that provides health information for a connector out of the box (time constraints), there is an ability for customers and partners who write connectors to develop a health model for their connector. In a nutshell, creating a connector creates a new instance of Microsoft.SystemCenter.Connector. In order to develop a health model around a new connector, a user should extend this class with their own and develop a health model targeted at the new class. Once this is complete, the built-in setup process will need to be augmented by the connector author to discover their connector as an instance of their new class. Assuming the model is developed and working correctly, the connector object will now have state like anything else SCOM is managing.

Performance Improvements

In 2005 we have many performance issues at scale due to the fact that a lot of data is copied from place to place. In the MOM to MOM Connector scenario in particular, we physically moved alerts from bottom tiers to the top tier, replicating the data and keeping it in sync.

The first change for performance was with respect to tiering. We no longer copy alerts from bottom tiers to the top tier, but instead make available alerts from multiple tiers on the top tier. A SCOM administrator can setup tiers in the UI and make them available to connectors. Once available, MCF provides special "tiered" versions of various methods that aggregate data across these tiers the administrator setup. For instance, calling GetMonitoringAlertsForTiers() will loop through all available tiers and aggregate the results, returning alerts from each. The recommended approach for tiering, however, is to manage the calls to each tier from within the connector code itself as this allows more robustness in terms of error handling and allows for parallel processing for multiple tiers. There is much more to talk about with respect to tiering and how to accomplish this, but it is not in the scope of this article. If there is interest, I will put together a more detailed post on tiering.

The next improvement for performance has to do with how we process alerts and alert changes. In MOM 2005, we distinguished between "New" and "Updated" alerts and actually kept a cached copy of each change to an alert in a pending list for each connector. If an alert changed 3 times, we would have three independently acknowledgeable changes and three copies of the alert in the cache. This caused performance problems when dealing with large scale deployments. In order to remedy this problem, in SCOM we manage alerts for connectors in place. The alerts in the alert table have a timestamp associated with non-connector related changes (so you don't get an update to an alert you changed as a connector) and that timestamp is checked against the current bookmark of a connector when retrieving alerts. Acknowledging data is now a function of moving a connectors bookmark. In other words, when a connector retrieves 10 alerts, when they are done processing these alerts, they should acknowledge receipt and processing by calling AcknowledgeMonitoringAlerts() with the maximum time of the alerts in the batch that was retrieved. This will ensure no data is lost.

Important Note: - Since SQL datetime is not particularly granular, it is possible that two alerts with the same datetime timestamp get split between two SELECT calls. Even worse, when acknowledging across tiers, the system times on the machines will not be the same which might cause data loss by acknowledging with a time from one alert on one tier to another tier that has a time slightly in the past. In order to remedy this we actually have a built-in "delay" when retrieving alerts so that we don't get the newest alert but instead get alerts older than 30 seconds. This actually causes some "weird" behavior in that if you mark an alert for forwarding and immediately call GetMonitoringAlerts() you won't get anything, even though the alert is marked. This value is configurable in the database. This query should do it, pending any changes to the property name at RTM: (The SettingValue is the number of seconds of "buffer" you want in GetMonitoringAlerts calls. It needs to be at least 1)

UPDATE GlobalSettings SET SettingValue = 1 WHERE ManagedTypePropertyId in
(SELECT ManagedTypePropertyId FROM ManagedTypeProperty WHERE ManagedTypePropertyName = 'TierTimeDifferenceThreshold')

Other Random Things

  1. We no longer support discovery data insertion via the web-service. This can be done as described in my earlier post.
  2. We support batching (and in fact enforce it with a maximum size of 1000), however the batch size is an "approximation" as ties in the alert timestamp might require more than the requested number of alerts to be returned. Also, batch size for tiered methods is the total across all tiers, not per tier.
  3. The MonitoringConnector object in the SDK has an Initialized property and a Bookmark property available for reading. The web-service has GetConnectorState() and GetConnectorBookmark() for the same purpose.
  4. Alert insertion is not supported. Please see this post and this one.
  5. Alert history retrieval is not done as part of the alert retrieval. Via the SDK there is a GetMonitoringAlertHistory() method on the alert. Via the web-service we have GetMonitoringAlertHistoryByAlertIds() for the same purpose.
  6. We added a way to generically get alerts via the web-service: GetMonitoringAlertsByIds(). This is available in the SDK in a variety of methods.
  7. When updating alerts via the web-service, the connector is implicit. When updating alerts via the SDK on behalf of a connector, it is important to use the overload that accepts a MonitoringConnector object to indicate it is the connector that is changing the alert.

Comments (78)

  1. BogN says:


    Can you tell us more about the connector you were talking about?

    BTW – Nice blog!

  2. BogN says:

    This connector: Microsoft.SystemCenter.Connector.

    You wrote: "there is an ability for customers and partners who write connectors to develop a health model for their connector"

    I want to make an integration between MOM and another third party application, should i use the Microsoft.SystemCenter.Connector class for that purpose?

