I have come across with a request from multiple customers, from my colleagues and in multiple forums where if any task was executed by any User in SCOM, how we will be able to get that information?
I have developed a management pack for this request where I have used Kevin’s fragments.
How this Management pack works?
Well, in this management pack, I have used PowerShell probe action module to execute the PowerShell Script which will be running the SCOM CMDLets, and it will retrieve the required information. If we have got any data in the propertybag, this PowerShell script will log an error event 7890 on the Operations Manager event logs and it will have all the task details which was triggered by an User. The Monitor called “Custom.TaskResult.Check.Monitor” will be running on RMS emulator server.
This Monitor will run every 270 seconds and I have given the option to overrides the frequency however I would recommend to run it only the defined frequency else you might miss some notifications.
You can download the management pack from the below link.
Management-Packs/Custom.TaskResult.Check.Monitor.ManagementPack.xml at master · souravmahato7/Management-Packs (github.com)
Please find the details about what you have to change to make this Management pack to work.
- Firstly, you have to change all the references in the MP according to the version of dependent MP in your environment.
- Once MP is imported and if any task were generated in last 5 minutes, you will get an alert and if you could see the Health Explorer of RMS emulator class, you will see the state change event as following:
- You will get the Task details in the Operations manager log of the RMS emulator under the event ID 7890 like below.
Log Name: Operations Manager Source: Health Service Script Date: 7/24/2021 11:58:49 AM Event ID: 7890 Task Category: None Level: Error Keywords: Classic User: N/A Computer: SCOM.domain.COM Description: : Task 'Reserved' was triggered by domain\sourav at 07/24/2021 06:55:17