Kevin Holman's System Center Blog

Posts in this blog are provided "AS IS" with no warranties, and confers no rights. Use of included script samples are subject to the terms specified in the Terms of UseAre you interested in having a dedicated engineer that will be your Mic

Adding event time to an alert description

Adding event time to an alert description

  • Comments 2
  • Likes

We have several “Time” variables, to which you can add to a notification subscription format, which will include a timestamp of something related to the alert.  For instance:



$Data/Context/DataItem/LastModified$                                UTC Date/Time DataItem was modified
$Data/Context/DataItem/LastModifiedLocal$                         Local Date/Time DataItem was modified
$Data/Context/DataItem/TimeAdded$                                   UTC Time Added
$Data/Context/DataItem/TimeAddedLocal$                           Local Time Added
$Data/Context/DataItem/TimeRaised$                                  UTC Time Raised
$Data/Context/DataItem/TimeRaisedLocal$                           Local Time Raised
$Data/Context/DataItem/TimeResolved$                              UTC Date/Time the Alert was resolved


However – all of these values are properties of the alert itself.  This is good – as it covers almost all timestamp scenarios of an alert.

The typical Alert description variables for an event rule (from the post above) are:

For event Rules:

EventDisplayNumber (Event ID):             $Data/EventDisplayNumber$
EventDescription (Description):               $Data/EventDescription$
Publisher Name (Event Source):              $Data/PublisherName$
EventCategory:                                    $Data/EventCategory$
LoggingComputer:                                $Data/LoggingComputer$
EventLevel:                                          $Data/EventLevel$
Channel:                                              $Data/Channel$
UserName:                                           $Data/UserName$
EventNumber:                                      $Data/EventNumber$

For event Monitors:

EventDisplayNumber (Event ID):            $Data/Context/EventDisplayNumber$
EventDescription (Description):              $Data/Context/EventDescription$
Publisher Name (Event Source):             $Data/Context/PublisherName$
EventCategory:                                    $Data/Context/EventCategory$
LoggingComputer:                                $Data/Context/LoggingComputer$
EventLevel:                                         $Data/Context/EventLevel$
Channel:                                             $Data/Context/Channel$
UserName:                                          $Data/Context/UserName$
EventNumber:                                     $Data/Context/EventNumber$


But what if – we are creating an event workflow such as an alert generating rule, and we want the actual time of the *event* to show up in the alert?  This is available by looking at the Alert Context tab of the alert properties.

For instance, I have a test rule I use for testing agents, it has a data source of event ID 100, and source = TEST.  When I generate this event – I can see the alert properties has all the actual event details:




So since the runtime is picking up all this data – that generally means I can use *anything* here in my alert description.  To use the event time:


For event rules:   $Data/@time$

For event monitors:   $Data/Context/@time$


Here is an example of my alert description:




And here is the output:



  • Hey Kevin!

    Thanks, that's interesting. What about non-standard values out of the alert context? For instance I've got OleDb monitors that return data like

    Date and Time 14.03.2012 12:19:18


    Result Success

    Initialization Time 40

    Open Time 0

    Execution Time 18148

    Fetch Time 0

    Result Set  Input Data Item

    In (at least) that case I also don't get the time from $Data/Context/@time$



  • Oh man... that was that easy, didn't tried the most obvious method:







Your comment has been posted.   Close
Thank you, your comment requires moderation so it may take a while to appear.   Close
Leave a Comment
Search Blogs