  3. This is simply the class that we instantiate when you call Setup. If you want a health model, you will need to derive from this class and develop a health model against your new class. When you call setup, we will instantiate a Microsoft.SystemCenter.Connector instance at which time you will need to use the discovery data API to discovery this same instance as your class as well. You can look at my previous post on discovery data insertion to help explain that process.

    In terms of making a connector, the health model is not required. If you called Setup on ConnectorFrameworkAdministration, we already create everything in SCOM you need; the next step will be to actually write the connector.

  4. BogN says:

    OK, thanks.

    I would like to test the OMCF Webervice where can i get it?

  5. It is hosted within the SDK service.

    The default address of the service is http://<SDK Server>:51905/ConnectorFramework

    The binding, address and other settings are configurable via the Microsoft.Mom.Sdk.ServiceHost.exe.config file in the same directory as the service. This service is a Windows Communication Foundation (Indigo) service.

    We ship a user-friendly proxy in the SDK client dll in the Microsoft.EnterpriseManagement.ConnectorFramework namespace. The proxy class is called ConnectorFrameworkProxy.

  6. BogN says:

    OK thanks.

    I have another question.

    I want to create from the SDK a new custom alert.

    I know how to insert a new custom event, but how can i insert a new custom alert?

  7. Inserting alerts directly is not supported in SCOM 2007. Please see my other post on creating alerts from inserted events.

  8. BogN says:

    I have read your previous posts and tried to insert an alert with the InsertCustomMonitoringPerfomanceData function but i can’t see any alert in SCOM 2007…

    This is my function:

    private void DriveSystemConnectorLibraryTestManagementPack()


               // Connect to the sdk service on the local machine

               MonitoringClass computerClass = mg.GetMonitoringClass(SystemMonitoringClass.Agent);

               // Use the class to retrieve partial monitoring objects

               ReadOnlyCollection<PartialMonitoringObject> computerObjects =


               // Loop through each computer

               foreach (PartialMonitoringObject computer in computerObjects)


                   CustomMonitoringPerformanceData perfData =

                       new CustomMonitoringPerformanceData("Processor", "% Processor Time", 40);

                   // Allows you to set the instance name of the item.

                   perfData.InstanceName = computer.DisplayName;

                   // Allows you to specify a time that data was sampled.

                   perfData.TimeSampled = DateTime.UtcNow.AddDays(-1);



  9. BogN says:

    This is my ManagementPack:

     <?xml version="1.0" encoding="utf-16" ?>

    – <ManagementPack ContentReadable="false" RevisionId="2afe9dcc-a3b0-430c-b940-84632d990190">

    – <Manifest>

    – <Identity>





    – <References>

    – <Reference Alias="MicrosoftWindowsLibrary6046550">





    – <Reference Alias="Performance">





    – <Reference Alias="MicrosoftSystemCenterInstanceGroupLibrary6046550">





    – <Reference Alias="System">





    – <Reference Alias="SystemCenter">





    – <Reference Alias="Health">







    – <TypeDefinitions>

    – <EntityTypes>

    – <ClassTypes>

     <ClassType ID="UINameSpace968ade72e9394363832c283a5ebf9d9b.Group" Accessibility="Public" Abstract="false" Base="MicrosoftSystemCenterInstanceGroupLibrary6046550!Microsoft.SystemCenter.InstanceGroup" Hosted="false" Singleton="true" />




    – <Monitoring>

    – <Discoveries>

    – <Discovery ID="UINameSpace968ade72e9394363832c283a5ebf9d9b.Group.DiscoveryRule" Enabled="true" Target="UINameSpace968ade72e9394363832c283a5ebf9d9b.Group" ConfirmDelivery="false" Remotable="true" Priority="Normal">


    – <DiscoveryTypes>

     <DiscoveryRelationship TypeID="MicrosoftSystemCenterInstanceGroupLibrary6046550!Microsoft.SystemCenter.InstanceGroupContainsEntities" />


    – <DataSource ID="GroupPopulationDataSource" TypeID="SystemCenter!Microsoft.SystemCenter.GroupPopulator">



    – <MembershipRules>

    – <MembershipRule>



    – <IncludeList>









    – <Monitors>

    – <UnitMonitor ID="UIGeneratedMonitor1de5fc76bfc94dd290d9758ae0aa00c8" Accessibility="Public" Enabled="true" Target="SystemCenter!Microsoft.SystemCenter.Agent" ParentMonitorID="Health!System.Health.PerformanceState" Remotable="true" Priority="Normal" TypeID="Performance!System.Performance.ThresholdMonitorType" ConfirmDelivery="false">


    – <AlertSettings AlertMessage="UIGeneratedMonitor1de5fc76bfc94dd290d9758ae0aa00c8_AlertMessageResourceID">






    – <OperationalStates>

     <OperationalState ID="UIGeneratedOpStateIde9161751f17b4b7898574e947740f3d3" MonitorTypeStateID="UnderThreshold" HealthState="Success" />

