no on premise os “ecks” sccm zed yes on premises os “ten” (os x) configmgr zee get it right!
TRANSCRIPT
No
On PremiseOS “Ecks”SCCMZed
Yes
On PremisesOS “Ten” (OS X)ConfigMgrZee
Get It Right!
Collection Evaluation and SuchSession Subtitle
Kim OppalfensTwitter HandleBlog or e-mail address
Jason Sandys@[email protected]
#MMSMOA
@TheWMIGuy
Junior Consultant (Job Titles go by Age)
• 17 years professional experience
• 12 years CM
• 10+ years MVP
Belgium
Kim Oppalfens
#MMSMOA
@jasonsandys
Principal Consultant 15+ Years
San Antonio, TX
Jason Sandys
Forums, Blog
OverviewA-F H-M O-S V-Z
.ADC files Historical Behavior One Million x 10 Collection evaluation Viewer
Best/Bad practices Incremental Update Stored Procedures Why are you here
Colleval.log Jason Collection Queries EXclusion rules
Direct Membership Kim RBA YOLO
Extended Events (SQL)
Limiting Collections Sql TempDB Z or Zed
Full update evaluation
Manual Update Membership
Sql Triggers
Collection_G Non-Indexed fields .Udc files in inbox
J
Why Do We Care
Collections are the core of most everything
Collection basics have changed drastically
The exact behavior of updates isn’t exactly deeply documented
J
Rule Types
Direct Membership Effects
Collection A
ResourceID
Collection A
Full Collection EvaluationOn Collection A
J
Include and Exclude Rules
Collection A
Collection B
Collection C
Include
Exclude
Depends On
Depends On
Collection X
Limited To
Depends On
J
Collection Evaluation in Hierarchies
CAS
Reason #513 why not to use a CAS unless you have to
Primary Site A Primary Site B
Collection evaluation occurs on the primary sites
J
Collection Membership Evaluation
DemoLogs & Tools
J
Collection Evaluation Types
FullIncrementalManual
Primary evaluationExpress evaluationSingle evaluationAuxiliary evaluation
J
Full Collection Evaluation Overview
K
Collection Rules
Queries
Dependency Chain Graph
Temp Table CollectionMembersTable
v_R_System_ValidView
Limiting Collections and Evaluation
Direct Rules
Query Rules
Includes
Excludes }#colltemp table
K
CollectionMembers table
Applied to Limiting Collection
CollectionMembers table+ where CollectionID
Incremental Evaluation Differences
K
CollectionNotifications
DB Trigger
DB Change
CollectionMembersTable
How Many Collections with Incremental Enabled?
10,000,000 / C * 0.7
I = Incremental Collection Evaluation Interval
C -> CollectionNotifications table
C = The number of changes within I
C -> collevel.log
10,000,000
K
Items That Impact Change Rate
Hardware Inventory Frequency
Hardware Inventory Often
Changing Attributes
Discovery Frequency
v_CH_ClientSummary
J
Kill incremental evaluation with a single query
SELECT *
FROM SMS_R_System sys
INNER JOIN SMS_G_System_CH_ClientSummary CHS
ON chs.ResourceId = sys.ResourceId
WHERE chs.LastMPServerName = "EvilJoe.oscc.be"
J
Find tables causing large number of changesSELECT tablename, count(*)
FROM CollectionNotifications
GROUP BY tableName
ORDER BY count(*) DESC
Query Optimization
Optimization Hints
Do
Use indexed fields
Do Not Use LIKE with double wildcards
Use LIKE with negation queries (NOT)
Use LIKE sparingly
Create incremental collections based of CI Compliance
K
Interesting Indices
SystemResource
• Netbios Name• Sid• Client• Obsolete• Decommisioned• Active
User Discovery
• Unique User Name• User Principal
Name• Sid• Mail• Distinguished
Name• Clouduserid
Hardware Inventory: Installed Software
• MachineId• Softwareproperties
Hash• Productname• Productversion• Publisher
Hardware Inventory: Recently Used Applications
• MachineId• Filedescription• Explorerfilename• ProductName• Productcode• msidisplayname• LastUsername
K
Use Indexed Columns
USE CM_SitecodeSELECT TableName = t.name, IndexName = ind.name, IndexId = ind.index_id,
