Kevin Holman's System Center Blog

Posts in this blog are provided "AS IS" with no warranties, and confers no rights. Use of included script samples are subject to the terms specified in the Terms of UseAre you interested in having a dedicated engineer that will be your Mic

Adding custom information to alert description (s) and notifications

TechNet Blogs > Kevin Holman's System Center Blog > Adding custom information to alert description (s) and notifications

Adding custom information to alert description (s) and notifications

Rate This
12 Dec 2007 8:35 AM
  • Comments 43

This is just a dump of some alert description variables I pulled from several other bloggers:

Custom Properties for Alert Description and Notification:

Alert Description Variables:

 

For event Rules:

EventDisplayNumber (Event ID):             $Data/EventDisplayNumber$
EventDescription (Description):               $Data/EventDescription$
Publisher Name (Event Source):              $Data/PublisherName$
EventCategory:                                    $Data/EventCategory$
LoggingComputer:                                $Data/LoggingComputer$
EventLevel:                                          $Data/EventLevel$
Channel:                                              $Data/Channel$
UserName:                                           $Data/UserName$
EventNumber:                                      $Data/EventNumber$
Event Time:                                          $Data/@time$

 

For event Monitors:

EventDisplayNumber (Event ID):            $Data/Context/EventDisplayNumber$
EventDescription (Description):              $Data/Context/EventDescription$
Publisher Name (Event Source):             $Data/Context/PublisherName$
EventCategory:                                    $Data/Context/EventCategory$
LoggingComputer:                                $Data/Context/LoggingComputer$
EventLevel:                                         $Data/Context/EventLevel$
Channel:                                             $Data/Context/Channel$
UserName:                                          $Data/Context/UserName$
EventNumber:                                     $Data/Context/EventNumber$
Event Time:                                         $Data/Context/@time$

 

For Repeating Event Monitors:

EventDisplayNumber (Event ID):              $Data/Context/Context/DataItem/EventDisplayNumber$
EventDescription (Description):                $Data/Context/Context/DataItem/EventDescription$
Publisher Name (Event Source):              $Data/Context/Context/DataItem/PublisherName$
EventCategory:                                      $Data/Context/Context/DataItem/EventCategory$
LoggingComputer:                                  $Data/Context/Context/DataItem/LoggingComputer$
EventLevel:                                            $Data/Context/Context/DataItem/EventLevel$
Channel:                                                $Data/Context/Context/DataItem/Channel$
UserName:                                             $Data/Context/Context/DataItem/UserName$
EventNumber:                                         $Data/Context/Context/DataItem/EventNumber$

  

Performance Threshold Monitors:

Object (Perf Object Name):                    $Data/Context/ObjectName$
Counter (Perf Counter Name):                $Data/Context/CounterName$
Instance (Perf Instance Name):              $Data/Context/InstanceName$
*Value (Perf Counter Value):                  $Data/Context/Value$ 
**Last Sampled Value                            $Data/Context/SampleValue$

*Value will show the actual performance value for simple and avg monitors.  It will show number of samples for consecutive threshold monitors.
**Last Sampled Value works to show the last value evaluated in a consecutive sample value monitor.

 

Service Monitors:

Service Name                         $Data/Context/Property[@Name='Name']$
Service Dependencies             $Data/Context/Property[@Name='Dependencies']$
Service Binary Path                $Data/Context/Property[@Name='BinaryPathName']$
Service Display Name             $Data/Context/Property[@Name='DisplayName']$
Service Description                 $Data/Context/Property[@Name='Description']$

 

Logfile Monitors:

Logfile Directory :                  $Data/Context/LogFileDirectory$
Logfile name:                        $Data/Context/LogFileName$
String:                                  $Data/Context/Params/Param[1]$

 

Logfile rules:

Logfile Directory:                   $Data/EventData/DataItem/LogFileDirectory$
Logfile name:                        $Data/EventData/DataItem/LogFileName$
String:                                  $Data/EventData/DataItem/Params/Param[1]$

 

General:

To show the name of the Windows Computer host:
$Target/Host/Property[Type="Windows!Microsoft.Windows.Computer"]/NetworkName$

 

Notifications:

