Launch an OMS Automation Runbook on a Hybrid Worker from Orchestrator

While the Operations Management Suite (OMS) and Azure Automation are the future of process automation, there are still many customers still using System Center Orchestrator (SCO). In fact, when polling audiences I have spoken to in the last six months, they are still the majority. For customers taking their first step into hybrid cloud automation, often OMS Automation and the Hybrid Runbook Worker are that first step (OMS enables the Hybrid Runbook Worker capability for Azure Automation).

A few users have asked how to trigger Azure Automation runbooks from Orchestrator, so I thought it was time to write up a quick how-to on the easy way to meet the need. While webhooks are a great tool, only people with the URL can use it, and passing that URL around to multiple teams via e-mail and the like may be less desirable than simply letting authorized teams in your org use their Azure credentials with delegated permissions. So we will look at triggering the runbook directly in this installment.

If you want to launch an Azure Automation runbook on a Hybrid Runbook Worker from System Center Orchestrator, here is the easy way complete the task in three steps, including a parameterized PowerShell script to use in your first runbook.

Step 1: Configure Orchestrator to use the latest version of PowerShell

By default, Orchestrator wants to use an ancient version of PowerShell (v2), where you cannot successfully load the Azure PowerShell module. While you could result to more complex PowerShell scripts to work around this, MS has provided an unadvertised registry key in System Center Orchestrator that you can use to work around this. This eliminates the need for any complexity in your PowerShell script.

1. Use regedit to navigate to the following key on your runbook servers: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework

2. Add a new DWORD entry and value of: OnlyUseLatestCLR = 1

From this point on, Orchestrator will call the latest version of PowerShell. You should have PowerShell v5 if you are working with Azure Automation and OMS. I am using PowerShell 5, Azure SDK 2.9 and latest version of Azure Automation PowerShell, dated 3/30/2016.

DISCLAIMER: I have not heard from MS that this breaks the support agreement. After all, they are the ones who put the registry key there! I do know there are at least a few companies using this in production today. If concerned, always check with Microsoft directly.

Step 2: Add credentials as variables

In figure 1, you will see I have added Azure logon credentials as variables in Orchestrator. Make sure to add your password as an encrypted variable, so it is not visible to others, as shown in the image below. Also, make sure to use credentials from your Azure AD instance. Authentication with a Microsoft (Live) account via Azure PowerShell will fail.

SCO variables

Figure 1. Azure subscription username and password

Step 3: Add sample script in SCO

Here is the sample script, which you will add to a Run .Net Script activity in Orchestrator, as pictured below. Notice in the images below I have also replaced the hard-coded values of the variables for Azure user and password, as well as the Hybrid Worker Group with the appropriate script variables and parameters. I have also replaced the one parameter of a simple ‘Hello World’ Azure Automation runbook (the ‘Message’ parameter), which accepts the message of your choice and logs it to a HelloWorld.txt file on the Hybrid Worker where it runs. There are several ‘Hello World’ examples for Azure Automation available (such as this from TechNet Gallery), so grab one for testing.

TIP: By making Hybrid Worker Group a parameter in your SCO runbook, you can effectively trigger an Azure Automation runbook on hybrid workers in any datacenter in the world from a single Orchestrator instance! You will see how this is done in figures 3 and 4 below.

SCO Runbok

Figure 2. Sample SCO runbook for calling our Azure Automation runbook on a hybrid worker.

Here is a simple PowerShell script you can use in Orchestrator to trigger a runbook in your Azure Automation account. Make sure to update the value of the -AutomationAccountName in the last line of the script as well!

