Menu Close

Authoring Management Packs – the fast and easy way, using Visual Studio???



I know what you are thinking.  “Wait, what did he just say?”




Well, hear me out.

Over the years, there have been many tools that we have used to write MP’s.  The SCOM UI Authoring tab, Notepad, XML Notepad, Notepad++, SCOM 2007R2 Authoring Console, Silect MP Author, and Visual Studio.


They all have tradeoffs.  I’d argue the most powerful tool over the years that was “somewhat” user friendly was the SCOM 2007R2 authoring console.  Once you learned the quirks, it was pretty good when you needed to make complex MP’s.  But even it was far from perfect.  And moving into SCOM 2012, now that the schema changed, using it becomes VERY challenging to update your existing MP’s.  Silect’s MPAuthor ( has stepped up in a big way to fill some of these gaps, and they have done a fantastic job of creating wizards that spit out MP’s that are useful, and relatively easy to author.  But they don’t have a wizard for all scenarios, and they don’t offer a way to update the workflows using the same UI that created them, so you are back to XML at that point.


Visual Studio has a powerful plugin called VSAE (Visual Studio Authoring Extensions)

The challenge with VSAE is unless you come from a developer background using Visual Studio, or you write management packs all day for a living, most people find it VERY daunting to use.  Even with experience, I find adding certain module types VERY cumbersome to use.  I find customers rarely use Visual Studio for authoring because of this.


I think that can change.  I have been presenting a different method on using VSAE with my customers and it has resonated very well.  The most powerful part of VSAE to me, is the ability to use Management Pack fragments.

A Management Pack fragment is simply a bit of XML, that contains all the “working parts” for a specific workflow….   Several authors have written about the power of fragments since VSAE launched, but the biggest gap I saw can be broken up into two major issues:

  • Nobody provided a good “library” of workable MP fragments
  • Nobody came up with a VERY simple method to reuse fragments quickly and easily


I hope to change that.  I am presenting an MP fragment library for you to download, and a simple methodology to add fragments to a MP you wish to create.  If you can do a FIND and REPLACE in notepad, you can use this.


What if I told you, in a few *minutes*, you could write a full Management Pack, that discovered an application dynamically, created views for the app, monitored for events and performance, monitored key services, and could even run your custom scripts against the app using VBScript or PowerShell?


I will be starting a blog series, which will include step by step examples of these fragments, and how to use them.


You can download the fragment library here from GitHub:


This will be a step by step series.  You really should go in order if you are just getting started, but it isn’t really required except for the first two parts.  You can complete ALL of these in less than an hour, even for a first timer.


Part 1: Use VSAE to create a new Management Pack Project

Part 2: Use VSAE fragments to dynamically discover an application based on the existence of a registry key or value

Part 3: Use VSAE fragments to monitor a service

Part 4: Use VSAE fragments to create an alert generating event log rule

Part 5: Use VSAE fragments to create a performance collection rule

Part 6: Use VSAE fragments to add Alert, State, and Performance views to your MP

Part 7: Use VSAE fragments to add custom Groups to your MP

Part 8: Use VSAE fragments to create a Windows Performance Monitor with Consecutive Samples


There MANY more fragments available in my download than just what I am documenting here.  These are just a basic walkthrough of VERY common workflows, to show how easy it can be, to use VSAE and create great management packs, quickly.  I will add additional examples as time goes on.  I welcome any feedback or MP fragment requests to be added to the library.


One of the important things to remember – is you aren’t limited by the fragments I provide.  You can (and should) make your own fragments, specializing them to your company.  For instance, one of the things you could do, is download all the fragments, and replace ##CompanyID## with your actual company ID.  This way – that is one step already eliminated in your find/replace steps.  If you ALWAYS do specific things with your classes (such as you always create classes AND groups) then you should combine these fragments into one.  It will just make it that much faster.



Let the “easy series” begin.  Smile




  1. Graham

    Hi Kevin,

    I created a MP for monitoring windows applications using Fragments which is working great, used most of the Fragments for the various components, seed discoveries, groups, monitories, rules etc. When importing “Class.And.Discovery.Registry.KeyExists.mpx” into my MP then importing into SCOM Console with no toehr components in the MP at this point, immediately the application is discovered and the servers can be seen under “Discovered Inventory” against the Class, albeit not monitored to be expected but, I can see the discovery is working.

    I have now a task to build a MP for UNIX/Linux and imported the Fragment “Class.And.Discovery.Unix.FileExists.mpx”, however see no discovered servers under “Discovered Inventory” against the Class. The UNIX Solaris and Red Hat servers are in the Console and are all of State=Healthy. The file path and file name are correct in the Discovery and exist on the servers. Should I be seeing the Servers being Discovered at this point as with the Windows App MP? I just didn’t want to move on with creating other discoveries and monitors etc., if there should be results at this stage, and I need to troubleshoot now rather than later. Thanks for any insight into the UNIX File Exists Class and Discovery behaviour.