     <OperationalState ID="UIGeneratedOpStateId248db74fc00e48ae9801a45a3698f829" MonitorTypeStateID="OverThreshold" HealthState="Error" />


    – <Configuration>


     <CounterName>% Free Space</CounterName>








    – <UnitMonitor ID="UIGeneratedMonitor05aa8e4c90f54b2ba619a6468d5e56eb" Accessibility="Public" Enabled="true" Target="SystemCenter!Microsoft.SystemCenter.Agent" ParentMonitorID="Health!System.Health.PerformanceState" Remotable="true" Priority="Normal" TypeID="Performance!System.Performance.ThresholdMonitorType" ConfirmDelivery="false">


    – <AlertSettings AlertMessage="UIGeneratedMonitor05aa8e4c90f54b2ba619a6468d5e56eb_AlertMessageResourceID">






    – <OperationalStates>

     <OperationalState ID="UIGeneratedOpStateIdbb0a89695ea841c5873b1fb08ac6e095" MonitorTypeStateID="UnderThreshold" HealthState="Success" />

     <OperationalState ID="UIGeneratedOpStateIdd670c570eda34c1d9416a45469fd14cd" MonitorTypeStateID="OverThreshold" HealthState="Error" />


    – <Configuration>


     <CounterName>% Processor Time</CounterName>











  10. Please see the management pack I attached to the post about inserting data via the SDK. You need to author a management pack that uses the SDK data source; this management pack does not and is looking for data from the perfomance log.

  11. BogN says:

    I Tried to import your management pack but i got an error that i have to import 3 more mp’s but when i try to import it i keep getting error messages….

    Can u show me how can i define all what i need with the GUI?

  12. You can’t define what you need with the UI. It is a more advanced scenario that is not supported by the UI directly. The MP I have up there just a bit old and needs to be updated. The Version and PublicKeyToken of each MP in the References section needs to be replaced with whatever version you have imported. So in your case, they should be replaced with:



  13. BogN says:

    Ok It work ๐Ÿ™‚ thanks!!!

    InsertCustomMonitoringPerformanceData only to raise events.

    I have some more questions:

    1) I want to use the InsertCustomMonitoringPerformanceData function to raise my events. How can I make warning alerts and error alerts? (depending on the value)?

    2) When I see my alert the path (agent name) is empty…. what am i doing wrong?

    3) Is this management pack good for everyday use? or it is good just for the learning?

    4) How did you create this management pack? I guess you did it through the SDK… but how?

    Thanks a lot!!


  14. 1. The write actions I used in my MP are configurable to set different level alerts, but you will need different rules for each alert level you want.

    2. Nothing. The alerts are about a computer that has no path.

    3. I take no responsibility for this management pack, but you are free to use it any way you like ๐Ÿ™‚

    4. I created it by hand in Visual Studio.

  15. BogN says:

    About my first question:

    Do you mean that i need to copy this node:Rule Rule ID="System.Connectors.Test.AlertOnThreshold"

    and give each value the right sevirity?

    If i’m wrong can you give me an example?

  16. Yes, and set the priority and severity accordingly.

  17. BogN says:

    Hi, new day new questions ๐Ÿ™‚

    1) How can i know to domain name of the computer that raised my alert?

    2) Is there any way for me to know the name of the component or feature within the application that cased the alert?

    3)How can i know the hyperlink to the alert’s page in the SCOM web console?

    4) How can i know the server role name of the alert? When i say server role name i mean the name of the windows service that was the source of the alert?

    5) How can I know the event ID that has raised my alert?

    Thanks A LOT!!!


  18. 1. IF an alert is generated on one computer (i.e. not a distributed application) the NetbiosDomainName property of the MonitoringAlert will be populated.

    2/4. Alerts are about a particular monitoring object that represents the server role/component the alert is about. No longer will the alert be attributed to the computer, when in fact it is a problem with IIS (for example). The MonitoringObjectId will give you the Id of the MonitoringObject that this alert is about. Also, the MonitoringObjectName, MonitoringObjectDisplayName, MonitoringObjectPath and MonitoringObjectFullName on the MonitoringAlert give you various names of that monitoring object (so you don’t have to retrieve it if this is all you are looking for about it).

    3. I will have to get back to you.

    5. Good question. We don’t actually keep things in the same fashion we did in MOM 2005 and there is no maintained relationship between the event that was collected and the event that triggered the alert. You can think of these actions (generating the alert and collecting the event) as two things happening in parallel, triggered by the same underlying data item being processing by the health service. In this case, the data item(s) will be available via the Context property of the alert. These data items could be any data type, not just "events"; i.e. they can be perf data, events, state change events (from monitors) or any other data item that we process.

  19. BogN says:

    Many many thanks :)!

  20. BogN says:

    About the url you gave me.

    Are you sure this is the port ? I guess the port is 51905.

