Welcome to TechNet Blogs Sign in | Join | Help

Adding custom information to alert description (s) and notifications

This is just a dump of some alert description variables I pulled from several other bloggers:

Custom Properties for Alert Description and Notification:

Alert Description Variables:

 

For event Rules:

EventDisplayNumber (Event ID):             $Data/EventDisplayNumber$
EventDescription (Description):               $Data/EventDescription$
Publisher Name (Event Source):              $Data/PublisherName$
EventCategory:                                    $Data/EventCategory$
LoggingComputer:                                $Data/LoggingComputer$
EventLevel:                                          $Data/EventLevel$
Channel:                                              $Data/Channel$
UserName:                                           $Data/UserName$
EventNumber:                                      $Data/EventNumber$

 

For event Monitors:

EventDisplayNumber (Event ID):            $Data/Context/EventDisplayNumber$
EventDescription (Description):              $Data/Context/EventDescription$
Publisher Name (Event Source):             $Data/Context/PublisherName$
EventCategory:                                    $Data/Context/EventCategory$
LoggingComputer:                                $Data/Context/LoggingComputer$
EventLevel:                                         $Data/Context/EventLevel$
Channel:                                             $Data/Context/Channel$
UserName:                                          $Data/Context/UserName$
EventNumber:                                     $Data/Context/EventNumber$

 

For Repeating Event Monitors:

EventDisplayNumber (Event ID):              $Data/Context/Context/DataItem/EventDisplayNumber$
EventDescription (Description):                $Data/Context/Context/DataItem/EventDescription$
Publisher Name (Event Source):              $Data/Context/Context/DataItem/PublisherName$
EventCategory:                                      $Data/Context/Context/DataItem/EventCategory$
LoggingComputer:                                  $Data/Context/Context/DataItem/LoggingComputer$
EventLevel:                                            $Data/Context/Context/DataItem/EventLevel$
Channel:                                                $Data/Context/Context/DataItem/Channel$
UserName:                                             $Data/Context/Context/DataItem/UserName$
EventNumber:                                         $Data/Context/Context/DataItem/EventNumber$

  

Performance Threshold Monitors:

Object (Perf Object Name):                    $Data/Context/ObjectName$
Counter (Perf Counter Name):                $Data/Context/CounterName$
Instance (Perf Instance Name):              $Data/Context/InstanceName$
Value (Perf Counter Value):                   $Data/Context/Value$

 

Service Monitors:

Service Name                         $Data/Context/Property[@Name='Name']$
Service Dependencies             $Data/Context/Property[@Name='Dependencies']$
Service Binary Path                $Data/Context/Property[@Name='BinaryPathName']$
Service Display Name             $Data/Context/Property[@Name='DisplayName']$
Service Description                 $Data/Context/Property[@Name='Description']$

 

Logfile Monitors:

Logfile Directory :                  $Data/Context/LogFileDirectory$
Logfile name:                        $Data/Context/LogFileName$
String:                                  $Data/Context/Params/Param[1]$

 

Logfile rules:

Logfile Directory:                   $Data/EventData/DataItem/LogFileDirectory$
Logfile name:                        $Data/EventData/DataItem/LogFileName$
String:                                  $Data/EventData/DataItem/Params/Param[1]$

 

Notifications:

$Data/Context/DataItem/AlertId$                                       The AlertID GUID
$Data/Context/DataItem/AlertName$                                   The Alert Name
$Data/Context/DataItem/Category$                                    The Alert category
$Data/Context/DataItem/CreatedByMonitor$                       True/False
$Data/Context/DataItem/Custom1$                                     CustomField1
$Data/Context/DataItem/Custom2$                                    CustomField2
$Data/Context/DataItem/Custom3$                                    CustomField3
$Data/Context/DataItem/Custom4$                                    CustomField4
$Data/Context/DataItem/Custom5$                                    CustomField5
$Data/Context/DataItem/Custom6$                                     CustomField6
$Data/Context/DataItem/Custom7$                                     CustomField7
$Data/Context/DataItem/Custom8$                                     CustomField8
$Data/Context/DataItem/Custom9$                                     CustomField9
$Data/Context/DataItem/Custom10$                                  CustomField10
$Data/Context/DataItem/DataItemCreateTime$                      UTC Date/Time of Dataitem created
$Data/Context/DataItem/DataItemCreateTimeLocal$               LocalTime Date/Time of Dataitem created
$Data/Context/DataItem/LastModified$                                 UTC Date/Time DataItem was modified
$Data/Context/DataItem/LastModifiedLocal$                          Local Date/Time DataItem was modified
$Data/Context/DataItem/ManagedEntity$                               ManagedEntity GUID
$Data/Context/DataItem/ManagedEntityDisplayName$             ManagedEntity Display name
$Data/Context/DataItem/ManagedEntityFullName$                   ManagedEntity Full name
$Data/Context/DataItem/ManagedEntityPath$                          Managed Entity Path
$Data/Context/DataItem/Priority$                                          The Alert Priority Number (High=1,Medium=2,Low=3)
$Data/Context/DataItem/Owner$                                           The Alert Owner
$Data/Context/DataItem/RepeatCount$                                  The Alert Repeat Count
$Data/Context/DataItem/ResolutionState$                               Resolution state ID (0=New, 255= Closed)
$Data/Context/DataItem/ResolutionStateLastModified$                 UTC Date/Time ResolutionState was last modified
$Data/Context/DataItem/ResolutionStateLastModifiedLocal$          Local Date/Time ResolutionState was last modified
$Data/Context/DataItem/ResolutionStateName$                       The Resolution State Name (New, Closed)
$Data/Context/DataItem/ResolvedBy$                                     Person resolving the alert
$Data/Context/DataItem/Severity$                                          The Alert Severity ID
$Data/Context/DataItem/TicketId$                                           The TicketID
$Data/Context/DataItem/TimeAdded$                                       UTC Time Added
$Data/Context/DataItem/TimeAddedLocal$                               Local Time Added
$Data/Context/DataItem/TimeRaised$                                      UTC Time Raised
$Data/Context/DataItem/TimeRaisedLocal$                              Local Time Raised
$Data/Context/DataItem/TimeResolved$                                  UTC Date/Time the Alert was resolved
$Data/Context/DataItem/WorkflowId$                                      The Workflow ID (GUID)
$Data/Recipients/To/Address/Address$                                    The name of the recipient

The Web Console URL:
$Target/Property[Type="Notification!Microsoft.SystemCenter.AlertNotificationSubscriptionServer"/WebConsoleUrl$

The principalname of the management server:
Target/Property[Type="Notification!Microsoft.SystemCenter.AlertNotificationSubscriptionServer"/PrincipalName$

Published Wednesday, December 12, 2007 4:35 PM by kevinhol

Comment Notification

If you would like to receive an email when updates are made to this post, please register here

Subscribe to this post's comments using RSS

Comments

# www.contoso.se » Blog Archive » Script: Notification Logfile

Sunday, March 16, 2008 1:51 PM by www.contoso.se » Blog Archive » Script: Notification Logfile

PingBack from http://contoso.se/blog/?p=265

# re: Adding custom information to alert description (s) and notifications

Tuesday, April 15, 2008 5:01 AM by Emeric

Do you think,I can used a another performance threshold monitor in alerte description ?

# Some more Command Notification Tricks and Tips

Wednesday, April 16, 2008 8:17 PM by OpsMgr, SCE And MOM Blog

Here are a couple a tidbits on command notification with Operations Manager 2007 I’ve seen people

# re: Adding custom information to alert description (s) and notifications

Friday, May 02, 2008 2:31 AM by Brian Soh

For Correlated event Monitor;

Below is the variable for event Description

$Data/Context/DataItem/Item0Context/DataItem/EventDescription$ $Data/Context/DataItem/Item1Context/DataItem/EventDescription$

# Are your Alert Descriptions Ugly?

Tuesday, July 01, 2008 6:02 PM by Kevin Holman's OpsMgr Blog

When you create an Alert Description in OpsMgr 2007 for alerting rules and monitors.... you might have

# Collecting and Monitoring information from WMI as performance data

Wednesday, July 02, 2008 6:43 PM by Kevin Holman's OpsMgr Blog

Many times, we would like to collect information for reporting, or measure and alert on something. 

# re: Adding custom information to alert description (s) and notifications

Monday, September 15, 2008 2:34 AM by Habeeb

What do you do when you have monitors created from Web application template, like in case an Base page status code monitor should be able to send out mail indicating from which web site that Alert is raised and also the exact base page status code which generated the error

# re: web application template alerts

Tuesday, September 16, 2008 4:30 PM by kevinhol

For these - please see http://blogs.technet.com/momteam/archive/2008/09/04/actionable-alerts-for-web-applications-in-operations-manager-2007.aspx

# SCOM 2007 Useful Links

Thursday, October 02, 2008 1:57 PM by Dario IT Solutions Blog

Main Downloads page (catalog, documentation) http://technet.microsoft.com/en-us/opsmgr/bb498232.aspx

# re: Adding custom information to alert description (s) and notifications

Friday, October 17, 2008 2:47 PM by David Strebel

Is there a way to add company knowledge to notifications.

# re: Adding custom information to alert description (s) and notifications

Tuesday, October 28, 2008 12:59 AM by ray

great resource. you saved my day.

# re: Adding custom information to alert description (s) and notifications

Monday, March 23, 2009 8:44 AM by Tom Speijer

Kevin nice one, but when i try the alerting in a monitor which monitors a basic service. and for example i use $Data/Context/EventDescription$ my alert will result in {0}..

shouldn't that be anything more helpfull?

and can you use multiple lines? because when i try it, the alert just won't come..?