  2. Graham

    Interesting, the sudoers file is correct, the Servers discover ok, and the Agent installs fine, and the servers are monitoring as Healthy. There are no monitor errors or alerts for processes that are being monitored – sshd, rpcbind, nscd, syslogd so assuming permissions look to be correct if processes are monitoring ok and performance metrics are being collected ok?

      • Graham

        So for > ls $Config/AppPath$ | wc -l
        running shell command in putty > ls /opt/tivoli/tsm/client/ba/bin/dsm.sys | wc -l
        returns 1

        Just to clarify, I logged in as the SCOM monitoring account and ran the shell command in a putty session and “1” is returned…

  3. Graham

    So for > ls $Config/AppPath$ | wc -l
    running shell command in putty > ls /opt/tivoli/tsm/client/ba/bin/dsm.sys | wc -l
    returns 1

  4. Graham

    Just to clarify, I logged in as the SCOM monitoring account and ran the shell command in a putty session and “1” is returned…

  5. Pim

    hi Kevin, I have a jobscheduler which generates an event in the Windows Application Log. There is no counter event, but I want to influence the Health of an object. I cannot use the Windows Server class because we will miss other issues with the server. I created a Manual Reset Monitor which works great but I think I need a custom class (like job class for instance). Can you help me in the right direction? (which MP fragments etcetera). Thanks in advance.

    Pim, SCOM Admin

  6. Brian Wright

    I have a question regarding your fragment “Class.And.Discovery.Script.ByServerName.mpx” For the ComputerNameList is it possible to use wildcards or a regex expresstion in the comma separated list. If so what would be the syntax.

    • Kevin Holman

      It is possible – but the way it is written would have to be changed. I started down this path and not using a script at all, but found it incredibly difficult as most of my customers are no Regex wizards, and ultimately we determined it would be easier to just use a comma separated explicit naming, rather than troubleshooting Regex outputs.

      If you are going to use Regex – you and use a different module and not need powershell, but a simple discovery like registry or WMI even. Or you can use regex condition detection along with or inside powershell. But it would need some development in the overall solution.

  7. Patrick

    I’m using your Monitor.Unix.ShellCommand.mpx fragment to create a two state monitor for memory consumption. I would like to add overrides for the error state, how can I do so?

      • Patrick

        A lot of people at my company want a percent based memory monitor. They don’t understand why that’s not a thing in SCOM when so many other monitoring products have this. So I’m left creating a custom monitor. At first I created a Unix/Linux Shell Command Two State Monitor to determine the memory on a machine and alert when it’s above 80%. The problem is, some people think that’s too low and want a 90% threshold. There is no way to override the healthy, or error expression on this monitor. So I have to create another one when somebody wants a new threshold. I was hoping there would be a way to resolve this by using your fragment.

  8. Christian

    when using the cat file discovery fragments for Unix, the discovery script always runs as the SCOM Server Action Account (which I see in the event log). How can you confirm if the Unix Privileged Account is being used to actually read the file? i.e. it needs to use the Unix Run As account to detect the existence of the file, the SCOM action account doesn’t have permissions.

  9. Ian Blyth

    I use Rule.Performance.Collection.Perfmon.mpx (A RULE to collect performance data from native perfmon.) fragment a lot for creating performance views in SCOM. Unfortunately I have come to realise that this does not work for CPU % as it multiplies by the number of CPUs and gives a misleading graph. I found a blog post from you about it 2010. I am sure I must have read but obviously forgotten.

    However you have blogged about the ScaleBy option and I found out that is used in the Authoring Templates – Process Monitoring and Windows Service. The trouble with these templates is they setup discoveries for the process/service and you have to use a group to do the filtering. I would prefer to target a custom role that I have created for custom application.

    Can I suggest that you put a warning in the rule fragment not to use it for CPU and create a new rule fragment just for CPU collection that uses

    That would be much appreciated.

  10. Ian Blyth

    I checked adding the scaleby line to Rule.Performance.Collection.Perfmon.mpx and it worked for using with CPU % rule collection so I have created a separate fragment with a new name and the scaleby line.
    I still thing that a warning needs to go into the original fragment not to use it with CPU % for process/service.

  11. Pingback:Copy SCOM monitors inside sealed management packs | SCOM Maintenance Mode Scheduler

  12. Brian

    Hi Kevin,
    We have been using SCOM to monitor our systems for 5 years now and have learned a lot through your blogs. Thanks!!!
    Our current version is SCOM 2016 UR9.
    We recently started using Visual Studio 2019 and your VSAE fragments to create custom Windows service alerts for our applications.
    Where we are running into issues creating a custom class for the Windows servers that make up the applications. Part 2 of your steps above.
    We can’t seem to find a fragment that will isolate and create a class of servers that make up a given application.
    We do have unique names for our servers. Each server has a 4 letter designation with the name of the server that identifies and associates it with an application.
    An example would be zxswXXXXdbpr01. Where XXXX would be the reference to the application and is in the location on every server.
    It would be great if we could key off that information from within the registry.
    Thanks in advance!

  13. Pingback:SCOM Resource Pools, part 1: how & why to create one - Monitoring Stuff

Leave a Reply

Your email address will not be published. Required fields are marked *