Collection Evaluation and Such

Get It Right!
No
On Premise
OS “Ecks”
SCCM
Zed
Yes
On Premises
OS “Ten” (OS X)
ConfigMgr
Zee
Collection Evaluation and Such
Session Subtitle
Kim Oppalfens
Twitter Handle
Blog or e-mail address
Jason Sandys
@jasonsandys
[email protected]
Kim Oppalfens
Belgium
Junior
Consultant
(Job Titles go
by Age)
#MMSMOA
•
17 years
professional
experience
•
12 years CM
•
10+ years MVP
@TheWMIGuy
Jason Sandys
@jasonsandys
San Antonio, TX
Principal
Consultant
#MMSMOA
15+ Years
Forums, Blog
Overview
A-F
J
H-M
O-S
V-Z
.ADC files
Historical Behavior
One Million x 10
Collection evaluation
Viewer
Best/Bad practices
Incremental Update
Stored Procedures
Why are you here
Colleval.log
Jason
Collection Queries
EXclusion rules
Direct Membership
Kim
RBA
YOLO
Extended Events (SQL)
Limiting Collections
Sql TempDB
Z or Zed
Full update evaluation
Manual Update
Membership
Sql Triggers
Collection_G
Non-Indexed fields
.Udc files in inbox
Why Do We Care
Collections are the core of most everything
Collection basics have changed drastically
The exact behavior of updates isn’t exactly deeply
documented
J
Rule Types
Direct Membership Effects
Collection A
J
Full Collection Evaluation
On Collection A
Include and Exclude Rules
Collection B
Limited To
Depends On
Collection X
Collection A
Collection C
J
Collection
Evaluation
Reason
#513
why not in
to Hierarchies
use a CAS unless you have to
CAS
Primary Site A
Primary Site B
Collection evaluation occurs on the primary sites
J
Collection Membership Evaluation
Demo
Logs & Tools
J
Collection Evaluation Types
Full
Incremental
Manual
J
Primary evaluation
Express evaluation
Single evaluation
Auxiliary evaluation
Full Collection Evaluation Overview
Collection
v_R_System_Valid
View
K
Rules
Dependency Chain Graph
Queries
Temp Table
CollectionMembers
Table
Limiting Collections and Evaluation
Direct Rules
CollectionMembers table
Query Rules
Applied to Limiting Collection
#colltemp table
Includes
Excludes
K
CollectionMembers table
+ where CollectionID
Incremental Evaluation Differences
DB Trigger
DB Change
CollectionMembers
Table
K
CollectionNotifications
How Many Collections with Incremental Enabled?
10,000,000
I = Incremental Collection Evaluation Interval
C = The number of changes within I
C -> CollectionNotifications table
C -> collevel.log
10,000,000 / C * 0.7
K
Items That Impact Change Rate
Hardware Inventory
Frequency
J
Hardware Inventory
Often Changing
Attributes
Discovery Frequency
v_CH_ClientSummary
Kill incremental evaluation with a single query
SELECT
*
FROM
SMS_R_System sys
INNER JOIN
SMS_G_System_CH_ClientSummary CHS
ON chs.ResourceId = sys.ResourceId
WHERE chs.LastMPServerName = "EvilJoe.oscc.be"
J
Find tables causing large number of changes
SELECT
FROM
GROUP BY
ORDER BY
tablename, count(*)
CollectionNotifications
tableName
count(*) DESC
Query Optimization
Optimization Hints
Use indexed fields
Use LIKE sparingly
Use LIKE with double
wildcards
Use LIKE with negation
queries (NOT)
Create incremental collections based of CI Compliance
K
Interesting Indices
SystemResource
•
•
•
•
•
•
K
Netbios Name
Sid
Client
Obsolete
Decommisioned
Active
User Discovery
•
•
•
•
•
•
Unique User Name
User Principal Name
Sid
Mail
Distinguished Name
Clouduserid
Hardware Inventory:
Recently Used
Applications
Hardware Inventory:
Installed Software
•
•
•
•
•
MachineId
SoftwarepropertiesHash
Productname
Productversion
Publisher
•
•
•
•
•
•
•
MachineId
Filedescription
Explorerfilename
ProductName
Productcode
msidisplayname
LastUsername
Use Indexed Columns
USE CM_Sitecode
SELECT
TableName = t.name, IndexName = ind.name, IndexId = ind.index_id,
ColumnId = ic.index_column_id, ColumnName = col.name, ind.*, ic.*, col.*
FROM
sys.indexes ind
INNER JOIN
sys.index_columns ic ON ind.object_id = ic.object_id and ind.index_id = ic.index_id
INNER JOIN
sys.columns col ON ic.object_id = col.object_id and ic.column_id = col.column_id
INNER JOIN
sys.tables t ON ind.object_id = t.object_id
WHERE
ind.is_primary_key = 0
AND
ind.is_unique = 0
AND
ind.is_unique_constraint = 0
AND
t.is_ms_shipped = 0
ORDER BY
t.name, ind.name, ind.index_id, ic.index_column_id
K
SQL
(If we have time)
SQL Internals
Use SQL extended events to monitor
SMS_Collection_evaluator
CM_Sitecode - The trigger happy
database
Enable Verbose logging for the
sms_collection evaluator
J
Use SQL extended events to monitor
ALTER EVENT SESSION [SMS Remote procedures executing] ON SERVER
DROP EVENT sqlserver.rpc_completed
WITH (TRACK_CAUSALITY=ON)
ALTER EVENT SESSION [SMS Remote procedures executing] ON SERVER
ADD EVENT sqlserver.rpc_completed(SET collect_statement=(1)
ACTION(package0.callstack,package0.collect_system_time,package0.process_id,sqlo
s.task_time,sqlserver.client_app_name,sqlserver.client_connection_id,sqlserver.