# Import Azure Modules
Import-Module "C:\Program Files (x86)\Microsoft SDKs\Azure\PowerShell\ResourceManager\AzureResourceManager\AzureRM.Profile\AzureRM.Profile.psd1"
Import-Module "C:\Program Files (x86)\Microsoft SDKs\Azure\PowerShell\ResourceManager\AzureResourceManager\AzureRM.Automation\AzureRM.Automation.psd"

# Authenticate with Azure AD credentials
$MyUserName=’username@yourdomain.onmicrosoft.com’
$MyClearTextPassword=’YourPassword’

# Hybrid Worker Pool
$HRWPool = 'ConfigMgrPool'
$SecurePassword=Convertto-SecureString –String $MyClearTextPassword –AsPlainText –force

$cred=New-object System.Management.Automation.PSCredential $MyUserName,$SecurePassword

Login-AzureRmAccount -Credential $cred

#Runbook parameters
$params = @{"Message"="Hello Azure Community!";}

Start-AzureRmAutomationRunbook –AutomationAccountName "contoso-testrba" –Name "Hello-World" `
-ResourceGroupName 'Default-Networking' –Parameters $params -RunOn 'ConfigMgrPool'

Notice I have replaced the values of the aforementioned hard-coded parameters, as shown in figure 4 below.

SCO Runbook Params

Figure 3. SCO Runbook Parameters

Paramized_SCO_Runbook

Figure 4. Parameterized PowerShell script in Orchestrator (Run .NET Script activity)

Step 4: Test Your SCO Runbook

To test my configuration, I’ll use the Orchestrator Runbook Tester. Once I see success reported in the Runbook Tester, I will then check Azure Automation and the HelloWorld.txt on the Hybrid Runbook Worker as an initial end-to-end validation my solution is working as intended.

Trigger Runbook

 Figure 5. Testing the runbook from the Orchestrator Runbook Tester

About 3 minutes after I started the job, I see a completed message in the Jobs area of my Azure Automation subscription, as well as an entry in HelloWorld.txt from my own Hello World runbook I use for testing.
Runbook Results

Figure 6. Runbook successfully triggered in Azure Automation and run on Hybrid Worker

That’s it for this installment. Let me know if you struggle with any of the above or have questions. Good luck!

Centralized Logging Strategy for Azure Automation Hybrid Worker with OMS

Many System Center Orchestrator administrators longed for centralized logging of Orchestrator runbook events and results. With no native centralized logging facility, many administrators used a simple SQL database as a centralized logging repository. While not ideal, this method is functional for a single data center.

Think about the challenges of implementing this strategy on a global basis. You would need either have to configure your Orchestrator runbook servers to log events to a SQL instance in a remote data center, or perhaps configure SQL replication to centralize the events after they were logged locally.

In this article, we will look at establishing a centralized runbook progress and result logging strategy for the Azure Automation Hybrid Runbook Worker using the Microsoft Operations Management Suite (OMS) that is quick, easy and searchable…no SQL database required.

In this post:

  • Hybrid Runbook Worker job logging in the Azure Portal
  • Native Logging on the Hybrid Worker
  • Why custom central logging for the Hybrid Worker?
  • Basic Custom Logging Implementation for Hybrid Worker
  • Logging runbooks events with a child runbook

Let us get down to business.

Hybrid Runbook Worker job logging in the Azure Portal

Enter the Azure Automation Hybrid Runbook Worker (hybrid worker) role, which enables Azure Automation customers to execute (run) runbooks on designated servers in their data centers around the world. The back-end infrastructure is Microsoft Azure, so implementing a global automation infrastructure is much less work than with Orchestrator.

However, the desire for detailed logging of activities on the hybrid runbook worker remains. Certainly the Jobs log (shown below) in Azure Automation shows results, inputs and outputs of runbook jobs. However, it does not provide detailed progress logging of your choosing at key points along the way.

Jobs_Log

With that in mind, the desire / need for centralized progress logging at our discretion remains.

Native runbook event logging on the Hybrid Worker

One bit of good news is that the hybrid worker includes some native logging to the Windows Event Log. You can find the log in the Windows Event Viewer under Applications and Services Logs > Microsoft-Automation > Operational.

More good news. You can easily add this log for collection by OMS in the Settings area on the Data tab. In the ‘Collect events from the following event logs’ window, type “Microsoft-Automation/Operational” and click on the plus sign (+) to add the log for collection. Then check the boxes for all three event levels.

