Académique Documents
Professionnel Documents
Culture Documents
Contents: Event Rules Event Monitors Repeating Event Monitors Performance Threshold Monitors Service Monitors
XML
$Data/EventDisplayNumber$ $Data/EventDescription$ $Data/PublisherName$ $Data/PublisherName$ $Data/EventCategory$ $Data/LoggingComputer$ $Data/EventLevel$ $Data/Channel$ $Data/EventNumber$
XML
$Data/Context/EventDisplayNumber$ $Data/Context/EventDescription$ $Data/Context/PublisherName$ $Data/Context/EventCategory$ $Data/Context/LoggingComputer$ $Data/Context/EventLevel$ $Data/Context/Channel$ $Data/Context/UserName$ $Data/Context/EventNumber$
XML
$Data/Context/DataItem/EventDisplayNumber$ $Data/Context/DataItem/EventDescription$ $Data/Context/DataItem/PublisherName$ $Data/Context/DataItem/EventCategory$ $Data/Context/DataItem/LoggingComputer$ $Data/Context/DataItem/EventLevel$ $Data/Context/DataItem/Channel$ $Data/Context/Context/DataItem/UserName$ $Data/Context/DataItem/EventNumber$
XML
$Data/Context/ObjectName$ $Data/Context/CounterName$ $Data/Context/InstanceName$ $Data/Context/Value$
XML
$Data/Context/Property[@Name='Name']$ $Data/Context/Property[@Name='Dependencies']$ $Data/Context/Property[@Name='BinaryPathName']$ $Data/Context/Property[@Name='DisplayName']$ $Data/Context/Property[@Name='Description']$
SNMP SNMP Probe-based Monitoring In SNMP probe-based or trap monitors, this is value youll need to add to the Parameter Name field when comparing a value returned from the probe (GET) operation. $data/SnmpVarBinds/SnmpVarBind[1]/Value$
SNMP Rules
SYSLOG Property
Facility Severity Priority PriorityName TimeStamp HostName Message
XML
$Data/EventData/DataItem/Facility$ $Data/EventData/DataItem/Severity$ $Data/EventData/DataItem/Priority$ $Data/EventData/DataItem/PriorityName$ $Data/EventData/DataItem/TimeStamp$ $Data/EventData/DataItem/HostName$ $Data/EventData/DataItem/Message$
Log File Monitor Property Log File Directory: LogFile name: String: XML $Data/EventData/DataItem/LogFileDirectory$
$Data/EventData/DataItem/LogFileName$ $Data/EventData/DataItem/Params/Param[1]$
Notifications Property
AlertID GUID Alert Name Alert category UTC Date/Time of Dataitem created LocalTime Date/Time of Dataitem created UTC Date/Time DataItem was modified Local Date/Time DataItem was modified CustomField1 CustomField2 CustomField3 CustomField4 CustomField5 CustomField6 CustomField7 CustomField8 CustomField9 CustomField10 Created by monitor? (true/false)
XML
$Data/Context/DataItem/AlertId$ $Data/Context/DataItem/AlertName$ $Data/Context/DataItem/Category$ $Data/Context/DataItem/DataItemCreateTime$ $Data/Context/DataItem/DataItemCreateTimeLocal$ $Data/Context/DataItem/LastModified$ $Data/Context/DataItem/LastModifiedLocal$ $Data/Context/DataItem/Custom1$ $Data/Context/DataItem/Custom2$ $Data/Context/DataItem/Custom3$ $Data/Context/DataItem/Custom4$ $Data/Context/DataItem/Cust2m5$ $Data/Context/DataItem/Custom6$ $Data/Context/DataItem/Custom7$ $Data/Context/DataItem/Custom8$ $Data/Context/DataItem/Custom9$ $Data/Context/DataItem/Custom10$ $Data/Context/DataItem/CreatedByMonitor$ System Center Forum | http://www.systemcenterfourm.org
Property
Recipient Name Mgmt Server Principal Name Web Console URL Workflow ID (GUID) Date/Time the Alert was resolved (UTC) Time Raised (Local) Time Raised (UTC) Time Added (Local) UTC Time Added TicketID Alert Severity ID Person resolving the alert The Resolution State Name (New, Closed) Date/Time Resolution State was last modified (Local) Date/Time Resolution State was last modified (UTC) Resolution state ID (0=New 255= Closed) Alert Repeat Count Alert Owner Managed Entity Path ManagedEntity Full name ManagedEntity Display name ManagedEntity GUID
XML
$Data/Recipients/To/Address/Address$ $Target/Property[Type="Notification!Microsoft.SystemCenter. AlertNotificationSubscriptionServer"]/PrincipalName$ $Target/Property[Type="Notification!Microsoft.SystemCenter. AlertNotificationSubscriptionServer"]/WebConsoleUrl$ $Data/Context/DataItem/WorkflowId$ $Data/Context/DataItem/TimeResolved$ $Data/Context/DataItem/TimeRaisedLocal$ $Data/Context/DataItem/TimeRaised$ $Data/Context/DataItem/TimeAddedLocal$ $Data/Context/DataItem/TimeAdded$ $Data/Context/DataItem/TicketId$ $Data/Context/DataItem/Severity$ $Data/Context/DataItem/ResolvedBy$ $Data/Context/DataItem/ResolutionStateName$ $Data/Context/DataItem/ResolutionStateLastModifiedLocal$ $Data/Context/DataItem/ResolutionStateLastModified$ $Data/Context/DataItem/ResolutionState$ $Data/Context/DataItem/RepeatCount$ $Data/Context/DataItem/Owner$ $Data/Context/DataItem/ManagedEntityPath$ $Data/Context/DataItem/ManagedEntityFullName$ $Data/Context/DataItem/ManagedEntityDisplayName$ $Data/Context/DataItem/ManagedEntity$
WMI
The following are expression matching and discovery mapper XPATH strings. In the examples below, replace WMI_PROP_NAME according to the query performed in the rule or monitor. Alert Parameter: $Data/Context/Property[@Name=WMI_PROP_NAME]$ Discovery Mapper: $Data/Property[@Name=WMI_PROP_NAME]$ Condition Expression: Property[@Name=WMI_PROP_NAME]
Feedback
4
System Center Forum | http://www.systemcenterfourm.org