No

On PremiseOS “Ecks”SCCMZed

Yes

On PremisesOS “Ten” (OS X)ConfigMgrZee

Get It Right!

Collection Evaluation and SuchSession Subtitle

Kim OppalfensTwitter HandleBlog or e-mail address

Jason Sandys@jasonsandysJason@sandys.us

#MMSMOA

@TheWMIGuy

Junior Consultant (Job Titles go by Age)

• 17 years professional experience

• 12 years CM

• 10+ years MVP

Belgium

Kim Oppalfens

#MMSMOA

@jasonsandys

Principal Consultant 15+ Years

San Antonio, TX

Jason Sandys

Forums, Blog

OverviewA-F H-M O-S V-Z

.ADC files Historical Behavior One Million x 10 Collection evaluation Viewer

Best/Bad practices Incremental Update Stored Procedures Why are you here

Colleval.log Jason Collection Queries EXclusion rules

Direct Membership Kim RBA YOLO

Extended Events (SQL)

Limiting Collections Sql TempDB Z or Zed

Full update evaluation

Manual Update Membership

Sql Triggers

Collection_G Non-Indexed fields .Udc files in inbox

J

Why Do We Care

Collections are the core of most everything

Collection basics have changed drastically

The exact behavior of updates isn’t exactly deeply documented

J

Rule Types

Direct Membership Effects

Collection A

ResourceID

Collection A

Full Collection EvaluationOn Collection A

J

Include and Exclude Rules

Collection A

Collection B

Collection C

Include

Exclude

Depends On

Depends On

Collection X

Limited To

Depends On

J

Collection Evaluation in Hierarchies

CAS

Reason #513 why not to use a CAS unless you have to

Primary Site A Primary Site B

Collection evaluation occurs on the primary sites

J

Collection Membership Evaluation

DemoLogs & Tools

J

Collection Evaluation Types

FullIncrementalManual

Primary evaluationExpress evaluationSingle evaluationAuxiliary evaluation

J

Full Collection Evaluation Overview

K

Collection Rules

Queries

Dependency Chain Graph

Temp Table CollectionMembersTable

v_R_System_ValidView

Limiting Collections and Evaluation

Direct Rules

Query Rules

Includes

Excludes }#colltemp table

K

CollectionMembers table

Applied to Limiting Collection

CollectionMembers table+ where CollectionID

Incremental Evaluation Differences

K

CollectionNotifications

DB Trigger

DB Change

CollectionMembersTable

How Many Collections with Incremental Enabled?

10,000,000 / C * 0.7

I = Incremental Collection Evaluation Interval

C -> CollectionNotifications table

C = The number of changes within I

C -> collevel.log

10,000,000

K

Items That Impact Change Rate

Hardware Inventory Frequency

Hardware Inventory Often

Changing Attributes

Discovery Frequency

v_CH_ClientSummary

J

Kill incremental evaluation with a single query

SELECT *

FROM SMS_R_System sys

INNER JOIN SMS_G_System_CH_ClientSummary CHS

ON chs.ResourceId = sys.ResourceId

WHERE chs.LastMPServerName = "EvilJoe.oscc.be"

J

Find tables causing large number of changesSELECT tablename, count(*)

FROM CollectionNotifications

GROUP BY tableName

ORDER BY count(*) DESC

Query Optimization

Optimization Hints

Do

Use indexed fields

Do Not Use LIKE with double wildcards

Use LIKE with negation queries (NOT)

Use LIKE sparingly

Create incremental collections based of CI Compliance

K

Interesting Indices

SystemResource

• Netbios Name• Sid• Client• Obsolete• Decommisioned• Active

User Discovery

• Unique User Name• User Principal

Name• Sid• Mail• Distinguished

Name• Clouduserid

Hardware Inventory: Installed Software

• MachineId• Softwareproperties

Hash• Productname• Productversion• Publisher

Hardware Inventory: Recently Used Applications

• MachineId• Filedescription• Explorerfilename• ProductName• Productcode• msidisplayname• LastUsername

K

Use Indexed Columns

USE CM_SitecodeSELECT       TableName = t.name,     IndexName = ind.name,     IndexId = ind.index_id,    

ColumnId = ic.index_column_id,     ColumnName = col.name,     ind.*,     ic.*,     col.*FROM       sys.indexes ind INNER JOIN       sys.index_columns ic ON  ind.object_id = ic.object_id and ind.index_id = ic.index_id INNER JOIN       sys.columns col ON ic.object_id = col.object_id and ic.column_id = col.column_id INNER JOIN       sys.tables t ON ind.object_id = t.object_id WHERE       ind.is_primary_key = 0      