HybWrk_Log_Collection

However, the bad news is, once this data arrives in our OMS subscription, you can see the formatting of the details in this log is less than ideal. Using the search interface, you can retrieve the contents of this log with the following query:

Type=Event EventLog=”Microsoft-Automation/Operational”

The result reveals that in the ParameterXml within the event lies the job status, but only the value (Succeeded, Failed, etc.) rather than a well-formatted name value pair we could use to extract the result into a custom field for better search. As a result, this native logging is not as useful as it could be, but can still serve to reduce the need for automation admins to use the Azure portal.

Moreover, this still does not address our need for ad-hoc progress logging hosted in a central repository.

Why custom central logging for the Hybrid Worker?

Even with the aforementioned logging, the need to log events within a runbook at key junctures remains, and this is where logging to the Windows Event Log with a custom source, with an event description detailing runbook progress or results, with output collected and forwarded to OMS. This gives us central logging without the need for a SQL database.

You can log this data to any local Windows Event Log, even the System log. One approach might be to use a couple of custom sources, such as one for logging runbook progress messages and another reporting the runbook result, both in an easily searchable format in OMS once the data has been collected and uploaded.

Basic Custom Logging Implementation for Hybrid Worker

I will describe a couple of simple approaches you could take for custom logging locally on the hybrid worker.

First, in order to write messages with a custom Windows event log source, the providers must exist. You can create custom event sources with the New-EventLog cmdlet. If you wanted, you could simply create these providers each time you deploy a new hybrid worker.

For runbook progress messages, I will write to the System event log with a source of OMSAutomation-Status. To create this new provider, simply run the following one-liner on the hybrid worker.

New-EventLog -LogName System -Source OMSAutomation-Status

For the final runbook result message, I will again write to the System log with a source of OMSAutomation-Result. To create this new provider, simply run the following one-liner on the hybrid worker.

New-EventLog -LogName System -Source OMSAutomation-Result

This approach ensures I can quickly and easily search runbook messages by event source. Then, any time you want to log a status message within your runbook, you would simply add a Write-EventLog message at the appropriate point in your runbook. Since the System log is already being collected in OMS, you do not have to configure any additional log collection in OMS.

Let’s assume that every time a runbook begins I log a message in the following format from within my PowerShell runbook on hybrid workers:

Write-EventLog -EventId 1 -LogName System -Message "Runbook $RBName is now beginning" -Source OMSAutomation-Status

Then in OMS I can find every message showing a runbook beginning with the following wildcard search:

Type=Event EventLog=System Source=OMSAutomation-Status “*now beginning “

Add | measure count() by Source and you can get a count of how many runbooks have run on hybrid workers.

Type=Event EventLog=System Source=OMSAutomation-Status “*now beginning ” | measure count() by Source

Add the computer name to filter results to a specific hybrid worker, as shown here

Type=Event EventLog=System Source=OMSAutomation-Status “*now beginning ” Computer=”VMBR01.contoso.corp” | measure count() by Source

If I wanted to find ever event where a specific runbook ran, I would simply expand the search based on my message syntax, for example.

Type=Event EventLog=System Source=OMSAutomation-Status “Runbook Hello-World is now beginning”

And finally, a search for all successful completions of a specific runbook

Type=Event EventLog=System Source=OMSAutomation-Result “Runbook Hello-World completed successfully” Computer=”VMBR01.contoso.corp” Source=OMSAutomation-Result

or any runbook, as pictured below

Type=Event EventLog=System Source=OMSAutomation-Result “*successfully” Computer=”VMBR01.contoso.corp” Source=OMSAutomation-Result

JobResult

As you can see, logging inline from within your runbook is simple, quick, easy and searchable in OMS!

Logging runbooks events with a child runbook

We could take what some might deem a slightly more elegant approach and instead call a child runbook to log the event. One advantage of this method is that we can accept the event source as an input, and check that the source exists before attempting to write the event. This means there would be no need to create the custom event sources manually. On the downside, this approach might mean slightly longer execution time, resulting in billing for a few more runbook minutes per month versus the simple inline method described above.

Here is a simple, generic and effective Windows event logging script borrowed from my friend Tao Yang. This script accepts event log name, ID, source, type and message as parameters. Before attempting to log the event, it checks for your event source on the hybrid worker. If the source does not exist, it creates the new source, then logs the event.

