SCOM Visual Studio Authoring – Basic Class Discovery

Today I’ll be going over a basic class discovery using Visual Studio. This discovery populates a class “RegistryDiscovery.PrintSpoolerComputer.Class” which represents the print spooler service on a server.

A copy of the Visual Studio project can be downloaded here:


Classes contain objects for targeting in SCOM

Class XML example for an instance of a print spooler service object below:


The class XML above defines the target in the console screen shot below. Classes are used as target objects for rules, monitors, views, discoveries… all kinds of stuff within SCOM.


Class schema documentation:

The <ClassType> element within the XML is used to define a class.

  •  ID – This is used to reference the class within a management pack .
  • Accessibility – This determines whether or not the class is able to be used publicly (can be used by other management packs) or privately (within the management pack it resides in only).
  • Abstract – As far as I understand it, true means that the class can only be used as a base class for other classes to use and can not be targeted directly for instance population. We’ll be using false here.
  • Base – This is the class you base your class off of. So if my class could potentially contain spooler services on any windows server I’ll want to base my class off of one that contains all windows servers.
  • Hosted – More on that here:
  • Singleton – True, the class is represented by one instance object. This is used for groups and distributed applications. False, the class has many instances which is what we’ll use here.
  • Class Property schema documentation:
    • ID – This is the name used to reference a property of the class, “StartupType” for this one.
    • Key – This is generally used when you need to differentiate multiple instances of one base targeted object. For example if your class is a logical drive and your base class is windows computer you could use the drive letter as the key property because multiple drive instances can belong to a computer object and you need a unique identifier between them. If you are only expecting a one to one ratio of instance discovery from the base class a key shouldn’t be necessary
    • Type – is the property a string, Boolean value, integer etc


Discoveries are used to populate a class.

Discovery XML below:


Discovery schema documentation:

  • Discovery
    • ID – This is used to reference the discovery within a management pack.
    • Target – This is the class you are targeting the discovery against. I want to discover all the spooler services for all windows servers so “Windows!Microsoft.Windows.Server.Computer” is appropriate here.
    • Remotable – Whether or not the discovery should run for agentless monitoring. don’t worry about this one for now. false is fine.
    • Enabled – Do you want the discovery enabled by default or not? Yes for this MP, but no if you’re looking to have the discovery disabled by default.
  • Category – Represents the category of the discovery. Shockingly you should always use discovery for a discovery.
  • DiscoveryTypes – defines the class/property that the discovery is populating.
    • DiscoveryClass – The class being populated “RegistryDiscovery.PrintSpoolerComputer.”
      • Property – The property(ies) you are populating for the discovered class
  • DataSource – This determines the datasource you want to use for the discovery. Schema documentation:
    • ID – In the example above, “DS” is just what I gave as an ID to reference for the TypeID “Windows!Microsoft.Windows.FilteredRegistryDiscoveryProvider” within the data source configuration. Its a choose your own ID kind of thing.
    • TypeID – How this works will become a little more clear in the next blog as we’ll be creating custom scripted data sources but for this example I’m referencing (more on references a little bit later in this blog entry) a data source “Windows!Microsoft.Windows.FilteredRegistryDiscoveryProvider” used for registry based discoveries which is found in the “Microsoft.Windows.Library” management pack.

Now on to the registry discovery configuration which happens to have schema documentation provided by Microsoft as they were nice enough to include along with their DataSource:

RegistryAttributeDefinitions – Multiple registry keys/values can be interrogated in a discovery configurations, in this example I’ll be looking for 2.

  • RegistryAttributeDefinition
    • AttributeName – SpoolerKeyExists and StartupType. These are the names given to each of the attributes I’m discovering. Their names only serve the purpose of providing a reference to each attribute being discovered.
    • Path – The key/value you’re validating or gathering from the registry
    • PathType – 0/1 key or value (consult the data source documentation link above for details)
    • AttributeType –
      • 0—Boolean
      • 1—String
      • 2—Integer
      • 3—Float
  • Frequency – How often in seconds the discovery runs. The shorter the interval the more overhead that is caused, try to keep short intervals to a minimum especially against large target sets.
  • ClassID – This is the class the discovery will populate
  • InstanceSettings – configures which class properties are set by the discovery
    • Name – The class property that you will set
    • Value – The value assigned to the property.
      • StartupType is set from the value gathered by the corresponding RegistryAttributeDefinition.
      • PrincipalName and DispayName I think are used to define rollup and are pulled from the referenced target class hierarchy.
  • Expression – This determines the criteria by which the class is discovered, in this case its checking if the value of SpoolerKeyExists from the RegistryAttributeDefinition is true

Ok, so that’s a basic registry discovery. If you want to seal your MP create a key file (it can be used for over and over again for every MP you create:

  • After that, in Visual Studio click on “project”
  • Then “<MP Name> Properties..”
  • Choose the checkbox for “Generate sealed and signed management pack”
  • Browse to the key file you created
  • done!


Next time we’ll delve deeper and go over discoveries based off powershell and VBScript.

SCOM Visual Studio Authoring – Site Index


Leave a Reply

Fill in your details below or click an icon to log in: Logo

You are commenting using your account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s