Professional Documents
Culture Documents
XML Master PDF
XML Master PDF
Contents:
Event Rules Notifications
Event Monitors SNMP
Repeating Event Monitors SYSLOG
Performance Threshold Monitors Log File Monitor
Service Monitors WMI
Event Rules:
Property XML
EventDisplayNumber (Event ID): $Data/EventDisplayNumber$
EventDescription (Description): $Data/EventDescription$
Publisher Name (Event Source): $Data/PublisherName$
Publisher Name (Event Source): $Data/PublisherName$
EventCategory: $Data/EventCategory$
LoggingComputer: $Data/LoggingComputer$
EventLevel: $Data/EventLevel$
Channel: $Data/Channel$
EventNumber: $Data/EventNumber$
Event Monitors:
Property XML
EventDisplayNumber (Event ID): $Data/Context/EventDisplayNumber$
EventDescription (Description): $Data/Context/EventDescription$
Publisher Name (Event Source): $Data/Context/PublisherName$
EventCategory: $Data/Context/EventCategory$
LoggingComputer: $Data/Context/LoggingComputer$
EventLevel: $Data/Context/EventLevel$
Channel: $Data/Context/Channel$
UserName: $Data/Context/UserName$
EventNumber: $Data/Context/EventNumber$
Service Monitors
Property XML
Service Name $Data/Context/Property[@Name='Name']$
Service Dependencies $Data/Context/Property[@Name='Dependencies']$
Service Binary Path $Data/Context/Property[@Name='BinaryPathName']$
Service Display Name $Data/Context/Property[@Name='DisplayName']$
Service Description $Data/Context/Property[@Name='Description']$
SNMP
$data/SnmpVarBinds/SnmpVarBind[1]/Value$
SYSLOG
Property XML
Facility $Data/EventData/DataItem/Facility$
Severity $Data/EventData/DataItem/Severity$
Priority $Data/EventData/DataItem/Priority$
PriorityName $Data/EventData/DataItem/PriorityName$
TimeStamp $Data/EventData/DataItem/TimeStamp$
HostName $Data/EventData/DataItem/HostName$
Message $Data/EventData/DataItem/Message$
Notifications
Property XML
AlertID GUID $Data/Context/DataItem/AlertId$
Alert Name $Data/Context/DataItem/AlertName$
Alert category $Data/Context/DataItem/Category$
UTC Date/Time of Dataitem created $Data/Context/DataItem/DataItemCreateTime$
LocalTime Date/Time of Dataitem $Data/Context/DataItem/DataItemCreateTimeLocal$
created
UTC Date/Time DataItem was $Data/Context/DataItem/LastModified$
modified
Local Date/Time DataItem was $Data/Context/DataItem/LastModifiedLocal$
modified
CustomField1 $Data/Context/DataItem/Custom1$
CustomField2 $Data/Context/DataItem/Custom2$
CustomField3 $Data/Context/DataItem/Custom3$
CustomField4 $Data/Context/DataItem/Custom4$
CustomField5 $Data/Context/DataItem/Cust2m5$
CustomField6 $Data/Context/DataItem/Custom6$
CustomField7 $Data/Context/DataItem/Custom7$
CustomField8 $Data/Context/DataItem/Custom8$
CustomField9 $Data/Context/DataItem/Custom9$
CustomField10 $Data/Context/DataItem/Custom10$
Created by monitor? (true/false) $Data/Context/DataItem/CreatedByMonitor$
WMI
The following are expression matching and discovery mapper XPATH strings. In the examples below,
replace WMI_PROP_NAME according to the query performed in the rule or monitor.
Feedback
4 System Center Forum | http://www.systemcenterfourm.org
Send any suggestions to administrator@systemcenterforum.org