XML Cheat Sheet

For Operations Manager and Essentials 2007

Contents:
Event Rules Notifications
Event Monitors SNMP
Repeating Event Monitors SYSLOG
Performance Threshold Monitors Log File Monitor
Service Monitors WMI

Event Rules:
Property XML
EventDisplayNumber (Event ID): $Data/EventDisplayNumber$
EventDescription (Description): $Data/EventDescription$
Publisher Name (Event Source): $Data/PublisherName$
Publisher Name (Event Source): $Data/PublisherName$
EventCategory: $Data/EventCategory$
LoggingComputer: $Data/LoggingComputer$
EventLevel: $Data/EventLevel$
Channel: $Data/Channel$
EventNumber: $Data/EventNumber$

Event Monitors:
Property XML
EventDisplayNumber (Event ID): $Data/Context/EventDisplayNumber$
EventDescription (Description): $Data/Context/EventDescription$
Publisher Name (Event Source): $Data/Context/PublisherName$
EventCategory: $Data/Context/EventCategory$
LoggingComputer: $Data/Context/LoggingComputer$
EventLevel: $Data/Context/EventLevel$
Channel: $Data/Context/Channel$
UserName: $Data/Context/UserName$
EventNumber: $Data/Context/EventNumber$

1 System Center Forum | http://www.systemcenterfourm.org

Repeating Event Monitors:
Property XML
EventDisplayNumber (Event ID): $Data/Context/DataItem/EventDisplayNumber$
EventDescription (Description): $Data/Context/DataItem/EventDescription$
Publisher Name (Event Source): $Data/Context/DataItem/PublisherName$
EventCategory: $Data/Context/DataItem/EventCategory$
LoggingComputer: $Data/Context/DataItem/LoggingComputer$
EventLevel: $Data/Context/DataItem/EventLevel$
Channel $Data/Context/DataItem/Channel$
UserName: $Data/Context/Context/DataItem/UserName$
EventNumber: $Data/Context/DataItem/EventNumber$

Performance Threshold Monitors

Property
Object (Perf Object Name):
Counter (Perf Counter Name):
Instance (Perf Instance Name):
Value (Perf Counter Value):
XML
$Data/Context/ObjectName$
$Data/Context/CounterName$
$Data/Context/InstanceName$
$Data/Context/Value$

Service Monitors
Property
Service Name
Service Dependencies
Service Binary Path
Service Display Name
Service Description
XML
$Data/Context/Property[@Name='Name']$
$Data/Context/Property[@Name='Dependencies']$
$Data/Context/Property[@Name='BinaryPathName']$
$Data/Context/Property[@Name='DisplayName']$
$Data/Context/Property[@Name='Description']$

SNMP

SNMP Probe-based Monitoring

In SNMP probe-based or trap monitors, this is value youll need to add to the Parameter Name
field when comparing a value returned from the probe (GET) operation.

$data/SnmpVarBinds/SnmpVarBind[1]/Value$

2 System Center Forum | http://www.systemcenterfourm.org

SNMP Rules

SYSLOG
Property XML
Facility $Data/EventData/DataItem/Facility$
Severity $Data/EventData/DataItem/Severity$
Priority $Data/EventData/DataItem/Priority$
PriorityName $Data/EventData/DataItem/PriorityName$
TimeStamp $Data/EventData/DataItem/TimeStamp$
HostName $Data/EventData/DataItem/HostName$
Message $Data/EventData/DataItem/Message$

Log File Monitor

Property XML
Log File Directory: $Data/EventData/DataItem/LogFileDirectory$
LogFile name: $Data/EventData/DataItem/LogFileName$
String: $Data/EventData/DataItem/Params/Param[1]$

Notifications
Property XML
AlertID GUID $Data/Context/DataItem/AlertId$
Alert Name $Data/Context/DataItem/AlertName$
Alert category $Data/Context/DataItem/Category$
UTC Date/Time of Dataitem created $Data/Context/DataItem/DataItemCreateTime$
LocalTime Date/Time of Dataitem $Data/Context/DataItem/DataItemCreateTimeLocal$
created
UTC Date/Time DataItem was $Data/Context/DataItem/LastModified$
modified
Local Date/Time DataItem was $Data/Context/DataItem/LastModifiedLocal$
modified
CustomField1 $Data/Context/DataItem/Custom1$
CustomField2 $Data/Context/DataItem/Custom2$
CustomField3 $Data/Context/DataItem/Custom3$
CustomField4 $Data/Context/DataItem/Custom4$
CustomField5 $Data/Context/DataItem/Cust2m5$
CustomField6 $Data/Context/DataItem/Custom6$
CustomField7 $Data/Context/DataItem/Custom7$
CustomField8 $Data/Context/DataItem/Custom8$
CustomField9 $Data/Context/DataItem/Custom9$
CustomField10 $Data/Context/DataItem/Custom10$
Created by monitor? (true/false) $Data/Context/DataItem/CreatedByMonitor$

3 System Center Forum | http://www.systemcenterfourm.org

Property XML
Recipient Name $Data/Recipients/To/Address/Address$
Mgmt Server Principal Name $Target/Property[Type="Notification!Microsoft.SystemCenter.
AlertNotificationSubscriptionServer"]/PrincipalName$
Web Console URL $Target/Property[Type="Notification!Microsoft.SystemCenter.
AlertNotificationSubscriptionServer"]/WebConsoleUrl$
Workflow ID (GUID) $Data/Context/DataItem/WorkflowId$
Date/Time the Alert was resolved $Data/Context/DataItem/TimeResolved$
(UTC)
Time Raised (Local) $Data/Context/DataItem/TimeRaisedLocal$
Time Raised (UTC) $Data/Context/DataItem/TimeRaised$
Time Added (Local) $Data/Context/DataItem/TimeAddedLocal$
UTC Time Added $Data/Context/DataItem/TimeAdded$
TicketID $Data/Context/DataItem/TicketId$
Alert Severity ID $Data/Context/DataItem/Severity$
Person resolving the alert $Data/Context/DataItem/ResolvedBy$
The Resolution State Name (New, $Data/Context/DataItem/ResolutionStateName$
Closed)
Date/Time Resolution State was last $Data/Context/DataItem/ResolutionStateLastModifiedLocal$
modified (Local)
Date/Time Resolution State was last $Data/Context/DataItem/ResolutionStateLastModified$
modified (UTC)
Resolution state ID (0=New 255= $Data/Context/DataItem/ResolutionState$
Closed)
Alert Repeat Count $Data/Context/DataItem/RepeatCount$
Alert Owner $Data/Context/DataItem/Owner$
Managed Entity Path $Data/Context/DataItem/ManagedEntityPath$
ManagedEntity Full name $Data/Context/DataItem/ManagedEntityFullName$
ManagedEntity Display name $Data/Context/DataItem/ManagedEntityDisplayName$
ManagedEntity GUID $Data/Context/DataItem/ManagedEntity$

WMI
The following are expression matching and discovery mapper XPATH strings. In the examples below,
replace WMI_PROP_NAME according to the query performed in the rule or monitor.

Alert Parameter: $Data/Context/Property[@Name=WMI_PROP_NAME]$

Discovery Mapper: $Data/Property[@Name=WMI_PROP_NAME]$
Condition Expression: Property[@Name=WMI_PROP_NAME]

Feedback
4 System Center Forum | http://www.systemcenterfourm.org
Send any suggestions to administrator@systemcenterforum.org

5 System Center Forum | http://www.systemcenterfourm.org