    But it still not available.

    1)When you will release the final version of SCOM 2007 you will change the SDK with new features?

    2)I mean like add a property to MonitorAlert that will give me the URL to the web console?

    3) In the final release there will be a Management Pack that will be "listening" to the SDK performace data? (Like the mp you uploaded in your previous post?)

  21. BogN says:

    Hi another question:

    I want to change my alert Source field…

    How is it possible? My MonitoringObject class has no such property.

  22. BogN says:

    Sorry that I overload you with questions today…

    But i’m trying to figure something.

    In Mom 05 I had this code:

    private void PrintAlertTOConsole(Alert iNewAlert)


       Console.WriteLine("Compenent = " + iNewAlert.Component");

       Console.WriteLine("CompenentInstance = " + iNewAlert.ComponentInstance);

       Console.WriteLine("ServerRole = " + iNewAlert.ServerRole);

    The MonitoringObjectName, MonitoringObjectDisplayName, MonitoringObjectPath and MonitoringObjectFullName didn’t give me what i wanted…

    Is there any way for me to get them!?


  23. BogN says:

    Last but not least ๐Ÿ™‚

    When I’m inserting my new alert using InsertCustomPermormanceData() How can I set the Custom1-10 fields of the created alert?

    In other words, how can I get the new alert ID the was just created using the InsertCustomPerformanceData function?

  24. Let me see if I can get some of these =)

    1.Are you sure this is the port ? I guess the port is 51905.

    – No, I am not sure. I believe it is configurable.

    2. When you will release the final version of SCOM 2007 you will change the SDK with new features?

    – If you are asking if there will be any difference between RTM SDK and RC1 SDK, then yes there will be some changes.

    3. I mean like add a property to MonitorAlert that will give me the URL to the web console?

    – We will not be adding a property like this

    4. In the final release there will be a Management Pack that will be "listening" to the SDK performace data? (Like the mp you uploaded in your previous post?)

    – There is already a rule that does that and simply collects the performance data you insert. There will be no other rules that do this out of the box.

    5. I want to change my alert Source field…

    How is it possible? My MonitoringObject class has no such property.

    – You can’t. The source is defined as what the alert is about and cannot be changed after it is created.

    6. The MonitoringObjectName, MonitoringObjectDisplayName, MonitoringObjectPath and MonitoringObjectFullName didn’t give me what i wanted…

    – I don’t know what you want exactly, so I can’t help you more here. I would need to see a specific alert in question and what you are trying to get out of it that you are not seeing

    7. When I’m inserting my new alert using InsertCustomPermormanceData() How can I set the Custom1-10 fields of the created alert?

    – You would do this by editing the rule in the management pack that creates your alerts

    8. In other words, how can I get the new alert ID the was just created using the InsertCustomPerformanceData function?

    – You would have to query for it using some sort of criteria that you know about it. Perhaps if you pulled out something from the performance data you inserted and included it in the custom fields, you could query on that.

  25. BogN says:

    Hi Jakub,

    Do you want to keep correspond here? Or do you prefer us to correspond in email?

    1) Do you know how to configure the web console to view my alerts?

    2) About the source alert field, I didn’t explained myself correctly. I want that when my new alert is created (By the InsertCustomPerformaceData) the source field will be "BogN" for example. Is there a way for doing that?

    3) About my question for inserting data to the custom fields when a new alert is created: Is it possible to insert dynamic data to the custom fields when a new alert is created (All my question is about creating new alerts with the InsertCustomPerformanceData function). Is so can you give me an example of a rule that does it?

    4) Do you have documentation of how to query through custom fields? I would like to have it

    5) I have a general question: I want to insert alerts coming from an external monitoring tool. I will do it with the management pack you gave us using the InsertCustomPerformanceData function. In that way I will be able to create alerts in SCOM 2007. So far so goodโ€ฆ ๏Š I saw that there is a class called "MonitoringConnector" and it has a method called GetMonitoringAlerts(), this should return me all the alerts that has been created after the timestamp in the bookmark property, am I right? And when I’m done handling my new alerts, I should use the AcknowledgeMonitoringAlerts to change the timestamp in the bookmark. Am I right? I’m asking it because no matter what my GetMonitoringAlerts of the MonitoringConnecter instance is always empty. And when I use the GetMonitoringAlerts of the ManagementGroup instance I get all my alertsโ€ฆ Maybe I’m doing something wrong with the MonitoringConnector class?

    Thanks for all you help!!!


  26. BogN says:

    Hi, me again ๐Ÿ™‚

    About question 5.

    I solved the problem. I’ve inserted a new Subscription to my connector and it works!!! =)

    But i want to be able to create a new connector with a subscription by code if it doesn’t yet.

    I know how to create a new connector, but i has problems in inserting a new subscription.

    There is no documentation about it at all…

    Do you have some documentation about inserting a new subscription?

    Where the connector are saved? In my management pack?  

  27. BogN says:


    I forgot to ask you.