Param (
 [Parameter(Mandatory=$true)][string]$EventLog,
 [parameter(Mandatory=$true)][int]$EventID,
 [Parameter(Mandatory=$true)][string]$EventSource,
 [Parameter(Mandatory=$true)][string]$EntryType,
 [Parameter(Mandatory=$true)][string]$Message
)

$ExistingEventSource = Get-Eventlog -LogName $EventLog -Source $EventSource -ErrorAction SilentlyContinue
If (!$ExistingEventSource)
{
 #The event source does not exist, create it now
 New-EventLog -LogName $EventLog -Source $EventSource
}
Write-EventLog -LogName $EventLog -source $EventSource -EventId $EventID -EntryType $EntryType -Message $Message

Here is a sample usage of this runbook you can past into your Azure Automation runbooks destined for hybrid workers. This assumes you have added the above sample runbook to your Azure Automation subscription with the name Write-WindowsEvent.

.\Write-WindowsEvent.ps1 -Message 'Test message' -EntryType 'Information' -EventLog 'System' -EventSource OMSAutomation -EventID 50001

Conclusion

As you can see, Azure Automation, the new hybrid worker and OMS open the door to easy and flexible implementation of a global, hybrid runbook automation infrastructure that transcends the limitations of System Center Orchestrator. Get started with your free subscription to OMS at http://microsoft.com/oms.

Inside System Center 3: Best Free System Center Solutions – Show Notes

In this episode, Dan and Pete talk about some of the more robust free solutions for System Center 2012 R2, including a couple of gems you have not seen before! Links to all the resources discussed (and some we didn’t get to) below!

New Show Updates

To get updates on the latest episodes of Inside System Center and Inside the Microsoft Cloud, follow on twitter (@insidemscloud@insidepodcast) or like us on Facebook at http://facebook.com/insidepodcastnetwork.

Episode Links

Audio editionavailable shortly!

Video edition – https://www.youtube.com/watch?v=tKfoJ-hBv0Y

OpsMgr 2012 R2

While there are thousands of great articles and scripts and related solutions for OpsMgr, here are a few of the more function-rich freebies. A couple of lesson known solutions in here! 

NiCE Log File Monitoring MP

https://www.nice.de/log-file-monitoring-scom-nice-logfile-mp

https://www.nice.de/wp-content/uploads/2015/01/NiCE_LogFileMP_SolutionBrief_2015Q1.pdf

MP Author (Silect Software)

http://www.silect.com/mp-author
OpsMgr Self Maintenance Management Pack (by Tao Yang)

http://blog.tyang.org/2013/03/03/opsmgr-self-maintenance-management-pack/

PKI Certificate Verification MP (by Raphael Burri)

https://rburri.wordpress.com/2015/06/22/pki-certificate-verification-mp-update-1-3-0-0/

Effective Configuration Viewer (Stefan Roth)

https://gallery.technet.microsoft.com/Get-effective-configuration-753e13bd

Adding GUI Authoring Support for PowerShell Monitors in OpsMgr (Wei H Lim)

https://gallery.technet.microsoft.com/Sample-Management-Pack-17b76379

ConFigMgr 2012 R2

While most everyone is familiar with the right click tools, we discussed a couple of other (and in some cases newer)  free solutions.

RegkeyToMof

http://myitforum.com/cs2/files/folders/proddocs/entry152945.aspx

RemoteManage

http://cireson.com/apps/remote-manage/

PowerShell Inventory Script (David O’Brien)

http://www.david-obrien.net/2014/01/update-inventory-script-makes-configmgr-life-easier/

Kent Agerland’s List of Community Tools

http://blog.coretech.dk/kea/community-tools-from-system-center-universe-2014/

Service Manager 2012 R2

Here are a few of our favorites for SCSM.

SCSM Dashboards (by Signature Consultancy)

http://www.signatureconsultancy.com/scsm-dashboard.html

SCSM Entity Explorer

https://gallery.technet.microsoft.com/SCSM-Entity-Explorer-68b86bd2

Free Community Stream (from Cireson Software)

DPM

SCOM DPM Dashboard

http://www.buchatech.com/2014/04/new-scom-dpm-dashboard-download

https://gallery.technet.microsoft.com/SCOM-DPM-Dashboard-8eef9b58

SCO / SMA / AA

Automating Software License Reclamation with System Center 2012 SCCM + Orchestrator

Part 1 – Software Metering Deep Dive and Automation Part 1: Use It Or Lose It – The Basics

This installment has a quick overview of the software metering feature in case you’re not familiar.

