Category: SCOM

SCOMpercentageCPUTimeCounter cause CPU Spike

Blog, Operations Manager

*Originally posted at

To be honest this have existed for years, and written about back in 2014. Now, in 2017, SCOM 2016 UR2 is released the problem remains. Perhaps with greater consequence due to virtualization.

If you’re unfamiliar with the problem SCOMpercentageCPUTimeCounter.vbs (.ps1 in SCOM 2016) is a script included in the “System Center Core Monitoring” management pack, and is used as the data source for a rule and a monitor to determinate agent health by gathering ‘HealthService’ CPU usage. The rule and monitor are set to run at a fixed interval of 321 seconds (I assume the person who wrote the MP just tapped 3-2-1 on their numpad 🙂 ) and sync time set to 00:00

If you want to look at the actual code you will find  the data source on

Running this script every 5 minutes isn’t exactly a problem when you have physical servers or a small amount of virtual machines on your Hypervisor. But if you run 100 or 300VM’s on one host and each single VM start this script simultainiasly it will create it creates unnecessary load on your host. If this host is overcommitted as well CPU wait time could cause a ‘freeze’ on your tenant machines as well.

To illustrate the problem, I have attached a graph, that clearly show spikes during script execution.

vcenter host cpu spike SCOM

On a monitored computer you will see a cscript.exe process executing the following command line “c:\windows\system32\cscript.exe” /nologo “SCOMPerventageCPUTimeCounter.vbs

Cscript.exe running SCOM Cpu percentange script

Unfortunately out of the box there isn’t much to do. Sync time and interval is the only overridable parameters, and these will only help reduce the load on the agent machine itself. So if you experience CPU utilization peaks due to this script, I see only two options

  • Disable the rule and monitor
    • Then you will have to rely on the CPU utilization monitor from the operating system management pack
  • Create a new rule and monitor, using SpreadInitializationOverInterval parameter
    • Reduces load as executions occurs randomly within the set interval
    • Requires authoring skills, but possible. Some information here.

To not let this go into oblivion, I have left feedback on Operations Manager user voice. Hopefully, Microsoft will make some changes in the future. If you have suggestions or other experience please let me know and i will update accordingly.


Posted by Sheikvara

+919840688822, +919003270444


OpsMgr 2012: Disabling Rules and Monitors in Bulk in PowerShell

Blog, Operations Manager, Powershell

As with several other areas of the Operations Manager Command Shell, disabling (or enabling) rules and monitors in bulk is quite easy, and the Operations Console UI provides a way to quickly validate your results after the fact.

Six cmdlets you will need when working with overrides on rules and monitors are:

  • Get-SCOMMonitor – retrieves monitors based on -displayname or other search filters you apply
  • Get-SCOMRule – retrieves monitors based on -displayname or other search filters you apply
  • Enable-SCOMRule – Enables the rule or rules that match your search criteria.
  • Enable-SCOMMonitor – Enables the monitor or monitors that match your search criteria.
  • Disable-SCOMRule – Disables the rule or rules that match your search criteria.
  • Disable-SCOMMonitor – Disables the monitor or monitors that match your search criteria.

Let’s take a quick look at these cmdlets in action to better understand how they work and how you can verify the results of your scripts.

Disabling Rules in Bulk (sample script)

To disable rules in bulk (that target SQL DB Engine and contain “*events/sec*” in their name, you’ll need a script that performs the following steps:

  • Retrieve the management pack in which to store the overrides
  • Retrieve the class that will be targeted by the override
  • Retrieve the rules or monitors that will be disabled
  • Disable the rule or monitor

Here is the sample that disables all rules matching the “*events/sec*” filter.

NOTE: You may have already guessed that you’ll need to carefully check which rules are returned by the Get-SCOMRule line and what class they target to ensure you retrieve the correct class with Get-SCOMClass. Just to be safe, you could actually find the target of the rule using Get-SCOMRule and pass that to Get-SCOMClass.

Checking Your Work

You can view your results in the Operations Console in the Authoring space in the Overrides node.



Re-enabling Disabled Rules (sample script)

To re-enable the same rules, you can use the Enable-SCOMRule cmdlet

Checking Your Work

Again, you can view your results in the Operations Console in the Authoring space in the Overrides node.


Additional Resources

You’ll find a growing number of System Center, Cloud and PowerShell resources here on SCC in the “Master Collection of System Center PowerShell” and elsewhere. A few related Operations Manager 2012 Command Shell articles

OpsMgr 2012: Group Maintenance Mode via PowerShell (the way it should be)

OpsMgr 2012: Running a Task in Bulk Using PowerShell

OpsMgr 2012: Automating Agent Discovery and Deployment with PowerShell [sample script]

OpsMgr 2012: Identifying Computers in Active Directory without an OpsMgr Agent Installed [sample script]

OpsMgr 2012 Quick Tip: Finding servers experiencing the most heartbeat failures with PowerShell


Reference Link –

Posted By Sheikvara

+919840688822, +919003270444

Monitoring Windows Event Subscription using SCOM 2012


Event subscription is used when we want to centralize Event Logs (receiving logs from remote computers)

We can see overall Event Subcsription status by right clicking subscription and choose Runtime Status



But how to monitor this status using SCOM 2012 ?

Read on !!

This is extension of previous post

We’ll configure script based monitor,so we need management pack

We need to configure monitoring on Event Collector server ( in our case),because wecutil command is not recognized on server where Subscription is not configured.Because in Subscription server there is no installed SCOM console,we’ll connect to from SCOM server (



Authoring-Management Pack Objects-Monitors-Create a Monitor-Unit Monitor


Select Sample PowerShell Script 2 State and management pack


Make sure Monitor is disabled,target set as Windows Server



$acs = wecutil gr wec | select -Index 2

output of wecutil command  (RunTimeStatus: Active stores in $acs variable



Add the value from the variable $acs…

View original post 49 more words