    In Mom 2005 i had a property for the Alert class called ruleID, where is this property in SCOM 2007?

  28. Well – if we do it here and others have the same questions, at least they might be answered that way.

    1. Unfortunately I don’t know much about the web console; you might try the beta newsgroups for that.

    2. The source field is a function of what monitoring object the alert is about. In the rule, when you set the id of the managed entity either explicitly or implicitely to the target of the rule, the alert will be about that instance, and the name shown in the UI will be the display name of that instance. Does this make sense? The field is not a string in the alert and is not settable in this fashion.

    3. Yes, you can. You can reference data from the data item for instance. Take a look at the System.Connectors.Test.AlertOnEventForComputer in the sample MP I have posted. You can reference the incoming data like this: $Data/<PropertyName>$.

    4. Use MonitoringAlertCriteria and the string would look something like this "CustomField1 = ‘Test’".

    5. Yeah, documentation is lacking here. The trick is to get the criteria right. The easiest way to do this is via the UI. Programmatically, you would have to understand the schema of the datasource. It can be found in the Microsoft.SystemCenter.Library.xml MP and it’s called AlertCriteriaType. You can export the MP and look at the xsd for the criteria. If you want to see what the criteria the UI generates looks like, you can query the DB for the rule that the UI created in the Rules table, then look in the Module table for all modules about that rule. The module that is the data source, will have xml configuration of which part will be the alert criteria.

    6. MonitoringRuleId if its a rule generated alert. ProblemId is the monitor id if IsMonitorAlert is true.

  29. BogN says:

    1) About the source field… There is no way to create a new alert with a source that doesn’t really exists? I want that all my alerts created from the SDK will have the name of the external monitoring tool… Please tell me that i will be able doing that…

    2)About the inserting dynamic data to my alert. I know that i can use $Data/<PropertyName>$ but, in the CustomPerformanceData i have only 3 or 4 properties and i need them all… Is there any other way doing that? I can extend this class and add it my own custom properties? or the data will be lost?

    3) Can i change the MonitoringRuleID when i create my alert? or it isn’t possible?

    4) About my last question in the previous comment (no 5)  I’ll explain myself again:

    I want to add to the MonitoringConnector a new subscription… that’s all… How can i do it via the SDk? Or another option is to save it in a new ManagementPack and then import it where necessary…

  30. BogN says:

    I forgot the question in my last comment.

    4) About my last question in the previous comment (no 5)  I’ll explain myself again:

    I want to add to the MonitoringConnector a new subscription… that’s all… How can i do it via the SDk? Or another option is to save it in a new ManagementPack and then import it where necessary… Is it possible to save all my connector subscription in a MP?

  31. 1. You can’t do this in SCOM 2007. The source must be an object that exists in the system. What are you really trying to accomplish here? All the custom fields are accessible to you for storing data.

    2. I don’t follow your question. Extend what class? There are only a few properties on the CustomPerformanceData object and you can persist all of them in custom fields on an alert since their are 10 of them. You could also persist them in a single custom field using some schema you define.

    3. It will be the rule id of the rule that generated it. Again, what are you trying to accomplish?

    4. Look at MonitoringConnectorSubscription in the Microsoft.EnterpriseManagement.ConnectorFramework namespace. My previos answer refers to the Criteria property of the Configuration property of this class.

  32. BogN says:

    Thanks for your answers…

    But i still need an example to create a subscription…

    Can you give me a piece of code for inserting new subscription? I don’t mind what will be the criteria property… I just want to see how to do it…

  33. BogN says:


    I want to connect to SCOM 2007 from another computer… How can i, connect through a remote machine? Do i need to connect to the web service?

  34. BogN says:

    I have the RC1.

    I did steps 1 and 3. But i keep getting this exception:

    The type initializer for ‘Bid’ threw an exception.

    You don’t have any example of creating a subscription through code…?

  35. Ok – maybe RC1 didn’t have the bits I thought. Can you try doing the other two steps? If you don’t want to bother and you don’t mind installing the UI on the box, that is the most sure fire way of getting it to work. I will answer your other question shortly, sorry for the delay.

  36. Inserting a subscription (assumes you already have a ManagementGroup instance):

                   ConnectorFrameworkAdministration connectorFrameworkAdministration = null;

                   connectorFrameworkAdministration = this.managementGroup.GetConnectorFrameworkAdministration();

                   AlertNotChangedSubscriptionConfiguration config = new AlertNotChangedSubscriptionConfiguration(AlertSubscriptionConfigurationType.Any);

                   config.IdleMinutes = 37;

                   config.Criteria = "<SimpleExpression>





                   config.ExpirationStartTime = DateTime.Now;

                   config.PollingIntervalMinutes = 1;

                   MonitoringConnectorSubscription alertChangeSubscription = new MonitoringConnectorSubscription("ConnectorNewAlertChangeSubscription", this.connectorIdForTest, config);

                   alertChangeSubscription.DisplayName = "My Subscription";

                   alertChangeSubscription.Description = "My Subscription Description";


  37. BogN says:

    Thanks ๐Ÿ™‚

    It works!!!