Part 2 – Software Metering Deep Dive and Automation Part 2: Use It Or Lose It – The Collections

This installment includes the collections of those systems using an application, and another collection with systems where the application is not being used.

Part 3 – Software Metering Deep Dive and Automation Part 3: Use It Or Lose It – The Orchestrator Runbook Automation

Sample Runbooks – Automation Use Cases

https://gallery.technet.microsoft.com/Sample-Runbooks-Automation-fafd8f13

http://blogs.technet.com/b/privatecloud/archive/2013/08/12/automation-orchestrator-back-to-basics-use-cases-spotlight-1-of-5.aspx

Orchestrator Sample Runbooks: Core Examples, PowerShell Examples, and Scenario E

https://gallery.technet.microsoft.com/Orchestrator-Sample-1bbb04a5

 

Simple Self-Service App Deployment with ConfigMgr, SCOrch and SCSM

At a recent meeting of the Houston Area Systems Management User Group, I presented a strategy for delivering effective self-service application deployment that would be achievable for System Center 2012 Configuration Manager (ConfigMgr) admins could potentially implement. By intention, the solution does not require custom management pack authoring, extending Service Manager (SCSM) classes or custom PowerShell. However, it is flexible and leverages the rich capabilities of SCSM for publishing a Service Catalog. This way, any ConfigMgr admin with basic Orchestrator (SCOrch) skills who can install a basic SCSM deployment (a Management Server, database and portal server) can configure ITIL friendly self-service with System Center 2012, complete with approval routing and documentation of the request in a proper service request.

By request, I am posting the sample runbooks here for the community members.

There is a variation of my approach HERE, but in this sample I have eliminated the need for custom PowerShell script, thereby further simplifying the solution.

NOTE: You do not have to replace your service desk solution to leverage System Center for self-service. The service requests created here can pretty easily be exported with a bit of PowerShell and imported into your target ITSM system of choice.

Solution Components

Components in the solution as demonstrated were:

  • ConfigMgr 2012 R2
  • SCSM 2012 R2
  • Orchestrator 2012 R2
  • Cireson Portal (optional) – This component is 100% optional, though it reduces the required server count by 1, eliminates the need for SharePoint and provides a self-service experience across mobile devices and is much more responsive than the native portal.

What I demonstrated used User Collections in ConfigMgr.  You could tweak the solution to use computer-based collections instead.

High-level Steps

The following are the high-level

  1. Configure deployments in SCCM
  2. Import runbook in SCO
  3. Connect SCSM to SCO and ConfigMgr
  4. Select the software to make available
  5. Configure the Offering in SCSM (For SCSM newbies, see “Automation and Self-Service with SCSM” on MVA)
  6. Publish to the Service Catalog

Sample Runbook #1

In this example, we used to retrieve the user and application (app) object. The app object is represented in the SCSM database by the Package class, which is populated by the ConfigMgr Connector in SCSM, which brings over the applications you have created in ConfigMgr When you look at the last two activities, you will notice that the runbook assumes that the ConfigMgr application (represented by the Package class in SCSM) and ConfigMgr collection have the same name.

I am not going to walk through the detailed configuration steps of either sample, as you can simply download both sample runbooks, import and see for yourself.

AppDeploy

Sample Runbook #2

I was asked if it would possible to extend the solution to allow use of existing packages. The short answer is yes, by simply adding a Map Published Data activity in which you can map the name of your application in ConfigMgr to the name of the collection to populate with the account of the user requesting the software.

AppDeploy_CustomColl
Here is a shot of the properties of the Map Published Data activity in the sample runbook.

Map_Published_Data

Download Runbook Samples

The runbook samples are available in a new GIT repository I setup to store community samples in a single, centralized repository. Both sample runbooks can be found at the URL below.

https://github.com/pzerger/CommunitySamples/tree/master/Runbooks/SCO