Kevin Holman's System Center Blog

Posts in this blog are provided "AS IS" with no warranties, and confers no rights. Use of included script samples are subject to the terms specified in the Terms of UseAre you interested in having a dedicated engineer that will be your Mic

Adding custom information to alert description (s) and notifications

TechNet Blogs > Kevin Holman's System Center Blog > Adding custom information to alert description (s) and notifications

Adding custom information to alert description (s) and notifications

Rate This
12 Dec 2007 8:35 AM
  • Comments 43

This is just a dump of some alert description variables I pulled from several other bloggers:

Custom Properties for Alert Description and Notification:

Alert Description Variables:

 

For event Rules:

EventDisplayNumber (Event ID):             $Data/EventDisplayNumber$
EventDescription (Description):               $Data/EventDescription$
Publisher Name (Event Source):              $Data/PublisherName$
EventCategory:                                    $Data/EventCategory$
LoggingComputer:                                $Data/LoggingComputer$
EventLevel:                                          $Data/EventLevel$
Channel:                                              $Data/Channel$
UserName:                                           $Data/UserName$
EventNumber:                                      $Data/EventNumber$
Event Time:                                          $Data/@time$

 

For event Monitors:

EventDisplayNumber (Event ID):            $Data/Context/EventDisplayNumber$
EventDescription (Description):              $Data/Context/EventDescription$
Publisher Name (Event Source):             $Data/Context/PublisherName$
EventCategory:                                    $Data/Context/EventCategory$
LoggingComputer:                                $Data/Context/LoggingComputer$
EventLevel:                                         $Data/Context/EventLevel$
Channel:                                             $Data/Context/Channel$
UserName:                                          $Data/Context/UserName$
EventNumber:                                     $Data/Context/EventNumber$
Event Time:                                         $Data/Context/@time$

 

For Repeating Event Monitors:

EventDisplayNumber (Event ID):              $Data/Context/Context/DataItem/EventDisplayNumber$
EventDescription (Description):                $Data/Context/Context/DataItem/EventDescription$
Publisher Name (Event Source):              $Data/Context/Context/DataItem/PublisherName$
EventCategory:                                      $Data/Context/Context/DataItem/EventCategory$
LoggingComputer:                                  $Data/Context/Context/DataItem/LoggingComputer$
EventLevel:                                            $Data/Context/Context/DataItem/EventLevel$
Channel:                                                $Data/Context/Context/DataItem/Channel$
UserName:                                             $Data/Context/Context/DataItem/UserName$
EventNumber:                                         $Data/Context/Context/DataItem/EventNumber$

  

Performance Threshold Monitors:

Object (Perf Object Name):                    $Data/Context/ObjectName$
Counter (Perf Counter Name):                $Data/Context/CounterName$
Instance (Perf Instance Name):              $Data/Context/InstanceName$
*Value (Perf Counter Value):                  $Data/Context/Value$ 
**Last Sampled Value                            $Data/Context/SampleValue$

*Value will show the actual performance value for simple and avg monitors.  It will show number of samples for consecutive threshold monitors.
**Last Sampled Value works to show the last value evaluated in a consecutive sample value monitor.

 

Service Monitors:

Service Name                         $Data/Context/Property[@Name='Name']$
Service Dependencies             $Data/Context/Property[@Name='Dependencies']$
Service Binary Path                $Data/Context/Property[@Name='BinaryPathName']$
Service Display Name             $Data/Context/Property[@Name='DisplayName']$
Service Description                 $Data/Context/Property[@Name='Description']$

 

Logfile Monitors:

Logfile Directory :                  $Data/Context/LogFileDirectory$
Logfile name:                        $Data/Context/LogFileName$
String:                                  $Data/Context/Params/Param[1]$

 

Logfile rules:

Logfile Directory:                   $Data/EventData/DataItem/LogFileDirectory$
Logfile name:                        $Data/EventData/DataItem/LogFileName$
String:                                  $Data/EventData/DataItem/Params/Param[1]$

 

General:

To show the name of the Windows Computer host:
$Target/Host/Property[Type="Windows!Microsoft.Windows.Computer"]/NetworkName$

 

Notifications:

$Data/Context/DataItem/AlertId$                                       The AlertID GUID
$Data/Context/DataItem/AlertName$                                   The Alert Name
$Data/Context/DataItem/Category$                                    The Alert category
$Data/Context/DataItem/CreatedByMonitor$                       True/False
$Data/Context/DataItem/Custom1$                                     CustomField1
$Data/Context/DataItem/Custom2$                                    CustomField2
$Data/Context/DataItem/Custom3$                                    CustomField3
$Data/Context/DataItem/Custom4$                                    CustomField4
$Data/Context/DataItem/Custom5$                                    CustomField5
$Data/Context/DataItem/Custom6$                                     CustomField6
$Data/Context/DataItem/Custom7$                                     CustomField7
$Data/Context/DataItem/Custom8$                                     CustomField8
$Data/Context/DataItem/Custom9$                                     CustomField9
$Data/Context/DataItem/Custom10$                                  CustomField10
$Data/Context/DataItem/DataItemCreateTime$                      UTC Date/Time of Dataitem created
$Data/Context/DataItem/DataItemCreateTimeLocal$               LocalTime Date/Time of Dataitem created
$Data/Context/DataItem/LastModified$                                 UTC Date/Time DataItem was modified
$Data/Context/DataItem/LastModifiedLocal$                          Local Date/Time DataItem was modified
$Data/Context/DataItem/ManagedEntity$                               ManagedEntity GUID
$Data/Context/DataItem/ManagedEntityDisplayName$             ManagedEntity Display name
$Data/Context/DataItem/ManagedEntityFullName$                   ManagedEntity Full name
$Data/Context/DataItem/ManagedEntityPath$                          Managed Entity Path
$Data/Context/DataItem/Priority$                                          The Alert Priority Number (High=1,Medium=2,Low=3)
$Data/Context/DataItem/Owner$                                           The Alert Owner
$Data/Context/DataItem/RepeatCount$                                  The Alert Repeat Count
$Data/Context/DataItem/ResolutionState$                               Resolution state ID (0=New, 255= Closed)
$Data/Context/DataItem/ResolutionStateLastModified$                 UTC Date/Time ResolutionState was last modified
$Data/Context/DataItem/ResolutionStateLastModifiedLocal$          Local Date/Time ResolutionState was last modified
$Data/Context/DataItem/ResolutionStateName$                       The Resolution State Name (New, Closed)
$Data/Context/DataItem/ResolvedBy$                                     Person resolving the alert
$Data/Context/DataItem/Severity$                                          The Alert Severity ID
$Data/Context/DataItem/TicketId$                                           The TicketID
$Data/Context/DataItem/TimeAdded$                                       UTC Time Added
$Data/Context/DataItem/TimeAddedLocal$                               Local Time Added
$Data/Context/DataItem/TimeRaised$                                      UTC Time Raised
$Data/Context/DataItem/TimeRaisedLocal$                              Local Time Raised
$Data/Context/DataItem/TimeResolved$                                  UTC Date/Time the Alert was resolved
$Data/Context/DataItem/WorkflowId$                                      The Workflow ID (GUID)
$Data/Recipients/To/Address/Address$                                    The name of the recipient

The Web Console URL:
$Target/Property[Type="Notification!Microsoft.SystemCenter.AlertNotificationSubscriptionServer"/WebConsoleUrl$

The principalname of the management server:
Target/Property[Type="Notification!Microsoft.SystemCenter.AlertNotificationSubscriptionServer"/PrincipalName$

 

Also see related post:

http://blogs.technet.com/kevinholman/archive/2009/09/23/alert-notification-subscription-variables-and-linking-that-to-the-console-database-and-sdk.aspx

Comments
Comments
  • 1 Mar 2010 5:23 PM

    Q:  In email notification, is there any way to display the severity by 'name' instead of 'id' so I don't get an integer?

    A:  Not that I know of.

  • Jeff C.
    9 Mar 2010 1:15 PM

    In OpsMgr, for notification, we use a command line channel to send pages. We have it configured as such (for example).

                   $Data[Default='$Data/Context/DataItem/Context/DataItem/Params/Param[1]$']/Context/DataItem/Custom1$

    That way, if Custom1 is blank we can page out on Param[1] value. This works great in paging, but when we try to do the same thing in email, it doesn’t work. It passes the literal text. How can we do the same thing in email?

  • Burton
    7 Jul 2011 11:42 AM

    Kevin,

    How do you embed diagnostic output in the alert notification?  For example, I have a script-based diagnostic attached to a percent processor utilization performance monitor.  The script lists the top running processes at the time, along with their individual processor utilization percentages.  It returns this information to the alert as a property bag property called 'Result'.  The diagnostic result appears in Health Explorer all right, but I also want to include it in the alert notification.  I would like to use something like this:

    $Data/Diagnostic/DataItem/Property[@Name='Result']$

    (from: technet.microsoft.com/.../ff714576.aspx ), but it does not work.  I have also tried this without success:

    $Data/Context/Property[@Name='Result']$

    BTW, ditto to David Strebel's question above.

    Thanks!

  • Email Admin
    28 Sep 2011 8:30 AM

    hi thanks nice artical.. but i have one query / help.

    i want to customized My own words like..

    Server Name ,

    Server Role,

    Up -

    Down -

    Down time -

    so can you suggest any way to how we can costomized alert....!

  • 28 Sep 2011 11:55 AM

    @Email Admin -

    This is doable - when you create the alert notification subscription - use the variables above and input them in the propert format that you want, into the email channel - and then use that custom channel for a subscription to that specific alert (computer unreachable)

  • Cara
    13 Dec 2011 4:01 PM

    Hi Kevin, I have a rule configured to capture the event log information from id's 644 & 4740, account lockouts.  I have a view setup to filter these account lockouts to just show service accounts in this format using text from the description:  'COMPANY\s-%'. This filter works great. However I cannot get the same filter to work when sending out the notification in email. It seems to be all account lockouts or nothing. Any ideas how I can make this work? Thanks!

