FAQ: How can I tell which servers are physical or virtual in SCOM?


 

This comes up all the time in conversations I have. 

Q:  How can I tell which monitored servers are a VM or a Physical Machine, including VMWare virtual machines?

A:  We need to disable a discovery, and add a new customized one in a management pack to accomplish this:

 

There is a property of the Windows Computer class, called “Virtual Machine”.  However, out of the box, we only discover this value and populate it IF the system is running on Hyper-V.  You can see my screenshot below easily which are definitely VM’s (true) and which are not populated, and likely physical:

 

image

 

This is populated by a discovery, in the Microsoft.SystemCenter.Internal.mp, named “Discover if Windows Computer is a Virtual Machine” with the ID of Microsoft.SystemCenter.DiscoverIsVirtualMachineTrue.    Our built in MP simply has a discovery, that populates this value to true, IF the following WMI query returns valid results: 

SELECT Name FROM Win32_BaseBoard WHERE Manufacturer = "Microsoft Corporation"

This is great if you are running Hyper-V, but has two shortcomings:

1.  It does not populate the value if the monitored OS is running on some other HyperVisor, such as VMware.

2.  It does not discover a “false” value, which is needed, since any machine that never runs the query, or has busted WMI, will show up as “NULL”, and this isn't accurate, it makes them all look like physical.

 

 

Ages ago – Pete Zerger posted a nice fix for this, in the form of a very popular community MP:

http://www.systemcentercentral.com/pack-catalog/virtual-machine-discovery-mp-for-operations-manager-2007/

This MP does three things:

1.  Contains a discovery that sets the value to TRUE if we detect the VM runs on VMware via WMI query:  SELECT * FROM Win32_ComputerSystem WHERE Manufacturer = "VMware, Inc."

2.  Contains another discovery that sets the value to FALSE if SELECT * FROM Win32_BaseBoard WHERE Manufacturer <> "Microsoft Corporation" OR Manufacturer <> "VMware, Inc."

3.  Sets an override on the built in discovery to disabled.

 

The above solution is simple, effective, but not perfect.  There are many comments there about things to change to work better.  The second discovery – which has an OR statement causes EVERYTHING to get set to false, in my environment.  This should be set to an AND statement.

Additionally, the “true” value and “false” values come from different places in WMI, which probably isn't the best way to ensure we don’t get any flip/flop.

Lastly, the MP doesn’t work well out of the box for Hybrid environments either, where you have VM’s from Hyper-V and VMware, because the “true” is only being set for VMware systems.

 

A better solution would be something like this:

1.  Discovery that sets the value to “true” if we detect the Manufacturer is “Microsoft Corporation” OR “VMware, Inc.”

SELECT * FROM Win32_ComputerSystem WHERE Manufacturer = "VMware, Inc." OR Manufacturer = "Microsoft Corporation"

2.  Discovery that sets the value to “false” if we detect the Manufacturer is NOT “Microsoft Corporation” AND ALSO NOT “VMware, Inc.”

SELECT * FROM Win32_ComputerSystem WHERE Manufacturer <> "VMware, Inc." AND Manufacturer <> "Microsoft Corporation"

3.  Override to disable the built-in discovery for Virtual Machine attribute.

 

Here is an example of the tweaks:

 

<Discoveries> <Discovery ID="Virtual.Machine.Discovery.Custom.IsVirtualMachineVMware" Enabled="true" Target="Windows!Microsoft.Windows.Computer" ConfirmDelivery="true" Remotable="true" Priority="Normal"> <Category>Custom</Category> <DiscoveryTypes> <DiscoveryClass TypeID="Windows!Microsoft.Windows.Computer"> <Property TypeID="Windows!Microsoft.Windows.Computer" PropertyID="IsVirtualMachine" /> </DiscoveryClass> </DiscoveryTypes> <DataSource ID="Discover.IsVirtualMachine.VMware" TypeID="Windows!Microsoft.Windows.WmiProviderWithClassSnapshotDataMapper"> <NameSpace>\\$Target/Property[Type="Windows!Microsoft.Windows.Computer"]/NetworkName$\ROOT\CIMV2</NameSpace> <Query><![CDATA[SELECT * FROM Win32_ComputerSystem WHERE Manufacturer = "VMware, Inc." OR Manufacturer = "Microsoft Corporation"]]></Query> <Frequency>86400</Frequency> <ClassId>$MPElement[Name="Windows!Microsoft.Windows.Computer"]$</ClassId> <InstanceSettings> <Settings> <Setting> <Name>$MPElement[Name="Windows!Microsoft.Windows.Computer"]/PrincipalName$</Name> <Value>$Target/Property[Type="Windows!Microsoft.Windows.Computer"]/PrincipalName$</Value> </Setting> <Setting> <Name>$MPElement[Name="Windows!Microsoft.Windows.Computer"]/IsVirtualMachine$</Name> <Value>true</Value> </Setting> </Settings> </InstanceSettings> </DataSource> </Discovery> <Discovery ID="Virtual.Machine.Discovery.Custom.DiscoverIsVirtualMachineFalse" Enabled="true" Target="Windows!Microsoft.Windows.Computer" ConfirmDelivery="true" Remotable="true" Priority="Normal"> <Category>Custom</Category> <DiscoveryTypes> <DiscoveryClass TypeID="Windows!Microsoft.Windows.Computer"> <Property TypeID="Windows!Microsoft.Windows.Computer" PropertyID="IsVirtualMachine" /> </DiscoveryClass> </DiscoveryTypes> <DataSource ID="Virtual.Machine.DiscoverIsVirtulMachineFalse" TypeID="Windows!Microsoft.Windows.WmiProviderWithClassSnapshotDataMapper"> <NameSpace>\\$Target/Property[Type="Windows!Microsoft.Windows.Computer"]/NetworkName$\ROOT\CIMV2</NameSpace> <Query><![CDATA[SELECT * FROM Win32_ComputerSystem WHERE Manufacturer <> "VMware, Inc." AND Manufacturer <> "Microsoft Corporation"]]></Query> <Frequency>86400</Frequency> <ClassId>$MPElement[Name="Windows!Microsoft.Windows.Computer"]$</ClassId> <InstanceSettings> <Settings> <Setting> <Name>$MPElement[Name="Windows!Microsoft.Windows.Computer"]/PrincipalName$</Name> <Value>$Target/Property[Type="Windows!Microsoft.Windows.Computer"]/PrincipalName$</Value> </Setting> <Setting> <Name>$MPElement[Name="Windows!Microsoft.Windows.Computer"]/IsVirtualMachine$</Name> <Value>false</Value> </Setting> </Settings> </InstanceSettings> </DataSource> </Discovery>

