Event 4502 Log analytics customs logs not present. Unable to get blob container for CustomLog

If you get this event in your opsmgr logs.

A module of type "Microsoft.EnterpriseManagement.Mom.Modules.CloudFileUpload.CloudFileUploadWriteAction" reported an exception Microsoft.EnterpriseManagement.Mom.Modules.CloudFileUpload.FileUploadException: Unable to get blob container for CustomLog from https://omsworkspaceid.ods.opinsights.azure.com/ContainerService.svc. Will keep trying according to the specified policy. ---> System.Net.WebException: The remote name could not be resolved: 'omsworkspaceid.ods.opinsights.azure.com'
   at System.Net.HttpWebRequest.EndGetRequestStream(IAsyncResult asyncResult, TransportContext& context)
   at System.Net.HttpWebRequest.EndGetRequestStream(IAsyncResult asyncResult)
   at Microsoft.EnterpriseManagement.Mom.Modules.CloudFileUpload.CloudFileUploadWriteAction.GetRequestStreamCallback(IAsyncResult asynchronousResult)
   --- End of inner exception stack trace --- which was running as part of rule "Microsoft.IntelligencePacks.CustomLogUpload.UploadCustomLog" running for instance

Just make sure that you are able to infact connect to that url from your servers.
If you rule out any firewall issues and the url infact does not exist which was in my case.
Since I am running this in the Azure government cloud the url for me was different.
This url can be found out by opening the overrides pane in your scom console.
Scope it to "Health Service" and look in Management pack object rule- Target Object.
The parameter Endpoint url is an overridedable parameter. Get the right one from the overrides in the others
the values for these endpoints vary according to the services that they provide. Just pick the right one which shows up in your event.
OperationalData.svc/PostDataItems
/ContainerService.svc/PostDataItems
/EtwEventCollectionDataService.svc/PostDataItems

 Then open rules and again scope them to health service.Find your rule from the event. Check the highlighted last line  from above event.
Override this rule and add the EndpointUrl that pertains to your environment.

System Center management health service credentials not found Alert

The SCOM run as profiles is a collection of run as accounts and objects that they are targeted to.

You select to add a run as account and distribute it to either a Class, Group or Object.

This all works fine and well until you choose to make the distribution for the account more secure and do not select the computers where you want this account to be distributed.

I have seen customers choosing to distribute the account to all targeted objects and then not adding those in the distribution to the run as account.

This the runas profile configuration which you see when you click on the runas profiles.

This is the runas account distribution you see when you click on the run as accounts.

This particular alert will give you the account ssid which is causing the alerts.

If you do not want this account do be distributed you can close the alert and it wont appear until there is  restart for the health service on the agent.

But if you don't want this, use the following script to find the account and then add the computer to it for distribution.

$SSID = "Enter the ssid from the alert here"

Get-RunAsAccount | Sort Name | % {$string = $null;$_.SecureStorageId | % {   $string = $string + "{0:X2}" -f $_}

 $RunAsAccountName = $_.Name

 [string]$RunAsAccountSSID = $string

 if ($SSID -match $RunAsAccountSSID) {write-host "The Run As Account is .. $RunAsAccountName"}

 }

Adding or removing a new SCOM zone from Om12 agent

Using Powershell:

Remove Management group

$OMCfg = New-Object -ComObject AgentConfigManager.MgmtSvcCfg;

$OMCfg.RemoveManagementGroup("zonetoberemoved")

 

Add management group

$OMCfg = New-Object -ComObject AgentConfigManager.MgmtSvcCfg;

$OmCfg.AddmanagementGroup(‘zonenametobeadded’,'MSNamewithFQCN',5723)