client_hostname,sqlserver.client_pid,sqlserver.database_id,sqlserver.database_n
ame,sqlserver.nt_username,sqlserver.server_instance_name,sqlserver.server_princ
ipal_name,sqlserver.server_principal_sid,sqlserver.sql_text,sqlserver.username)
WHERE
([sqlserver].[equal_i_sql_unicode_string]([sqlserver].[database_name],N'CM_KIM'
)))
GO
Query based collections (1)
Queries
select
SMS_R_SYSTEM.ResourceID,SMS_R_SYSTEM.Reso
urceType,SMS_R_SYSTEM.Name,SMS_R_SYSTEM.S
MSUniqueIdentifier,SMS_R_SYSTEM.ResourceDom
ainORWorkgroup,SMS_R_SYSTEM.Client from
SMS_R_System inner join
SMS_G_System_INSTALLED_SOFTWARE on
SMS_G_System_INSTALLED_SOFTWARE.ResourceI
d = SMS_R_System.ResourceId where
SMS_G_System_INSTALLED_SOFTWARE.ARPDispl
ayName = "Microsoft Office Professional Plus
2013"
select
SMS_R_SYSTEM.ResourceID,SMS_R_SYSTEM.Reso
urceType,SMS_R_SYSTEM.Name,SMS_R_SYSTEM.S
MSUniqueIdentifier,SMS_R_SYSTEM.ResourceDom
ainORWorkgroup,SMS_R_SYSTEM.Client from
SMS_R_System inner join
SMS_G_System_INSTALLED_SOFTWARE on
SMS_G_System_INSTALLED_SOFTWARE.ResourceI
d = SMS_R_System.ResourceId where
SMS_G_System_INSTALLED_SOFTWARE.ProductN
ame = "Microsoft Office Professional Plus 2013"
Modifications
1. Installed Software
product name indexed
field in where clause as
opposed to Non-indexed
add remove programs
arpdisplayname
Result
1. Query1: 102,69 seconds
2. Query2: 6,3 seconds
Query based collections –duplicates (2)
Queries
select
R.ResourceID,R.ResourceType,R.Nam
e,R.SMSUniqueIdentifier,R.ResourceD
omainORWorkgroup,R.Client from
SMS_R_System as r full join
SMS_R_System as s1 on
s1.ResourceId = r.ResourceId full join
SMS_R_System as s2 on s2.Name =
s1.Name where s1.Name = s2.Name
and s1.SID != s2.SID order by r.Name
select
R.ResourceID,R.ResourceType,R.Nam
e,R.SMSUniqueIdentifier,R.ResourceD
omainORWorkgroup,R.Client from
SMS_R_System as r inner join
SMS_R_System as s2 on s2.Name =
r.Name where r.NetbiosName =
s2.NetbiosName and r.SID != s2.SID
Modifications
1. Inner joins vs full joins
2. 1 additional SMS_r_system
join, not 2
3. Netbiosname indexed name
in where clause as opposed
to Non-indexed name
4. No Order by (useless in a
collection query)
Result
1. Query1: 153,17 seconds
2. Query2: 1,1 seconds
Overview
A-F
J
H-M
O-S
V-Z
.ADC files
Historical Behavior
One Million x 10
Collection evaluation
Viewer
Best/Bad practices
Incremental Update
Stored Procedures
Why are you here
Colleval.log
Jason
Collection Queries
EXclusion rules
Direct Membership
Kim
RBA
YOLO
Extended Events (SQL)
Limiting Collections
Sql TempDB
Z or Zed
Full update evaluation
Manual Update
Membership
Sql Triggers
Collection_G
Non-Indexed fields
.Udc files in inbox
Discuss…
Ask your questions-real world answers!
Plenty of time to engage, share knowledge.
Evaluations: Please provide session feedback by clicking the EVAL button in the scheduler app (also
download slides). One lucky winner will receive a free ticket to the next MMS!
SPONSORS
Session Title:

Download Report