I am attaching the modified MP to this blog post as well.  If you have different WMI values in your own environment, you can easily tweak these two discoveries to make it work well for you.  I’d recommend you seal this MP with your own key, because you will likely use this value in computer groups in other management packs.

Virtual.Machine.Discovery.Custom.zip


Comments (11)

  1. Kevin Holman says:

    @Anon –

    Ummm this is a VERY simple WMI function in a native module….. I cant see how this could spike the CPU. How did you isolate it to this specific workflow as the culprit?

  2. Tao Yang says:

    Hey Kevin,
    I’ve also noticed a while ago that Microsoft Surface devices are also being discovered as virtual machine in SCOM, because the manufacturer is also "Microsoft Corporation". It’s probably rare for having Surface monitored by SCOM, but I thought just let everyone
    know.

  3. Diane K says:

    I am struggling with the Unix/Linux side. How can we tell if they are virtual or not? It seems like a small % of the unix/Linux agents return a value for the unix computer virtual attribute but the majority of them don’t return anything. I am unable to
    figure out what is the agent using to determine if a server is physical or virtual and how can I fix this for the other ones not returning a value for the virtual property. We are mostly a VMware shop so I am assuming I may need to go the route of creating
    a discovery specific to the VMware processes but I would like to know what Microsoft is using to determine the virtual property.

  4. Floyd says:

    This works like a charm. Thanks Kevin 🙂

  5. bezel hysek says:

    How can I fix this for the other ones not returning a value for the virtual property.
    http://www.perfectrw.com/working-chronograph-pvd-bezel-hysek-replica-watch-with-white-dial-rubber-strap-p-86868.html

  6. Anon says:

    I’ve seen the System Center Central solution to this spike CPU on 0.5% of servers to 100% for extended periods of time. I used to use it all the time… but no longer.

  7. Julian Milano says:

    In SCOM 2012, the above view is working in the Windows Computer view but you need to Personalise the view and check the Virtual Machine option.

    How do I find this MP in the AuthoringManagement Pack Objects view?

  8. Tom vergauwen says:

    Hi Kevin,

    I want to apply same thing to get the volume name of a logical disk supplied… attribute is there but is not filled in with the logical disk discoveries…

    I tried the ‘code’ beneath but this does not seems to do the trick. (I know that discovery is disabled, enabled this for a logical disk but does not seems to woork)
    To me it is a bit odd, that the attribute itself is foreseen, but not filled in with the discovery :-s

    thanks for your adviece/input

    Tom

  9. Tom Vergauwen says:

    And here’s the code/mp
    http://www.w3.org/2001/XMLSchema&quot; xmlns:xsl="http://www.w3.org/1999/XSL/Transform">

    LogicalDisk.VolumeName.Discovery.Custom
    1.0.0.2

    LogicalDisk.VolumeName.Discovery.Custom

    shortened the references

    Custom

    ROOTCIMV2
    Select * from Win32_LogicalDisk where DeviceID=’$Target/Property[Type="Windows!Microsoft.Windows.LogicalDevice"]/DeviceID$’
    86400
    $MPElement[Name="Windows!Microsoft.Windows.LogicalDisk"]$

    $MPElement[Name="Windows!Microsoft.Windows.LogicalDisk"]/VolumeName$
    $Data/Property[@Name=’VolumeName’]$

    $MPElement[Name="Windows!Microsoft.Windows.LogicalDevice"]/DeviceID$
    $Target/Property[Type="Windows!Microsoft.Windows.LogicalDevice"]/DeviceID$

    Virtual Machine Discovery (Custom)

    Discover VolumeName
    Sets the LogicalDisk VolumeName property

  10. tom vergauwen says:

    mmm… problems with posting xml of my mp :-s

  11. Lorenzo says:

    It works, thanks!
    Do you know if the isVirtual flag is available in the SCOM DWH schema as well?

    Lorenzo

Skip to main content