Troubleshooting - Unusual Error during Linux Agent Deployment

Symptoms:

   During the installation of SCOM agent on RHEL servers I encountered the following error message during the process of signing agent's certificate:

Exception message: Unable to create certificate context
; {ASN1 bad tag value met.
}

    The message quite unusual - apart from one previous case I could not find any other reference to this problem associated in any way with SCOM.

Resolution:

    The only suggested solution - a firewall problem has been ruled out in first place. After trying several approaches it turned out, that during certificate signing process, SCOM agent was trying to use the older versions of two particular libraries, that the ones present on the system, and failed due to this. The workaround applied was creation of the symbolic links named as the old library file pointing to the new files with the following commands and manually re-initiating certificate signing process:

cd /usr/lib
sudo ln -s libcrypto.so.1.0.1e libcrypto.so.1.0.0
sudo ln -s libssl.so.1.0.1e  libssl.so.1.0.0
sudo /opt/microsoft/scx/bin/tools/scxsslconfig -f -v

    Following up on the threads suggesting this approach (even though for a different problem) I figured out, that the problems reported to have been fixed with that script were mitigated with the release of next Cumulative Update for Management Pack for UNIX and Linux Operating Systems. After verification it turned out, that the agent binaries were taken from SCOM 2012 R2 Sp1 iso and didn't contain the latest fixes applied to the Management Pack. After downloading the latest version of the binaries the "ASN1 bad tag value" problem disappeared for all the Linux servers

SCOM Agents Migration Part 2. Migrating to Another Server within the Same Management Group

    Sometimes you might have a need to redirect the SCOM Agents to the new infrastructure after changing Management Servers.This can be done from the SCOM Console level, assuming, that:

1. You deployed the SCOM agents via Discovery from the SCOM Console, or you performed a change on the Ops DB necessary in order to be able to manage manually deployed SCOM Agents from the Console

2. The old Management Servers are still active and communicate with your Management Group

    It might happen though, that you have an SCCM Deployment, or any other way of distributing the agent, which for some reasons was not updated after the migration and deployed agents with old settings despite the SCOM infrastructure change. The situation is problematic, because by simply re-installing the agent you will not be able to change the settings. SCOM Agent keeps the old configuration and keeps trying to contact non-existing servers. Recently I posted a solution to migrate the SCOM agents to a new Management Group. You can find it here:

SCOM Agents Migration to Another Management Group

    Unfortunately this solution is not invasive enough to migrate objects within the same Management Group. SCOM is pretty persistent when it comes to keeping the configuration of the agent. When you remove the configuration and then add the new entry for the same Management Group the configuration will revert to the previous one. What needs to be done is the Health Service State flush, and the script in this post is doing this as well

Usage:

     Swap the following strings in the script below with the names from your SCOM infrastructure:

• _MGName_ - put the name of your Management Group
• _NewMGServerFQDNName_1_ - put the FQDN of the first new Management Server
• _NewMGServerFQDNName_2_ - put the FQDN of the second new Management Server

     The code has to be saved as a .vbs file and run on the SCOM client either manually or for instance via SCCM deployment

Additional Notes:

    The script as well as the previous version contains the random seed in order to spread the load between two Management Servers.

Code:

Option Explicit
On Error Resume Next

Dim objMSConfig
Set objMSConfig = CreateObject("AgentconfigManager.MgmtSvcCfg")

Dim oShell
Set oShell = CreateObject("Wscript.Shell")

Dim objMG

oShell.run "CMD /C ""NET STOP HealthService""", 0, true
oShell.run "CMD /C ""RMDIR /S /Q ""C:\Program Files\System Center Operations Manager\Agent\Health Service State.old""""", 0, true
oShell.run "CMD /C ""REN ""C:\Program Files\System Center Operations Manager\Agent\Health Service State"" ""Health Service State.old""""", 0, true


Call objMSConfig.RemoveManagementGroup ("_MGName_")

Randomize
If Rnd > 0.5 Then
    Call objMSConfig.AddManagementGroup ("_MGName_", "_NewMGServerFQDNName_1_",5723)
Else
    Call objMSConfig.AddManagementGroup ("_MGName_", "_NewMGServerFQDNName_2_",5723)
End If

Call objMSConfig.ReloadConfiguration

SCOM Agents Migration to Another Management Group

    During your adventure with System Center Operations Manager you might stumble upon the situation where you will create a brand new SCOM infrastructure just aside the already existing one. It might also happen, that after completing this task you will face one more task - the migration of SCOM agents from old Management Group to the new one. The migration might be completed by running a script on each SCOM client individually - preferably with usage of SCCM deployment. The script contains also random seed in case you would like to, as I did, randomly spread the clients among two SCOM Management Servers. The code ensures 50%/50% division of the load, but it can be adjusted according to needs with a small script modification. The same could be done in case of different number of Management Servers.

Usage:

     Swap the following strings in the script below with the names from your SCOM infrastructure:

• _NewMGName_ - put the name of your new Management Group (the target one)
• _OldMGName_ -  put the name of your new Management Group (the target one)
• _NewMGServerFQDNName_1_ - put the FQDN of the first Management Server in the target Management Group
• _NewMGServerFQDNName_2_ - put the FQDN of the second Management Server in the target Management Group

     The code has to be saved as a .vbs file and run on the SCOM client either manually or for instance via SCCM deployment

Code:

Option Explicit
On Error Resume Next

Dim objMSConfig
Set objMSConfig = CreateObject("AgentconfigManager.MgmtSvcCfg")

Dim objMGNew
Dim objMGOld

Set objMGNew = objMSConfig.GetManagementGroup ("_NewMGName_")
If Err <> 0 Then
    Randomize
    If Rnd > 0.5 Then
        Call objMSConfig.AddManagementGroup ("_NewMGName_", "_NewMGServerFQDNName_1_",5723)
    Else
        Call objMSConfig.AddManagementGroup ("_NewMGName_", "_NewMGServerFQDNName_2_",5723)
    End If
End If

Call objMSConfig.RemoveManagementGroup ("_OldMGName_")

Call objMSConfig.ReloadConfiguration