    Another question… ๐Ÿ™‚

    I’m an using the MP you wrote to trigger my alerts. So far so good… The problem is when I want to generate an alert (using the CustomPerformanceData) on an agent that to not exists in the SCOM server… Can I generate the performance data on this "fictive" agent?

    Did you understand what i mean…?

  38. How did you discover this agent? Can you elaborate more on what you are trying to accompish?

  39. BogN says:

    Yes I can…

    I want to insert alerts from an external monitoring application.

    There is a possibility that i will insert an alert on a agent or a network device for example that don’t exists in the mom server…

    Can i add an agent that hasn’t been discovered yet using only the SDK?

    I want to give the SDK a name of an agent, or a network device and insert this agent network device and then make a CustomPerformanceData on the Agent / Network device…

  40. BogN says:

    Ok, I’ll try it tomorrow (It’s 22:00 here…)

    Well as you know the way for me to insert new alerts to SCOM 2007 programmically is using your MP and the InsertCustomPerformanceData.

    This will be seen in the HealthExplore as performace alerts… But how can I create a new alert that will impact the availability (In the health explore) of my agent for example…?

  41. Please see the following two posts:



    Alerts don’t create state changes, state changes create alerts. You need to create a monitor and place it in the monitor hierarchy somewhere under the Availability monitor to affect availablity state.

  42. BogN says:

    OK this I uderstand. (About the state…)

    I want to have 4 generic monitors.

    One for performance, one for availability , one for security and one for configuration.

    My question is where and how to define those monitors so I will be able to generate alerts from the SDK on each category.

  43. I don’t understand your question. Did you look at those posts I referenced? You need to define monitors in a management pack and make the appropriate monitor a parent of your monitor.

  44. .code { font-family: verdana; font-size: 8pt; color: green; } .pbody { font-family: verdana; font-size:

  45. huangtj says:

    Hi, Jakub

    Could you give me a hand, since I just start with SCOM 2007? What I am going to do is to integrate SCOM 2007 with HP Openview.

    We want to develop code in Java and communicate with SCOM 2007  via web seervice to collect alart and performance data from SCOM 2007  to HP Openview. So that we can have a single view in HP Openview.

    But there is mot much documentation on SCOM 2007 SDK. What I can find is some web page on MS MSDN site.

    Could you let me know what is the endpoint for the WSDL? Is SCOM 2007 SDK service compatible with Axis 2?  ( In the other word, could I develop Java code with Axis and to access data in SCOM 2007 via SDK service )

    Thanks a lot for your help!

  46. SCOM 2007 only has one web service interface which is only for MCF (to synchronize alerts). If you want to do more than that, you need to use our managed code client-side API.

    More on MCF:


    And the endpoint by default is:


  47. huangtj says:

    Hi, Jakub

    Do you mean that we can not get performance data ( like MSTV performance counter) from SCOM 2007 via web service?

    From operations Manager 2007 SDK Architecture Overview, MCF communicates with SDK service.

    We do not familar with C# ( .NET ). Is there a way to use Java to get performance counter data. Our developed code is run on windows.

    By the way, when will the SDK doc will be ready.

    thanks a lot!

  48. huangtj says:

    Hi, Jakub

    Can we monitor a windows standalone system ( member of a workgroup, not belong to any domain)with SCOM 2007?

    I have tried, but still not suceess. What I did is manually installed agent on that system.

    and try connect it to a GW server.

    is it the right way?


  49. First – no, you cannot get performance data via a web-service interface – yes, MCF comminucates with the SDK service, however, it does not expose all the funcationality thereof.. The only way to use the full functionality of the SDK is with managed code. What doc are you referring to?

    Second – Yes, you can monitor such a computer, but you will either need to use a gateway server, and have the agent communicate with that OR use certificate based authetication directly with a management server. This guide should help: http://download.microsoft.com/download/7/4/d/74deff5e-449f-4a6b-91dd-ffbc117869a2/OM2007_OpsGuide.doc

  50. wanganguo says:

    Hi Jakub:

    One question about MOM.

    There are 6 types of views in the MOM Management Pack, like Alerts,State, Events, Performance and so on.

    Performance counter information, for an example:

    Total ChangeDefaultChannelMap


    IPTV User Store

    Category Description:

    Counters used in the User Store Web Service




    Number of times web method ChangeDefaultChannelMap has been called.

    Total GetChannelMap


    IPTV User Store

    Category Description:

    Counters used in the User Store Web Service




    Number of times web method GetChannelMap has been called.

    Is this performance data which we can not get via a web-service interface?

    Thx for your time.

    Warm regards.