$Data/Context/DataItem/AlertId$                                       The AlertID GUID
$Data/Context/DataItem/AlertName$                                   The Alert Name
$Data/Context/DataItem/Category$                                    The Alert category
$Data/Context/DataItem/CreatedByMonitor$                       True/False
$Data/Context/DataItem/Custom1$                                     CustomField1
$Data/Context/DataItem/Custom2$                                    CustomField2
$Data/Context/DataItem/Custom3$                                    CustomField3
$Data/Context/DataItem/Custom4$                                    CustomField4
$Data/Context/DataItem/Custom5$                                    CustomField5
$Data/Context/DataItem/Custom6$                                     CustomField6
$Data/Context/DataItem/Custom7$                                     CustomField7
$Data/Context/DataItem/Custom8$                                     CustomField8
$Data/Context/DataItem/Custom9$                                     CustomField9
$Data/Context/DataItem/Custom10$                                  CustomField10
$Data/Context/DataItem/DataItemCreateTime$                      UTC Date/Time of Dataitem created
$Data/Context/DataItem/DataItemCreateTimeLocal$               LocalTime Date/Time of Dataitem created
$Data/Context/DataItem/LastModified$                                 UTC Date/Time DataItem was modified
$Data/Context/DataItem/LastModifiedLocal$                          Local Date/Time DataItem was modified
$Data/Context/DataItem/ManagedEntity$                               ManagedEntity GUID
$Data/Context/DataItem/ManagedEntityDisplayName$             ManagedEntity Display name
$Data/Context/DataItem/ManagedEntityFullName$                   ManagedEntity Full name
$Data/Context/DataItem/ManagedEntityPath$                          Managed Entity Path
$Data/Context/DataItem/Priority$                                          The Alert Priority Number (High=1,Medium=2,Low=3)
$Data/Context/DataItem/Owner$                                           The Alert Owner
$Data/Context/DataItem/RepeatCount$                                  The Alert Repeat Count
$Data/Context/DataItem/ResolutionState$                               Resolution state ID (0=New, 255= Closed)
$Data/Context/DataItem/ResolutionStateLastModified$                 UTC Date/Time ResolutionState was last modified
$Data/Context/DataItem/ResolutionStateLastModifiedLocal$          Local Date/Time ResolutionState was last modified
$Data/Context/DataItem/ResolutionStateName$                       The Resolution State Name (New, Closed)
$Data/Context/DataItem/ResolvedBy$                                     Person resolving the alert
$Data/Context/DataItem/Severity$                                          The Alert Severity ID
$Data/Context/DataItem/TicketId$                                           The TicketID
$Data/Context/DataItem/TimeAdded$                                       UTC Time Added
$Data/Context/DataItem/TimeAddedLocal$                               Local Time Added
$Data/Context/DataItem/TimeRaised$                                      UTC Time Raised
$Data/Context/DataItem/TimeRaisedLocal$                              Local Time Raised
$Data/Context/DataItem/TimeResolved$                                  UTC Date/Time the Alert was resolved
$Data/Context/DataItem/WorkflowId$                                      The Workflow ID (GUID)
$Data/Recipients/To/Address/Address$                                    The name of the recipient

The Web Console URL:
$Target/Property[Type="Notification!Microsoft.SystemCenter.AlertNotificationSubscriptionServer"/WebConsoleUrl$

The principalname of the management server:
Target/Property[Type="Notification!Microsoft.SystemCenter.AlertNotificationSubscriptionServer"/PrincipalName$

 

Also see related post:

http://blogs.technet.com/kevinholman/archive/2009/09/23/alert-notification-subscription-variables-and-linking-that-to-the-console-database-and-sdk.aspx

Comments
Comments
  • Rajeev
    18 May 2009 2:46 PM

    can I get the ip address of the host?

  • 19 May 2009 5:04 PM

    You can add anything that is a property of your data source.... like event, perf, etc... that our data source mudule understands.

    The IP address is an ATTRIBUTE of the Windows Computer object... and is not tied to the alert, or the data source.

    So - I dont know a way to add the IP address of the object to all alerts.... and this wont always even make sense - for alerts that come from "SQL Database" for instance.  

    The only thing I can think of is writing a custom product connector - which would modify alerts via the SDK after they are created on a polling cycle.... this connector would examin the alert - query up the containment/hosting relationships to find the windows computer object - gather the IP attribute - and populate a custom field with the IP, on the alert.