AND ind.is_unique = 0      AND ind.is_unique_constraint = 0      AND t.is_ms_shipped = 0

ORDER BY t.name, ind.name, ind.index_id, ic.index_column_id

K

SQL(If we have time)

SQL Internals

Use SQL extended events to monitor SMS_Collection_evaluator

CM_Sitecode - The trigger happy database

Enable Verbose logging for the sms_collection evaluator

J

Use SQL extended events to monitor

ALTER EVENT SESSION [SMS Remote procedures executing] ON SERVER

DROP EVENT sqlserver.rpc_completed

WITH (TRACK_CAUSALITY=ON)

ALTER EVENT SESSION [SMS Remote procedures executing] ON SERVER

ADD EVENT sqlserver.rpc_completed(SET collect_statement=(1)

ACTION(package0.callstack,package0.collect_system_time,package0.process_id,sqlos.task_time,sqlserver.client_app_name,sqlserver.client_connection_id,sqlserver.client_hostname,sqlserver.client_pid,sqlserver.database_id,sqlserver.database_name,sqlserver.nt_username,sqlserver.server_instance_name,sqlserver.server_principal_name,sqlserver.server_principal_sid,sqlserver.sql_text,sqlserver.username)

WHERE ([sqlserver].[equal_i_sql_unicode_string]([sqlserver].[database_name],N'CM_KIM')))

GO

Queriesselect SMS_R_SYSTEM.ResourceID,SMS_R_SYSTEM.ResourceType,SMS_R_SYSTEM.Name,SMS_R_SYSTEM.SMSUniqueIdentifier,SMS_R_SYSTEM.ResourceDomainORWorkgroup,SMS_R_SYSTEM.Client from SMS_R_System inner join SMS_G_System_INSTALLED_SOFTWARE on SMS_G_System_INSTALLED_SOFTWARE.ResourceId = SMS_R_System.ResourceId where SMS_G_System_INSTALLED_SOFTWARE.ARPDisplayName = "Microsoft Office Professional Plus 2013"select SMS_R_SYSTEM.ResourceID,SMS_R_SYSTEM.ResourceType,SMS_R_SYSTEM.Name,SMS_R_SYSTEM.SMSUniqueIdentifier,SMS_R_SYSTEM.ResourceDomainORWorkgroup,SMS_R_SYSTEM.Client from SMS_R_System inner join SMS_G_System_INSTALLED_SOFTWARE on SMS_G_System_INSTALLED_SOFTWARE.ResourceId = SMS_R_System.ResourceId where SMS_G_System_INSTALLED_SOFTWARE.ProductName = "Microsoft Office Professional Plus 2013"

Modifications1. Installed Software

product name indexed field in where clause as opposed to Non-indexed add remove programs arpdisplaynameResult1. Query1: 102,69 seconds2. Query2: 6,3 seconds

Query based collections (1)

Queriesselect R.ResourceID,R.ResourceType,R.Name,R.SMSUniqueIdentifier,R.ResourceDomainORWorkgroup,R.Client from SMS_R_System as r full join SMS_R_System as s1 on s1.ResourceId = r.ResourceId full join SMS_R_System as s2 on s2.Name = s1.Name where s1.Name = s2.Name and s1.SID != s2.SID order by r.Nameselect R.ResourceID,R.ResourceType,R.Name,R.SMSUniqueIdentifier,R.ResourceDomainORWorkgroup,R.Client from SMS_R_System as r inner join SMS_R_System as s2 on s2.Name = r.Name where r.NetbiosName = s2.NetbiosName and r.SID != s2.SID

Modifications1. Inner joins vs full joins2. 1 additional SMS_r_system

join, not 23. Netbiosname indexed name

in where clause as opposed to Non-indexed name

4. No Order by (useless in a collection query)Result1. Query1: 153,17 seconds2. Query2: 1,1 seconds

Query based collections –duplicates (2)

OverviewA-F H-M O-S V-Z

.ADC files Historical Behavior One Million x 10 Collection evaluation Viewer

Best/Bad practices Incremental Update Stored Procedures Why are you here

Colleval.log Jason Collection Queries EXclusion rules

Direct Membership Kim RBA YOLO

Extended Events (SQL)

Limiting Collections Sql TempDB Z or Zed

Full update evaluation

Manual Update Membership

Sql Triggers

Collection_G Non-Indexed fields .Udc files in inbox

J

Evaluations: Please provide session feedback by clicking the EVAL button in the scheduler app (also download slides). One lucky winner will receive a free ticket to the next MMS!Session Title:

Discuss…

Ask your questions-real world answers!Plenty of time to engage, share knowledge.

SPO

NSO

RS