This chapter is from the book
This chapter is from the book
This chapter is from the book
Data Layer
The data layer is the logical layer where the data is stored. This layer is of vital importance to the MOM system, due to the vast quantities of data that need to be received, processed, stored, and acted on. Figure 3.6 shows the data layer and its components.
)
Figure 3.6 Data layer and components.
There are five main components within the data layer shown in Figure 3.6:
- Operations database
- Reporting database
- Providers
- SDK SQL views
- SQL views
Without a robust and high-performance data layer, MOM's features would be less effective and could be rendered useless.
Operations Database
The operations database is the centralized repository for MOM's configuration and operational data. This data includes rules, events, performance data, scripts, and the knowledge base. The database engine used is Microsoft SQL 2000 or 2005, either Enterprise or Standard edition. This database is named OnePoint. The name is a holdover from the product's roots before Microsoft acquired MOM and ensures backward compatibility with MOM 2000. Microsoft plans to change the name of this database in the next version of Operations Manager (see Chapter 23, "Touring Operations Manager 2007," for details).
The OnePoint SQL database is stored in two files by default: the primary database file (EEADATA.MDF) and the transaction log file (EEALOG.LDF), as shown in Figure 3.7. Within the database are more than 350 tables containing the data and configuration settings. Also more than 100 views are defined, providing rapid access to various groupings of the data.
)
Figure 3.7 MOM 2005 database files.
There can be only one operations database in a management group. All collected data, alerts, and configuration data for the management group are stored in the database. This can be a lot of information.
As an example, if the system is collecting data on 100 computers and there are 100 performance counters on each computer measured at 15-minute intervals, there will be close to a million data points collected in a 24-hour period or close to 365 million data points in a year. For 1,000 computers, that would be 3 billion data points per year—and that is just for performance data and does not take into account data from event logs, synthetic transactions, and so on. The sheer quantity of information can be staggering.
The maximum supported size of the MOM 2005 database is 30GB. This limitation is a pragmatic one, in that there is no inherent hard stop limitation built into the MOM code. Exceeding 30GB will not cause the system to halt or fail immediately. The problem is that as the database becomes larger, certain processes such as database grooming take so long to complete that functionality becomes impaired. In the case of database grooming, the database is locked and will not accept additional data while the grooming is taking place. Therefore, management servers collecting data have to buffer the information they have collected and stop accepting new data from agents while the database is locked. Agents then buffer their data while the management server is not accepting data. This can result in delayed alerts because the centralized alerts will not trigger while data is buffered on the agents. The larger the database, the longer the lockdown window and the more delayed the alerts can get. In a worst-case view, the agent buffers might start overflowing and then information will be lost. Thus, placing an official limit on the database size allows the internal database procedures to complete promptly and the system to function properly.
To get around these inherent limitations, MOM includes many features to help maintain the database. Several SQL jobs run automatically to assist in keeping the database trim. The grooming process removes event and performance data that have aged out according to the database grooming setting. Other jobs, created as part of the database installation, perform routine integrity and reindex processes to ensure that the database is healthy and performing well. With the exception of the grooming job, these are standard maintenance jobs that can be performed on any SQL Server database. One job not configured as part of the setup process is the database backup. We discuss procedures for backing up OnePoint and other MOM components in Chapter 12, "Backup and Recovery."
Although the grooming process takes place on a daily basis by default, the actual grooming window is set in the MOM Administrator console under Global Settings. The grooming interval defaults to four days, meaning that events and performance data points older than four days are removed from the operations database when the MOMx Partitioning and Grooming job runs at 12:00 a.m. Before the data disappears forever, it is transferred to the reporting database for long-term storage, which we discuss in the next section.
The database is also optimized to allow the grooming to take place quickly, using database partitioning. The database is divided into daily partitions (shown in Figure 3.8). The database is in effect logically broken into daily segments. Grooming and other database-intensive operations can be performed on the logical segments, rather than against the entire database. Most of these operations have specific time constraints, such as grooming data every four days by default or auto-resolving information alerts in four hours. Partitioning allows the database to efficiently retrieve and process the appropriate data.
)
Figure 3.8 Operations database partitions.
