Finding Overides

Dashboard Server
, ,
1

Is there a way I can get a list of all overrides done in my SCOM environment? Ideally with dates of when they were done. I inherited this environment and in the past week I have found 4 different rules/monitors disable all with in the same few days of each other all were things I looked at and said that was a very poor decision. I would like to find all other overrides done in the same time frame if I could.

2

Yep,

Go to Authoring, Management Pack Objects, Overrides.

It will show all overrides, including creation date.

Be sure to remove/change the scope to get all/the overrides you are looking for.

1 Like
3

In this collection of SQL scripts there is a script called “Management Pack and Instance Space misc queries:”

https://blogs.technet.microsoft.com/kevinholman/2016/11/11/scom-sql-queries/

This will give you a list of all overrides in unsealed management packs.

You can change the script up a bit to get your desired results.

For example you can add “AND LastModified between ‘2017-01-01’ AND ‘2017-02-01’” to the where clause to get overrides done in a specific period. (PS! There are two where clauses)

--To dump out all the rules and monitors that have overrides, and display the context and instance of the override:
select rv.DisplayName as WorkFlowName, OverrideName, mo.Value as OverrideValue, 
mt.TypeName as OverrideScope, bme.DisplayName as InstanceName, bme.Path as InstancePath, 
mpv.DisplayName as ORMPName, mo.LastModified as LastModified 
from ModuleOverride mo 
inner join managementpackview mpv on mpv.Id = mo.ManagementPackId 
inner join ruleview rv on rv.Id = mo.ParentId 
inner join ManagedType mt on mt.managedtypeid = mo.TypeContext 
left join BaseManagedEntity bme on bme.BaseManagedEntityId = mo.InstanceContext 
Where mpv.Sealed = 0 AND mo.LastModified between '2017-01-01' AND '2017-02-01'
UNION ALL 
select mv.DisplayName as WorkFlowName, OverrideName, mto.Value as OverrideValue, 
mt.TypeName as OverrideScope, bme.DisplayName as InstanceName, bme.Path as InstancePath, 
mpv.DisplayName as ORMPName, mto.LastModified as LastModified 
from MonitorOverride mto 
inner join managementpackview mpv on mpv.Id = mto.ManagementPackId 
inner join monitorview mv on mv.Id = mto.MonitorId 
inner join ManagedType mt on mt.managedtypeid = mto.TypeContext 
left join BaseManagedEntity bme on bme.BaseManagedEntityId = mto.InstanceContext 
Where mpv.Sealed = 0 AND mto.LastModified between '2017-01-01' AND '2017-02-01'
Order By mpv.DisplayName
2 Likes
4

You can run a report to get the list of overrides for chosen MPs with dates.

Go to Reporting pane , click on “Microsoft Generic Report Library” MP and double click on “Overrides” to open the report.

2 Likes
5

Hi,

try OverrideExplorer !
http://www.systemcentercentral.com/download/override-explorer-for-operations-manager-2012/

explorer.png
explorer.png796×307 109 KB

Kjetil

1 Like
6

I agree Override Explorer is one of those must have utils for any SCOM admin !

7

I use PowerShell to explore my configurations. Specifically, I use the PowerShell ISE as it’s Console has more variable persistence than a standard PS console. I preload variables with the objects I’m looking through to minimize load time for each search.

If you’re on the management server:

$overrides = Get-SCOMOverride
If not:
$overrides = Get-SCOMOverride -ComputerName “scom-management-server-name”
With the variable loaded, we can refer to it over and over again to explore the configurations that are set:
$overrides | Select-Object * | Out-GridView -PassThru | Format-List *
This makes a dynamic filtering grid for the data that will send the selected items through to the console when you click OK.
$MS = “scom-management-server-name”

$creds = get-credentials

$mp = Get-SCOMManagementPack -computername $MS -Credential $creds
$rules = Get-SCOMRule -ComputerName $MS -Credential $creds
$monitors = Get-SCOMMonitor -ComputerName $MS -Credential $creds
$agents = Get-SCOMAgent -ComputerName $MS -Credential $creds
$classes = Get-SCOMClass -ComputerName $MS -Credential $creds
$instances = Get-SCOMClassInstance -ComputerName $MS -Credential $creds
$overrides = Get-SCOMOverride -ComputerName $MS -Credential $creds
$groups = Get-SCOMGroup – -ComputerName $MS -Credential $creds


Happy spelunking! Caution… these are live objects that can be changed from Powershell! For exploration purposes:

Assume you want to find all of the agents for servers with the name “AOS-1”, “AOS-2”, “AOS-3”

$searchTerm = “AOS-”

$agents | where-object displayname -like “$searchTerm” | Out-GridView -PassThru


Here’s a quick and dirty discovery audit of systems containing the term DC in their name:

# Please note the use of backticks for line continuation to make the filtering more presentable $ms = “scom-management-server-name” $agents = Get-SCOMAgent -ComputerName $ms $instance = Get-SCOMClassInstance -ComputerName $ms $agents ` | Where-Object displayname -like “*DC*” ` | foreach { $instance ` | Where-Object path -like “$($_.displayname)*” ` | Select-Object path, displayname, fullName ` | Sort-Object displayname ` | Format-Table -AutoSize write-output “`n” }
8

You should also be able to plug the SQL queries from Kevin Holman, via bottekott, into your Squared Up dashboards using the SQL Tile if you want