  • Sandy
    11 Feb 2012 2:02 AM

    What's the value for setting SQL Instance name under SCOM Alert Message..?

  • Abdul Karim
    16 Sep 2012 11:50 PM

    Hello Kevin,

    Recently, I was asked to create a unit monitor to be alerted for any file changes in the environment.

    So, I created an event based timer reset monitor, which targets the security log and a particular ID and a parameter.

    The alerting works fine in SCOM whenever the ID and parameter are triggered together in the event viewer.

    The problem is with the description that is shown in SCOM.

    The event shows proper format of descrption as shown below:

    A handle to an object was requested.

    Subject:

     Security ID:  DOM\user

     Account Name:  user

     Account Domain:  DOM

     Logon ID:  0x1c77b615e

    Object:

     Object Server:  Security

     Object Type:  File

     Object Name:  \Device\HarddiskVolume7\test\testuser\testuserH\Reports\test\test2012\user2012\Security2012.xlsx

     Handle ID:  0x0

    Process Information:

     Process ID:  0x4

     Process Name:  

    Access Request Information:

     Transaction ID:  {00000000-0000-0000-0000-000000000000}

     Accesses:  DELETE

        READ_CONTROL

        ACCESS_SYS_SEC

        ReadData (or ListDirectory)

        ReadEA

        ReadAttributes

     Access Reasons:  DELETE: Unknown or unchecked

        READ_CONTROL: Granted by Ownership

        ACCESS_SYS_SEC: Not granted due to missing SeSecurityPrivilege

        ReadData (or ListDirectory): Unknown or unchecked

        ReadEA: Unknown or unchecked

        ReadAttributes: Granted by ACE on parent folder D:(A;OICIID;0x1301bf;;;S-1-5-21-3362488545-1801783553-3570299896-10108)

     Access Mask:  0x1030089

     Privileges Used for Access Check: -

     Restricted SID Count: 0

    However, in the event viewer friendly view (both general and XML) the data is displayed as shown below:

    EventData

     SubjectUserSid S-1-5-21-3362488545-1801783553-3570299896-4101

     SubjectUserName user

      SubjectDomainName DOM

     SubjectLogonId 0x1c77b615e

     ObjectServer Security

     ObjectType File

     ObjectName  \Device\HarddiskVolume7\test\testuser\testuserH\Reports\test\test2012\user2012\Security2012.xlsx

      HandleId 0x0

     TransactionId {00000000-0000-0000-0000-000000000000}

     AccessList %%1537 %%1538 %%1542 %%4416 %%4419 %%4423  

     AccessReason %%1537: %%1809 %%1538: %%1804 %%1542: %%1810 SeSecurityPrivilege %%4416: %%1809 %%4419: %%1809 %%4423: %%1811 D:(A;OICIID;0x1301bf;;;S-1-5-21-3362488545-1801783553-3570299896-10108)

      AccessMask 0x1030089

     PrivilegeList -

     RestrictedSidCount 0

     ProcessId 0x4

     ProcessName

    The same XML data (from friendly view) is displayed in SCOM.

    Is there a way I can get SCOM to read the data from the general view of the eventviewer instead of it reading from the friendly View.

    Any Help will be appreciated.

    Thanks in Advance!

    Regards,

    Abdul Karim

  • Eric
    16 Oct 2012 1:24 PM

    The event rule variables don't seem to work. I have tried  $Data/EventDescription$ as well as  $Data/Context/EventDescription$ I tried them both in the rule itself and in a SMTP channel for a subscription that fires an email for that rule and always get blank results? Can you confirm where we use these variables, in the rule or alert channel and what they should be for an NT Event Log rule?

  • 16 Oct 2012 1:28 PM

    Eric - these should be working fine when used in a notification, for an NT event log rule or monitor.

    SCOM 2007R2 or SCOM 2012?

  • Jules
    18 Oct 2012 7:08 AM

    We have the software remedy and if we try to add [$$BLABLA$$] for example. But the $ always gets interpreted as a variable and we need 2 $ because of the remedy.

    Here an example:

    Service Type !1000000099!: [$$Infrastructure Event$$]

    But it's always:

    Service Type !1000000099!: [$Infrastructure Event$]

    In some cases it gets interpreted correctly with 4$ but in some cases not. So do you have a solution for my problem what works for my whole problem?

    Regards,

    Jules

  • Teresa
    30 Jan 2013 10:15 AM

    I'm trying to update Custom Fields with IP address from text file, is there any suggestions on why I can update the fields with text but not IP?

  • Ed
    10 Apr 2013 8:58 AM

    Hello and thank you for all the details you have provided to us.

    My question is this - within Monitoring, I've created a rule for EventID = 6000 (Log file is full) - can I pass $Data/LoggingComputer$ to a PowerShell script as a parameter when specifying command line execution settings?

    I want to have it go off and perform event log backup & clear on that remote server.

    Thanks!

Page 3 of 3 (43 items) 123
Leave a Comment
  • Please add 1 and 5 and type the answer here:
  • Post
Search Blogs
Options
Tags
Archive
Archives