Using Orchestrator to Place Servers in SCOM Maintenance Mode during SCCM patching Reboot

This post is a follow up to my previous article "Automatically Placing Servers in Maintenance Mode with SCOM Rule during SCCM patching Reboot".

This time I will share with you a simple SCORCH Runbook that will monitor a SCOM alert and place the server in Maintenance Mode if the SCCM process "CcmExec.exe " initiates a reboot.

This will help reduce unnecessary SCOM alerts such as  Failed to Connect and Unexpected Shutdown etc...

Figure 1 show the diagram or the  SCORCH runbook

Figure 1

Let's start with the first activity: Monitor Alert. You want to configure this activity to monitor 

New SCOM Alerts

Name of Alert: Detects Server Reboot

Description will contain:  CcmExec.exe 

See Figure 2 below

Figure 2

In the next activity, I am calling another runbook that will place the server in  Maintenance Mode. 

Figure 3 shows a sample runbook I created for  Maintenanc Mode

I will not go into detail on this runbook, there are plenty of examples on how to do this. In this particular runbook I have a start/stop  Maintenanc Mode

Figure 3

The next activity is optional, I am checking to see if an Ticket was created from SCOM for this alert.

I am using the map published data activity to check the SCOM field TicketId.

I then create and close a ticket in my case in HPSM, If a TicketID does not exist.

I use this for tracking purposes.

Next, I update the SCOM alert. I like to do this so I am able to get more information when checking SCOM alerts. See the fiels updated in Figure 4 to give you some ideas. I recommend you customize this piece to your environment.

Figure 4

Finally, I send the SCOM administrator an email for this event using the Send Email activity. I do this on two different checks:

1- If Maintenance Mode Fails, I capture the error in email

2- After ticket HPSM incident is created.

After rolling this runbook to production, I will replace the Send Email acitivty with send platform message.