  51. Correct. Only alert data is available via a web-service interface. Everything else you need to use the managed API.

  52. wanganguo says:

    Hi Jakub:

    New year new question:

    ManagementGroupConnectionSettings mgSettings = new ManagementGroupConnectionSettings(serverName);

    ReadOnlyCollection<MonitoringPerformanceData> performanceDataCollection;

    performanceDataCollection = managementGroup.GetMonitoringPerformanceData();

    I want to get performance data by GetMonitoringPerformanceData(GUID) method.  But i donot know how can  i know the GUID of each monitor.

    Where can i get the GUID of each monitoring performance data?

  53. You would already have to have it to begin with. The method that takes a GUID is designed for retrieval if you already have the id from somewhere else (perhaps a cache of some kind). You wouldn’t be able to get the Id otherwise.

  54. huangtj says:

    Hi Jakub,

    Happy new year!

    As it  describe in "MSTV Troubleshooting_Reference_Performance_Counters.doc", Microsoft® TV IPTV Edition (IPTV Edition) performance counters counters are a mechanism to monitor performance of critical operations on IPTV Edition server machines.

    Can we get all the defined performance counters to SCOM 2007 if we deploy Management_Pack_for_IPTV_Edition in SCOM 2007?

    I have load the Management_Pack_for_IPTV_Edition to SCOM 2007, but I can not find these counters on operation console.

    Do I miss any configration in SCOM?

    Thanks a lot!

  55. I am not familiar with that management pack, but perhaps it does not include a performance counter view for the performance counters it collects?

    Where can I get this MP to take a look at it?

  56. huangtj says:

    Hi, Jackub,

    Acutally, I convert the MP from MOM 2005 version to SCOM 2007 XML version.

    It is about 9M. could I have your email and I can send it to you?  Or you can get it from your MSTV colleague.


  57. Ashwath Akirekadu says:

    Very useful Blog.

    Thanks for your hard work, Jackub.  I love the team blogs.

  58. mkantipudi says:

    We want to develop code in Java and communicate with SCOM 2007  via web seervice to send the alart and performance data to SCOM 2007

    But there is not much documentation on SCOM 2007 SDK. What I can find is some web page on MS MSDN site.

    can you please guide me how to proceed? give me the links if you have any thing.

  59. You canโ€™t insert alert and performance data to SCOM via the web-service. Only retrieving and updating alerts is supported.

  60. mkantipudi says:

    If I was not able to pass the alerts through web services, what is inbound connecter?

  61. mkantipudi says:

    is there any other way to post the event to SCOM?

  62. Inbound connector can insert events and performance data (not alerts) as well as discovery data via the SDK. None of these features are supported as part of the web-service. The SDK is managed code, however. You can always wrap the SDK into your own web-service and call it that way if you like.

  63. mkantipudi says:

    Thank you very much for your response.

    We have our own management s/w, which will manages the fabrics, that was written in java. Now we are planning to send/post these fabric events/alerts/perforamcen data to microsoft MOM/SCOM server.

    If the SDK webservice was not usefull for us, can you give me is there any other third party connectors avaliable? As per your prvious post, we need to write a webservice and need to do the local SDK calls to post the events/alerts/performace data. Can you give me the SDK API link?

  64. I am not sure any third party connectors would help here. You best (and easiest) bet would likely be calling the SDK some way from Java (not sure what support Java has for interacting with .Net); you might need to rather it in your own web-service. MSDN has documentation on the SDK itself:


    And the API is available only as part of the product.

  65. Ariram says:

    I am developing connector , which will be used from our product to interact with SCOM2007. I am using java code to interact with SCOM through webservice. We have already developed a connector for MOM2005 , but it is bit different. Can you forward me to document how to create one for scom.I don’t find wsdl file or list of service exposed . We want to push events from our product to SCOM2007 through webservice is it possible .


  66. sprokkelpsv says:

    Hello I am new in SCOM. I have managed to add a connector in c# to SCOM. When I add a product connector subscription in SCOM there is a possibility to configure groups (i.e. Unix Computer Group). I have configured all. The alerts are coming in correctly (getMonitoringAlerts). Is there a possibility to retrieve the group which triggered the alert? Or is there a possibility to retrieve alerts for a certain group?

    I hope someboxy can help me out.

    Kind regards,

    Stefan Verheggen

  67. Yes, the alert is associated to a MonitoringObjectId, which is the instance that the alert is about. If you get that object, you can find which groups it’s a part of by finding the appropriate relationships (which is harder) or you can get the group you are interested in as a MonitoringObject and call .GetMonitoringAlerts() on it with a TraversalDepth of Recursive.

  68. sprokkelpsv says:

    Hello thank you for the reply. I saw your mail in the morning and I come up with another solution to retrieve alerts by group. I now use the following code:

    foreach (MonitoringObjectGroup mog in mogs)


                                            ReadOnlyCollection<MonitoringAlert> mals = mog.GetMonitoringAlerts();

    where mogs is set as mg.GetRootMonitoringObjectGroups

    I don’t get any alerts for any groups. I see all the groups that are in the subscription (except for the root group), but I don’t get any errors. Root group is selected in the subscription. In the connector.GetMonitoringAlerts I see the correct errors. I tried then to deselect the root group and selected all the subgroups. I still don’t get alerts on mog.GetMonitoringAlerts and I don’t get alerts anymore on connector.GetmonitoringAlerts(). It looks like the alerts are all mapped on the root group. Does somebody have a solution for this?

