Remove IIS servers from SCOM monitoring

In our environment we have alot of Windows servers running IIS (Internet Information Services). Many of these servers do not need to have IIS monitoring enabled in SCOM because they are development or test servers that have their IIS services stopped, restarted, or specific sites stopped at random by developers and engineers. So, the problem I am faced with is removing these servers from IIS monitoring in SCOM (we’re using the Microsoft-provided IIS management packs) while still getting things like OS-related alerts.

To do this, create a group in SCOM under the Authoring tab. Use explicit membership and add each Windows computer object for the servers running IIS that we don’t want to monitor. Then, we need to set overrides on the object discoveries. Click on Object Discoveries in the Authoring section, and search for the following three object discovery rules:

• Windows Internet Information Services Server Role Discovery Rule (for Windows 2003/IIS 6 servers)
• IIS 7 Server Role Discovery
• IIS 8 Server Role Discovery

Right-click each of these rules, click “Overrides – Override the Object Discovery – For a group…” and select the group created in the previous step. Check the override for the “Enabled” parameter and change the value to “False.” The next time the object discovery runs, it will remove IIS monitoring for the servers in the group. (Note: By default, the object discoveries for IIS on Windows 2003 and 2012 run every hour, but for 2008/2008 R2, they run every 4 hours.)

BUT WAIT…there’s more! After the discovery runs and the IIS objects are disabled, you’ll notice that they still show up in the views, and old alerts will remain in the console. There is a powershell cmdlet you need to run in order to clean these up. Open the Operations Manager Shell and run the following:

• SCOM 2007: remove-disabledmonitoringobject
• SCOM 2012: remove-scomdisabledclassinstance

You’ll receive a warning that the operation will permanently delete class instances and relationships from the database and it can take a significant amount of time to complete. I haven’t experienced any long delays in my environment of over 700 agents, it typically takes less than one minute to complete.

If you need to add IIS monitoring back for one of these servers, simply remove it from the group you used to disable monitoring, and the IIS objects will be added back to SCOM on the next discovery cycle.