Reporting Database
The reporting database contains data archived from the operations database. This database is variously referred to as the reporting database, the data warehouse, the archive, and the System Center Data Warehouse (SCDW), but the actual SQL Server database name is SystemCenterReporting. The acronym SCDW is frequently used when naming processes within MOM 2005 Reporting, which uses the capacities of the System Center Reporting Server.
As a SQL Server database, the reporting database is stored in two physical files by default: the primary database file (REPDATA.MDF) and the transaction log file (REPLOG.LDF). The database contains more than 100 tables with data and configuration settings. Also more than 300 views are defined, giving the system rapid access to various groupings of the data. These are more views than in the operations database, which makes sense because the reporting database is intended to present information. These views are described in Appendix D, "Database Views."
Data is transferred from the operations database to the reporting database via a Data Transformation Services (DTS) job that runs as a Scheduled Task in the Windows Scheduled Tasks. Similar to the operations database, a job periodically grooms the old data from the reporting database. Both jobs are shown in Table 3.2.
Table 3.2. Reporting Jobs
|
Job Name |
Purpose |
Default Schedule |
|
SystemCenterDTSPackageTask |
Transfers data from the operations database to the reporting database. This job is run as a scheduled task in Windows Scheduled Tasks rather than as an SQL job. |
Every day at 1:00 a.m. |
|
SCDWGroomJob |
Grooms the SystemCenterReporting database. |
Every day at 3:00 a.m. |
The grooming interval for the reporting database is one year. The reporting database grooming parameters are hard-coded and buried in a table named WarehouseClassSchema within the SystemCenterReporting database. The table has a column named WCS_GroomDays that specifies the number of days to groom after, which is 365 for the majority of the data types. The table is keyed on the class ID of the data, so it is not straightforward to modify the information in this table and likely not supported. In the future, Microsoft will provide a user interface method to change these values in a supported manner. Chapter 8, "Post-Installation Tasks," provides information on scheduling the grooming jobs.
Within the one-year grooming window, the reporting database provides a historical view of the operations of your monitored servers. This information is available using reports generated with SQL Server Reporting Services (SSRS).
There is a tentative limit of 200GB for the reporting database, but this is not likely to be the true upper-end boundary. The reporting database growth really only impacts the time needed to generate reports, which does not impact operations functions such as alerting. As the database grows, the database can be separated into different disk subsystems for better performance and even placed on a Storage Area Network (SAN) type technology for performance and growth.
Providers
One of MOM's key advantages is its capability to collect data from a wide variety of sources. This data can be numeric or textual. The information can even reflect missing items that should have occurred within some time frame but did not. This flexibility in the sources of data that MOM can collect and respond to is a key feature in that it allows you to monitor almost anything. For example, many popular brands of Uninterruptible Power Supply (UPS) devices include hardware additions that measure external temperature and humidity. This can be logged to text files or accessed via an Application Program Interface (API). MOM can be configured to read the API or text file, capturing the data and alerting you when the humidity in the server room gets too high or too low.
These sources of data are called providers. Provider types include
- Application logs—These include the standard event logs, Internet Information Server (IIS) log files, SQL trace log files, ASCII log files, and even UNIX syslog files.
- Timed events—These events are generated by MOM and are useful for launching scripts on a regular basis or detecting missing events.
- Windows Management Instrumentation (WMI) events—This is a flexible provider, giving MOM access to a wide variety of event-based information through the WMI interface.
- WMI numeric data—Similar to the WMI events, this provider gives access to numeric or performance data through the WMI interface.
- Generic—This is another class of provider generated by MOM. The Generic provider includes information such as agent heartbeat or events internally generated by scripts.
MOM 2005 includes nearly 700 different predefined providers with its default management packs. You can easily create new providers as needed. Management packs, which are essentially collections of business logic, usually add providers when imported into MOM.
Database Views
MOM includes a number of documented SQL views to help you create custom reports and transfer data from the MOM operations database to other applications and data stores. These views provide read-only access to the MOM database. If you need both read and write access, you can utilize the MOM Windows Management Instrumentation (WMI) classes or the MOM Managed code Application Programming Interface (API), both of which are documented in the MOM Software Development Kit (SDK). The SDK can be accessed at http://go.microsoft.com/fwlink/?LinkId=50272.
The SDK SQL views for the operations database and SQL views to access reporting detail are documented in Appendix D.