    Thanks in advanced.


    Stefan Verheggen

  69. You need to pass in TraversalDepth.Recursive to the GetMonitoringAlerts call.

    In the UI the "root group" is not a real group, it just means don’t filter by group and if that is the case, perhaps you don’t have a group that encapsulates the instances you are trying to get alerts for?

  70. sprokkelpsv says:

    Hello Jakub,

    Now I can see the alert for a group. But the strange thing is that I see for the connectorid in the MonitoringObjectAlert a null value. Also I see the resolutionstate on 255. That is also not correct, because in my active alerts window it is displayed as a new alert.

    Do you know what the problem can be?

    The configuration in scom is the following:


    —Groups: A group is made test.avadev.local watcher computer group. With a explicit groupmember <computername>.Avadev.local (this I think the root)

    —Management pack objects: A object is made called test.avadev.local. I don’t state all of the properties. If you like I can sent these to you.

    Maybe you can help me out when I describe what I want to do. I want to retrieve the active alerts with a product connector. I want to identify to which group it belongs (or retrieve the active alerts by group).

    The code that I used so far is:

                  if (connector == null)


                       ManagementGroup mg = new ManagementGroup(scomHost);

                       ConnectorFrameworkAdministration cfAdmin = mg.GetConnectorFrameworkAdministration();

                       connector = cfAdmin.GetMonitoringConnector(ConnectorGuid);

                       scomWebConsoleUrl = mg.GetAdministration().Settings.GetDefaultValue(Settings.NotificationServer.WebAddresses.WebConsole);

                       mogs = mg.GetRootMonitoringObjectGroups();    

                   //    MonitorCriteria monitorCriteria =

                   //new MonitorCriteria(

                   //    ReadOnlyCollection<ManagementPackMonitor> monitors =

                   //    mg.GetMonitors(monitorCriteria);

                   //    // Display information about each monitor.

                   //    foreach (ManagementPackMonitor monitor in monitors)

                   //    {

                   //        monitor.

                   //        //Console.WriteLine("Monitor name: " + monitor.Name);

                   //        //Console.WriteLine("Status: " + monitor.Status.ToString());

                   //        //Console.WriteLine("Description: " + monitor.Description +

                   //        //    Environment.NewLine);

                   //    }


                   ReadOnlyCollection<ConnectorMonitoringAlert> alerts;

                   foreach (MonitoringObjectGroup mog in mogs)


                       ReadOnlyCollection<MonitoringAlert> mals = mog.GetMonitoringAlerts(TraversalDepth.Recursive);

                       foreach (MonitoringAlert mal in mals)


                           if (mal.ConnectorId == SCOMConnectorService.ConnectorGuid)


                               if (mal.ResolutionState != 255)






                   // Get the alerts we subscribed to. You must setup a subscription for this

                   // connector before it will process any alerts.

                   alerts = connector.GetMonitoringAlerts();

                   IList<ManagementPackConfigurationGroup> configs = connector.ManagementGroup.GetConfigurationGroups();

                   //foreach(ManagementPackConfigurationGroup mpcg in configs)



                   //MonitoringRule mr;


                   if (alerts.Count > 0)


                       foreach (ConnectorMonitoringAlert alert in alerts)



                           //It seems like SCOM has a bug in the subscription. Although the subscription is configured for

                           //receiving active alerts also closed alerts are received. These should be filtered out.

                           if (alert.ResolutionState != 255)


                               if (alert.MonitoringObjectPath.Contains(AlertSourceIDEttenLeur))


                                   topDeskClientEttenLeur.ProcessAlert(alert, scomWebConsoleUrl);




                                   topDeskClientRoosendaal.ProcessAlert(alert, scomWebConsoleUrl);




                       // Call AcknowledgeMonitoringAlerts to enable the SDK to mark these alerts as processed.




    I really don’t know anymore how to retrieve it and identify the group it belongs to. Can you help me out? Maybe configuration in SCOM isn’t correct or the code I use isn’t correct. I am able to retrieve all alerts on the connector when I select the root group in subscriptions, but I don’t receive anything else (connector.GetMonitoringAlerts()). Can you help me out. Maybe with examples, hints or something else?

    Thanks in advanced.

    Kind regards,


  71. I am guessing you are simply looking at an older alert. Why don’t you add criteria to the alert method, something like MonitoringAlertCriteria("ResolutionState = 0").

  72. jll says:


    do you know if a SCOM to MOM connector exist and if not if it will be difficult to create one ?


  73. I don't. Have you tried the OM forums?

Skip to main content