# re: Adding custom information to alert description (s) and notifications

Monday, March 23, 2009 10:00 AM by kevinhol

Tom - the reason this doesnt work - is because there IS NO "EventDescription" for a server monitor.

Event Description is for Events, in the Event log.  The Service unit monitor is its own module, and it has no relation to the event log module.  You need to uses variabled applicable to the Service Unit Monitor.... which are posted above.

# re: Adding custom information to alert description (s) and notifications

Monday, March 23, 2009 11:32 AM by Tom Speijer

Kevin,

i've already tried about anything shown above

now i've tried this one :

$Data/Context/Property[@Name='Name']$ it still gives me {0}

# re: Adding custom information to alert description (s) and notifications

Tuesday, March 24, 2009 6:33 AM by Tom Speijer

it's fixed..

when i changed something in the alert description, i immediatly looked in the alert what was showing op in the active alerts. it always said {0}.

i never waited for a new alert to popup.

apparantly when a new one shows, the event description is populated perfectly.

thx for you assistance!

# re: Adding custom information to alert description (s) and notifications

Monday, May 18, 2009 2:46 PM by Rajeev

can I get the ip address of the host?

# re: IP address

Tuesday, May 19, 2009 5:04 PM by kevinhol

You can add anything that is a property of your data source.... like event, perf, etc... that our data source mudule understands.

The IP address is an ATTRIBUTE of the Windows Computer object... and is not tied to the alert, or the data source.

So - I dont know a way to add the IP address of the object to all alerts.... and this wont always even make sense - for alerts that come from "SQL Database" for instance.  

The only thing I can think of is writing a custom product connector - which would modify alerts via the SDK after they are created on a polling cycle.... this connector would examin the alert - query up the containment/hosting relationships to find the windows computer object - gather the IP attribute - and populate a custom field with the IP, on the alert.

# Using a Generic Text Log rule to monitor an ASCII text file – even when the file is a UNC path

Friday, June 19, 2009 7:30 PM by Kevin Holman's OpsMgr Blog

There are several examples in blogs on how to create a generic text log rule to monitor for a local text

# re: Adding custom information to alert description (s) and notifications

Friday, July 10, 2009 4:11 PM by CJH

The event Monitor variables don't work.

I'm trying to put information in the subject of the notification subscription based on a monitor.  I'm using

$Data/Context/UserName$ is logging in to $Data/Context/LoggingComputer$

as the subject.  When the email goes out, I get

" is logging in to "

# re: Adding custom information to alert description (s) and notifications

Monday, July 13, 2009 10:14 PM by Gurpreet

If I have a configuration parameter in the monitor like a threshold number, how do i access this value in the alert?

For e.g. I have a monitor that generates an alerts if 5 samples have value of call duration of more than 100ms. Both the number of samples and duration threshold need to be displayed in the alert. These are not properties of any of the classes.

# re: Adding custom information to alert description (s) and notifications

Friday, August 14, 2009 1:59 AM by PaulD

Hi Kevin.

using get-alert cmdlet we have field named "NetbiosComputerName". Is there any Xpath equivalent for this field?

# re: Computername

Friday, August 14, 2009 2:12 AM by kevinhol

Not that I am aware of - but I am working on just that issue.  We really need this - and if there is a way to xpath this - it would really help.

I am trying to find out if this is possible from the product group right now - but I dont think it is.  Sure would be nice.

I am develping a spreadsheet to cross reference the alert view in the console/alert view in DB/alert notification variables/SDK Get-Alert/R2 connector key pairs.

# re: Adding custom information to alert description (s) and notifications

Tuesday, November 03, 2009 12:20 PM by Mark Benoit

Are there any Alert Description variables available for Aggregate rollup monitors?  At best, I would like to be able to have the Aggregate monitor alert description show the actual value that triggerd the unhealthy state of the child monitors (in this case, CPU% utilization) like $Data/Context/Property[@Name='PctUsage'], but that does not work.  If that is not available to the parent monitor, then it would be nice to be able to include a Alert Description variable for the Alert Severity of the child monitor that went unhealthy (Warning or Critical).

# re: Adding custom information to alert description (s) and notifications

Tuesday, November 03, 2009 12:28 PM by kevinhol

Aggregate rollup monitors roll up state only.  They have no idea or information about the values or details on the monitors below them.  They have a state-rollup algorithm (best of, worst of) and then they simply change state according to that policy.

In this way - by design if you alert from an aggregate monitor - you cannot get deep level details about the root cause monitor - it could be one - or many that are problematic at any given time.

For the details - you must alert on the unit monitor.

Leave a Comment

(required) 
required 
(required) 

  
Enter Code Here: Required
 
Page view tracker