  • Kevin Holman's OpsMgr Blog
    19 Jun 2009 7:30 PM

    There are several examples in blogs on how to create a generic text log rule to monitor for a local text

  • 10 Jul 2009 4:11 PM

    The event Monitor variables don't work.

    I'm trying to put information in the subject of the notification subscription based on a monitor.  I'm using

    $Data/Context/UserName$ is logging in to $Data/Context/LoggingComputer$

    as the subject.  When the email goes out, I get

    " is logging in to "

  • Gurpreet
    13 Jul 2009 10:14 PM

    If I have a configuration parameter in the monitor like a threshold number, how do i access this value in the alert?

    For e.g. I have a monitor that generates an alerts if 5 samples have value of call duration of more than 100ms. Both the number of samples and duration threshold need to be displayed in the alert. These are not properties of any of the classes.

  • PaulD
    14 Aug 2009 1:59 AM

    Hi Kevin.

    using get-alert cmdlet we have field named "NetbiosComputerName". Is there any Xpath equivalent for this field?

  • 14 Aug 2009 2:12 AM

    Not that I am aware of - but I am working on just that issue.  We really need this - and if there is a way to xpath this - it would really help.

    I am trying to find out if this is possible from the product group right now - but I dont think it is.  Sure would be nice.

    I am develping a spreadsheet to cross reference the alert view in the console/alert view in DB/alert notification variables/SDK Get-Alert/R2 connector key pairs.

  • Mark Benoit
    3 Nov 2009 12:20 PM

    Are there any Alert Description variables available for Aggregate rollup monitors?  At best, I would like to be able to have the Aggregate monitor alert description show the actual value that triggerd the unhealthy state of the child monitors (in this case, CPU% utilization) like $Data/Context/Property[@Name='PctUsage'], but that does not work.  If that is not available to the parent monitor, then it would be nice to be able to include a Alert Description variable for the Alert Severity of the child monitor that went unhealthy (Warning or Critical).

  • 3 Nov 2009 12:28 PM

    Aggregate rollup monitors roll up state only.  They have no idea or information about the values or details on the monitors below them.  They have a state-rollup algorithm (best of, worst of) and then they simply change state according to that policy.

    In this way - by design if you alert from an aggregate monitor - you cannot get deep level details about the root cause monitor - it could be one - or many that are problematic at any given time.

    For the details - you must alert on the unit monitor.

  • Ashutosh
    9 Dec 2009 11:22 PM

    even when i have created a unit monitor for % CPU utilization. When i use the same string in Alert description i don't get the value for CPU utilization.

  • 11 Dec 2009 1:09 AM

    How to get the source server name in alert description for the alerts that we are receiving for services going down. The string i am using here is as

    $Data/Context/Property[@Name='Name']$ has stopped running.

    This gives me only the service name. How to get the affected server anme in this.

    any help will appreciated.

  • JOBBO
    11 Jan 2010 8:28 PM

    I need to send SMS messages with short HostName and IPv4 Address (not DNS or Source or Path name)

    Can you guide me how to send notification with NetBIOS name in subject feild.

    I have use $Target/Host/Property[Type="Windows!Microsoft.Windows.Computer"]/NetbiosComputerName$   but it could not be save setting.

  • JB
    26 Jan 2010 8:24 AM

    Any update on a simple way to capture the hostname for ANY alert type?  This inability effectively shuts down our process of send SCOM alerts to Tivoli TEC.  (Not using the TEC connector)  We need to have the severity,hostname, description, alert name of every event\alert that comes in.  Sometimes the parameters we use grab the hostname, others it does not.  

    Is Microsoft attempting to fix this?

  • Pua
    19 Feb 2010 2:42 PM

    Is there an xpath expression for a monitor's threshold value?  I wish to include this in my alerts so our alert recipients can see both the value that exceeded the threshold, and the threshold itself.  Thanks.

  • JD
    1 Mar 2010 4:55 PM

    In email notification, is there any way to display the severity by 'name' instead of 'id' so I don't get an integer? For example, I want the notification to read Severity: Warning instead of Severity: 1 which is what happens when $Data/Context/DataItem/Severity$ variable is used.

Page 2 of 3 (43 items) 123
Leave a Comment
  • Please add 2 and 1 and type the answer here:
  • Post
Search Blogs
Options
Tags
Archive
Archives