ColumnId = ic.index_column_id, ColumnName = col.name, ind.*, ic.*, col.*FROM sys.indexes ind INNER JOIN sys.index_columns ic ON ind.object_id = ic.object_id and ind.index_id = ic.index_id INNER JOIN sys.columns col ON ic.object_id = col.object_id and ic.column_id = col.column_id INNER JOIN sys.tables t ON ind.object_id = t.object_id WHERE ind.is_primary_key = 0
AND ind.is_unique = 0 AND ind.is_unique_constraint = 0 AND t.is_ms_shipped = 0
ORDER BY t.name, ind.name, ind.index_id, ic.index_column_id
K
SQL(If we have time)
SQL Internals
Use SQL extended events to monitor SMS_Collection_evaluator
CM_Sitecode - The trigger happy database
Enable Verbose logging for the sms_collection evaluator
J
Use SQL extended events to monitor
ALTER EVENT SESSION [SMS Remote procedures executing] ON SERVER
DROP EVENT sqlserver.rpc_completed
WITH (TRACK_CAUSALITY=ON)
ALTER EVENT SESSION [SMS Remote procedures executing] ON SERVER
ADD EVENT sqlserver.rpc_completed(SET collect_statement=(1)
ACTION(package0.callstack,package0.collect_system_time,package0.process_id,sqlos.task_time,sqlserver.client_app_name,sqlserver.client_connection_id,sqlserver.client_hostname,sqlserver.client_pid,sqlserver.database_id,sqlserver.database_name,sqlserver.nt_username,sqlserver.server_instance_name,sqlserver.server_principal_name,sqlserver.server_principal_sid,sqlserver.sql_text,sqlserver.username)
WHERE ([sqlserver].[equal_i_sql_unicode_string]([sqlserver].[database_name],N'CM_KIM')))
GO
Queriesselect SMS_R_SYSTEM.ResourceID,SMS_R_SYSTEM.ResourceType,SMS_R_SYSTEM.Name,SMS_R_SYSTEM.SMSUniqueIdentifier,SMS_R_SYSTEM.ResourceDomainORWorkgroup,SMS_R_SYSTEM.Client from SMS_R_System inner join SMS_G_System_INSTALLED_SOFTWARE on SMS_G_System_INSTALLED_SOFTWARE.ResourceId = SMS_R_System.ResourceId where SMS_G_System_INSTALLED_SOFTWARE.ARPDisplayName = "Microsoft Office Professional Plus 2013"select SMS_R_SYSTEM.ResourceID,SMS_R_SYSTEM.ResourceType,SMS_R_SYSTEM.Name,SMS_R_SYSTEM.SMSUniqueIdentifier,SMS_R_SYSTEM.ResourceDomainORWorkgroup,SMS_R_SYSTEM.Client from SMS_R_System inner join SMS_G_System_INSTALLED_SOFTWARE on SMS_G_System_INSTALLED_SOFTWARE.ResourceId = SMS_R_System.ResourceId where SMS_G_System_INSTALLED_SOFTWARE.ProductName = "Microsoft Office Professional Plus 2013"
Modifications1. Installed Software
product name indexed field in where clause as opposed to Non-indexed add remove programs arpdisplaynameResult1. Query1: 102,69 seconds2. Query2: 6,3 seconds
Query based collections (1)
Queriesselect R.ResourceID,R.ResourceType,R.Name,R.SMSUniqueIdentifier,R.ResourceDomainORWorkgroup,R.Client from SMS_R_System as r full join SMS_R_System as s1 on s1.ResourceId = r.ResourceId full join SMS_R_System as s2 on s2.Name = s1.Name where s1.Name = s2.Name and s1.SID != s2.SID order by r.Nameselect R.ResourceID,R.ResourceType,R.Name,R.SMSUniqueIdentifier,R.ResourceDomainORWorkgroup,R.Client from SMS_R_System as r inner join SMS_R_System as s2 on s2.Name = r.Name where r.NetbiosName = s2.NetbiosName and r.SID != s2.SID
Modifications1. Inner joins vs full joins2. 1 additional SMS_r_system
join, not 23. Netbiosname indexed name
in where clause as opposed to Non-indexed name
4. No Order by (useless in a collection query)Result1. Query1: 153,17 seconds2. Query2: 1,1 seconds
Query based collections –duplicates (2)
OverviewA-F H-M O-S V-Z
.ADC files Historical Behavior One Million x 10 Collection evaluation Viewer
Best/Bad practices Incremental Update Stored Procedures Why are you here
Colleval.log Jason Collection Queries EXclusion rules
Direct Membership Kim RBA YOLO
Extended Events (SQL)
Limiting Collections Sql TempDB Z or Zed
Full update evaluation
Manual Update Membership
Sql Triggers
Collection_G Non-Indexed fields .Udc files in inbox
J
Evaluations: Please provide session feedback by clicking the EVAL button in the scheduler app (also download slides). One lucky winner will receive a free ticket to the next MMS!Session Title:
Discuss…
Ask your questions-real world answers!Plenty of time to engage, share knowledge.
SPO
NSO
RS