Fun with OMS and Windows Media Center[Updated 11/29/2017: This blog post has now been updated to the new query language for Log Analytics in the code samples]
After completing a series on how to create a custom management pack to monitor Windows Media Center (available here) I realized how simple it would be to create similar functionality in Microsoft OMS. OMS provides a great solution for this type of alerting as you can monitor your Windows Media Center without having to implement System Center Operations Manager and it has a free tier with a 7 day retention period (up to 500 MB of data per day).
How would we do something similar in OMS?
- The first thing you need is OMS!
- Integrate with OMS
- Enable the alerting preview
- Enable collection of the Media Center logs
- Create alerts for Windows Media Center events
Try it out!
To get OMS go to http://www.microsoft.com/oms and click on the option to try for free.
Integrate with OMS:
The next step is to install the OMS agent on your system, or integrate OMS into your Operations Manager environment.
Tip: If you have an existing MMA agent you can just configure the Azure Operational Insights tab with the Workspace ID and Workspace key.
The workspace ID and workspace key are found under settings/connected sources in OMS.
Enable the alerting preview:
The alerting feature is currently in preview state. To enable this, open settings/preview features and set it to Enabled as shown below.
Enable collection of the Media Center logs:
On settings/data, add the Windows Event log named “Media Center” to the list of data to be collected.
And save this using the save button on the bottom.
Once these events have started to collect, we can use a query such as this to find events which are occurring related to the Media Center log using syntax such as: (please note, this takes a few minutes to start and you may want to generate some new events in your Windows Media Center environment to get some data as it collects the log files going forward, not what was there historically)
search in (Event) “Media Center”
To provide alerting we can now go back to the Excel spreadsheet (originally discussed in http://blogs.catapultsystems.com/cfuller/archive/2015/03/27/fun-with-opsmgr-and-windows-media-center-part-3-gathering-information-and-developing-a-health-and-alerting-model/) which contained a list of EventID’s and other relevant information. In Excel we now filter this to only things which need to be alerted on as shown below.
|Event ID||Event Source||Event Level||Alert?||Alert: Informational, Warning, Critical||What is it?|
|0||MCUpdate||Warning||Yes||Failed to retrieve a schedule|
|8||Recording||Warning||Yes||Warning||TV signal failure|
|21||Recording||Informational||Yes||Informational||Recording was removed|
|6||Recording||Warning||Yes||Informational||Not recorded due to conflict|
|3||Recording||Warning||Yes||Warning||Signal loss during recording|
|17||Recording||Informational||Yes||Informational||Recording was removed|
The following are the queries which I used to alert on based upon the information above from Excel.
- Event | where EventLog == “Media Center” and Source == “MCUpdate” and EventID == 0
- Event | where EventLog == “Media Center” and Source == “MCUpdate” and EventID == 8
- Event | where EventLog == “Media Center” and Source == “MCUpdate” and EventID == 21
- Event | where EventLog == “Media Center” and Source == “MCUpdate” and EventID == 6
- Event | where EventLog == “Media Center” and Source == “MCUpdate” and EventID == 3
- Event | where EventLog == “Media Center” and Source == “MCUpdate” and EventID == 24
- Event | where EventLog == “Media Center” and Source == “MCUpdate” and EventID == 17
- Event | where EventLog == “Media Center” and Source == “MCUpdate” and EventID ==
These are the notifications which were created for the 8 items listed above (in order):
- Failed to retrieve a schedule
- TV signal failure
- Recording was removed
- Not recorded due to conflict
- Signal loss during recording
- Recording started
- Recording was removed
- Recording completed
Use the alert tab at the bottom to create each alert:
Specifying the name and scheduling information shown below.
Additionally you need to specify the email address to send the alert information to. Once we have created an alert for each of the conditions identified above and you are now good to go!
The alerts which are created can be shown in under Settings/Alerts.
Trying it out:
After the alerts were created correctly, emails were received in the account which was specified on the alert. An example of these are shown below.
Summary: Are you looking for a quick, easy and free method to provide notifications when you Windows Media Center system records shows and more? Using the approach in this blog post I was able to create this in less than an hour and it is working like a champ!