Summary

This post describes how to access performance data from SCOM via PowerShell.

Introduction

One of the most useful elements of SCOM’s monitoring is the collection and storage within SCOM of monitored system’s performance data. This collection allows a SCOM operator to access and compare performance data from monitored systems within the SCOM console’s views and reports. Being able to view historical and trending performance data can be very useful when investigating system issues or justifying additional purchases. For the majority of users, accessing this data via the console and reports are all that is needed.

Using PowerShell, we can also access any of the performance data stored within SCOM’s operational database for use in scripted processes, custom monitors, or more. The means to get the performance data does require a light understanding of SCOM’s data model, but no moreso than building views or reports. In this post, we’ll provide examples on how to access performance data within SCOM via PowerShell.

Finding the Data

In order to access performance data with PowerShell, the first prerequisite is knowing which type of object, or class, is going to contain the desired performance data. This is no different from accessing the data via a view, though it does require understanding where SCOM stores performance data.

The key to remember is that SCOM is an application-focused monitoring program. When SCOM monitors a computer, it doesn’t see the computer as a flat plane, but rather as a collection of different types of objects. For example, a single computer will be seen by SCOM as a “computer” object, an “operating system” object, a collection of “logical disk” objects, and more. This model allows SCOM to target its monitoring workflows at the specific object types relevant to those workflows, rather than targeting application-specific workflows at computers regardless of whether or not that application is present. SCOM won’t attempt to monitor Exchange processes on a server where Exchange is not installed – the “Exchange Server” object won’t be present, so monitoring workflows targeting that “Exchange Server” object won’t run, as there will be no target for them to run against.

What this means is that SCOM’s performance collection workflows all target specific object types. When the collected performance data is stored in SCOM, it is associated with the instance of the object which spawned it. One doesn’t need to worry that logical disk performance counters on a computer with multiple disks will overlap with one another because each data set is associated with a specific disk, not with the computer hosting that disk.

The short takeaway here is that the first step to access performance data with PowerShell is to know the type of class where the data will be stored. To collect this information, all that is needed is to look at the configuration of the performance collection rule within SCOM and note the rule’s target.

Let’s use an example of the “% Processor Time” counter. If we search for performance collection rules which capture that counter, we’ll find that there are several – one for each version of the Windows operating system. In this screenshot, you can see the rule I’ve selected (“Processor Information % Processor Time Total Windows Server 2012 R2”) and the Target of that rule.

We can see that this rule targets the class “Windows Server 2012 R2 Operating System”. Now we know where to find our data.

Retrieving an Object

Since we know where our desired performance collection data can be found, we can dive into PowerShell to access it. In our example, the “% Processor Time” data will be contained by the “Windows Server 2012 R2 Operating System” class, so we’ll begin by retrieving an instance of that class.

$Class = Get-SCOMClass -DisplayName "Windows Server 2012 R2 Operating System"
$ClassInstance = Get-SCOMClassInstance -Class $Class | Select-Object -First 1

In the above example, I’m simply isolating the first class instance returned. If you need to retrieve a specific class instance, there are several ways it can be done. Here are two:

Method 1: Filter the Class Instances based on Host Computer Name

$Class = Get-SCOMClass -DisplayName "Windows Server 2012 R2 Operating System"
$ClassInstance = Get-SCOMClassInstance -Class $Class | ?{$_.'[Microsoft.Windows.Computer].PrincipalName'.Value -eq "ComputerName.Domain.com"}

Method 2: Retrieve the Base Computer Class Instance, then Retrieve the Hosted Windows Server 2012 R2 Class Instance

$ComputerInstance = Get-SCOMClassInstance -DisplayName "ComputerName.Domain.com" | ?{$_.GetClasses().DisplayName -eq "Windows Computer"}
$ClassInstance = $ComputerInstance.GetRelatedMonitoringObjects() | ?{$_.GetClasses().DisplayName -eq "Windows Server 2012 R2 Operating System"}

Regardless of what method you choose, in our example, we now have an class instance containing our desired performance data saved to the $ClassInstance variable.

Retrieving the Data

Now that we have an object to work with, the next step is to retrieve the performance data. To do this, we need to use the GetMonitoringPerformanceData method. This method will return MonitoringPerformanceData objects for each of the performance counters attached to the class instance. We can get a list of each of the available counters via this method:

$ClassInstance.GetMonitoringPerformanceData() | Select CounterName

The following image shows the available counters in my test SCOM environment:

We need to isolate the counter for which we want to access performance data. To do that, we can use a simple Where-Object filter (here represented with the alias, “?“):

$PercentProcessorTime = $ClassInstance.GetMonitoringPerformanceData() | ?{$_.CounterName -eq "% Processor Time"}

Now that we have the counter object isolated, we can use the GetValues method to retrieve the performance data. As described on the MSDN page for this method (link here), we need to provide a start date and an end date in the format of datetime objects. In my example below, I will use the Get-Date cmdlet to set the end date as the current time and the start date as 6 hours prior to then.

$SampleStartTime = (Get-Date).AddHours(-6)
$SampleEndTime = (Get-Date)
$PerformanceValues = $PercentProcessorTime.GetValues($SampleStartTime,$SampleEndTime)

The $PerformanceValues variable will contain any performance samples created in the specified time frame, sorted from the oldest samples to the newest. To see the most recent value sampled, use the Select-Object cmdlet:

$PerformanceValues | Select-Object -Last 1

The result will be similar to this image:

In my example, the last sampled value was 27.80%, as seen on the SampleValue property.

Conclusion

This post has described how to access performance data within SCOM via PowerShell. Several script pieces have been provided above illustrating how to find and retrieve the data you want. The combined script is here:

## Set some values as variables
$ComputerName = 'ComputerName.domain.com'
$PerfCounterTargetClassName = 'Windows Server 2012 R2 Operating System'
$PerfCounterName = '% Processor Time'

## Retrieve the class instance containing the performance data
$ComputerInstance = Get-SCOMClassInstance -DisplayName $ComputerName | ?{$_.GetClasses().DisplayName -eq "Windows Computer"}
$ClassInstance = $ComputerInstance.GetRelatedMonitoringObjects() | ?{$_.GetClasses().DisplayName -eq $PerfCounterTargetClassName}

## Retrieve the performance counter data
$PercentProcessorTime = $ClassInstance.GetMonitoringPerformanceData() | ?{$_.CounterName -eq $PerfCounterName}

## Retrieve the performance samples
$SampleStartTime = (Get-Date).AddDays(-6)
$SampleEndTime = (Get-Date)
$PerformanceValues = $PercentProcessorTime.GetValues($SampleStartTime,$SampleEndTime)

## View the most recent sample
$PerformanceValues | Select-Object -Last 1

Hopefully, this has demonstrated all you need to know in order to use PowerShell to access performance data in SCOM. If you have any questions, please post them below. Happy SCOMming!