PowerShelled

This blog has moved to http://ThePowerShellGuy.com Greetings /\/\o\/\/ $AtomFeed = ("Atom.xml")
$PreviousItems = (" More ACL and MSH on MSH for Fun "," Jelle "," Monad and "Jeugd sentiment" "," Monad Beta 3 Docs changes "," Get SpecialFolder Locations in Monad "," Filling Emty Properties in AD from MSH "," First Monad B3 impression and please help the scri... "," Monad Beta 3 is released ! "," Report MP3 count and size by User from MSH "," YMCK "," ")

Tuesday, January 17, 2006

Watching FSRM Quota and filescreen events from Monad

With Windows 2003 Server R2 comes FSRM (File Server Resource Manager),

(for more info White paper on storage management in R2, or about FSRM Step-by-Step Guide for File Server Resource Manager .)

you can send alerts with FSRM by Mail, Eventlogs and running a command.

but with FSRM you can also get the events by some new WMI Classes.

win32_quotalimitevent
win32_quotathresholdevent
win32_filescreenevent
win32_quotaevent

I used Get-WmiClasses from Wmi-Help Part 1 , to list them (we installed nothing more on the R2 server as FSRM)

(its easy to use this script remote by filling in the Path in the Managementscope declaration)
e.g.
$MS = new-object system.management.ManagementScope(\\server\root\cimv2)

I made 2 hashTables from this script, and did compare them like this :

MSH C:\MowMSH> $ClassesR2.keys | select @{expression={$_}; name="R2"},@{expression={$classesW2k3.ContainsKey($_.tostring())}; name="2k3"} | where {$_.'2k3' -eq $false} 

R2                                                                             2k3 
--                                                                             --- 
win32_quotalimitevent                                                        False 
win32_quotathresholdevent                                                    False 
win32_filescreenevent                                                        False 
win32_quotaevent                                                             False

from there on it was easy, I just modified this script a bit :MSH Cluster Watcher script

now it looks like this,

# watch-QuotaEvent.msh  
# watches for WMI events 
# parameters are prefilled for watching R2 FSRM events.   
# /\/\o\/\/ 2005  

'Param ($server = "server", $class = "win32_quotaevent") 
Param ($server = "server", $class = "Win32_FileScreenEvent") 

Function Main { 
  "Watching $server, Press Any Key to Quit" 
  trap {Break} 

  # Make a WMI Connection to the R2 server 

  $ms = new-object system.management.managementscope 
  $ms.path = "\\$server\root\Cimv2" 
  $ms.connect() 

  # Make Event Watcher 

  $ew = new-object system.management.ManagementEventWatcher 
  $ew.scope = $ms 
  $ew.query = "SELECT * FROM $Class WITHIN 10" 

  $opt = new-object System.Management.EventWatcherOptions 
  $opt.Timeout = [timespan]::FromSeconds(1) 
  $ew.options = $opt 

  # Wait for event : 

  while (!$host.ui.rawui.KeyAvailable){ 
    $e = $null 
    $e = $ew.WaitForNextEvent() 
    $e 
  } 
} 
. main 

you can use the parameters, but as a good admin is lazy, I just made 2 copies and prefilled the parameters ;-)

so in 10 Minutes (test-Quota where running already) I could catch Quota and Filescreen events in MSH like this :

MSH C:\MowMSH> .\FSWatch.msh 
Watching Server, Press Any Key to Quit 


FileScreenFlags      : 1 
FileScreenGroup      : Audio and Video Files 
FileScreenPath       : F:\MowTestData 
FileScreenSystemPath : \\?\Volume{3afa528a-xxxx-xxxx-xxxx-xxxxxxxxxxxx}\MowTestData 
SECURITY_DESCRIPTOR  : 
SourceFileOwner      : 
SourceFileOwnerEmail : 
SourceFileOwnerSid   : 
SourceFilePath       : F:\MowTestData\test.mp3 
SourceIoOwner        : Domain\Mow 
SourceIoOwnerEmail   : mow001@hotmail.com 
SourceIoOwnerSid     : S-1-5-21-xxxxxxxxxx-xxxxxxxxxx-xxxxxxxxx-xxxxxxx 
SourceProcessId      : 4 
SourceProcessImage   : System Process 
TIME_CREATED         : 127819666365994053 
__GENUS              : 2 
__CLASS              : Win32_FileScreenEvent 
__SUPERCLASS         : __ExtrinsicEvent 
__DYNASTY            : __SystemClass 
__RELPATH            : 
__PROPERTY_COUNT     : 15 
__DERIVATION         : {__ExtrinsicEvent, __Event, __IndicationRelated, __SystemClass} 
__SERVER             : 
__NAMESPACE          : 
__PATH               : 

######################################################### 

MSH C:\MowMSH> .\QuotaWatch.msh 
Watching Server, Press Any Key to Quit 


QuotaFlags           : 256 
QuotaFree            : 191488 
QuotaHighWaterMark   : 261952512 
QuotaHighWaterTime   : 20060117120104.452558+060 
QuotaLimit           : 262144000 
QuotaOwner           : 
QuotaOwnerEmail      : 
QuotaOwnerSid        : 
QuotaPath            : F:\MowTestData 
QuotaSystemPath      : \\?\Volume{3afa528a-xxxx-xxxx-xxxx-xxxxxxxxxxxx}\MowTestData 
QuotaUsed            : 261952512 
SECURITY_DESCRIPTOR  : 
SourceFileOwner      : 
SourceFileOwnerEmail : 
SourceFileOwnerSid   : 
SourceFilePath       : F:\MowTestData\Copy of srv03_r2_2075_usa_x86fre_adsr2.iso 
SourceIoOwner        : domain\mow 
SourceIoOwnerEmail   : mow001@hotmail.com 
SourceIoOwnerSid     : S-1-5-21-xxxxxxxxxx-xxxxxxxxxx-xxxxxxxxx-xxxxxxx 
SourceProcessId      : 4 
SourceProcessImage   : System Process 
TIME_CREATED         : 127819656645306841 
__GENUS              : 2 
__CLASS              : Win32_QuotaLimitEvent 
__SUPERCLASS         : Win32_QuotaEvent 
__DYNASTY            : __SystemClass 
__RELPATH            : 
__PROPERTY_COUNT     : 22 
__DERIVATION         : {Win32_QuotaEvent, __ExtrinsicEvent, __Event, __IndicationRelated, __SystemClass} 
__SERVER             : 
__NAMESPACE          : 
__PATH               : 

this gives the possibility do handle the events a custom way,
a very powerfull capability.

as we are testing R2 FSRM for Quota management, it is likely we need to script some policies and reports also, this is also very powerfull but there are commandlinetools for it.

main reason is we need more flexibility in mail scheduling.
(Standard 1 hour) and policy configuration.

but the scripting possibilities of FSRM look very promising for this.

gr /\/\o\/\/

Tags : Monad msh

posted by /\/\o\/\/

/\/\o\/\/ PowerShelled

Tuesday, January 17, 2006

Watching FSRM Quota and filescreen events from Monad

Archives

Links