I've recently started monitoring my new SharePoint 2010 farms on SCOM, and found the management pack's documentation to be rather lacking in setup instructions, and the required permissions for SCOM's account on the farm were rather shocking:
- Local admin on all SharePoint servers
- Local admin on all SQL servers
- dbowner on all SharePoint's databases
- Membership in the Farm Administrators group
After some experimenting, I managed to reduce the permissions to a
normal level, and create my own (working!) workflow:
(treat FARM as a unique identifier for your farm)
Prepare a special AD account (one for every farm) for SCOM's monitoring, such as
Grant that account:
- Membership in the
Farm Administratorsgroup on the SharePoint farm (via Central Administration)
dbowneron the farm's DBs (or
sysadminon the SQL server, if it only holds this farm's DBs anyway)
- Membership in the
Using SCOM's console, Create a Windows
Run-As account(under administration, be careful) named something like "SP FARM Monitoring"
Edit the SharePoint MP's xml file thusly:
- If you installed the MP on the SCOM server (as you should), copy the
"SharePointMP.Config" file from
C:\Program Files (x86)\System Center Management Packs\Microsoft SharePoint 2010 Products OpsMgr 2007 MP en-us\to
C:\Program Files\System Center Management Packs\. It should stay there.
- Open the file in your favorite XML editor
Add an Association node like:
<Association Account="NAME" Type="Agent"></Association>
NAMEis SCOM's Run-As account
Inside the Association node, add a Machine node for every computer inside the farm, like:
<Machine Name="MACHINE" />
- If you installed the MP on the SCOM server (as you should), copy the "SharePointMP.Config" file from
Add every SharePoint server to SCOM's monitored servers (through discovery wizard)
Execute the task
Configure SharePoint Management Pack(in
Monitoring > SharePoint 2010 Products > Administration). Change the task credentials to an account with farm administrator privileges (like yours), otherwise the task will execute with SCOM's default action account, which might not have enough permissions.
Wait for about an hour, and check out the Diagram View!
If your servers won't appear, check the
unidentified machines view,
the Agent's health, and the server's event log.