TimHe's Blog of SMS SCCM SCOM MOM and SCE

Some people have asked how to get event data into the Alert Description.

Here are some values you can use:

In a rule, use the following variables to display event properties:

Event Category:

$Data/EventCategory$

Event ID:

$Data/EventDisplayNumber$

Event Level (i.e. Error, Warning, Information):

$Data/EventLevel$

Note: In the alert description, the Event Level variable displays 1 for Error, 2

for Warning and 4 for Information.

Event Source:

$Data/PublisherName$

Full Event Number (typically the same as Event ID):

$Data/EventNumber$

Logging Computer:

$Data/LoggingComputer$

Logname (i.e. Application, System, Security):

$Data/Channel$

User:

$Data/UserName$

Event Description:

$Data/EventDescription$

Custom Parameters:

$Data/Params/Param[1]$

$Data/Params/Param[2]$

etc.

In a monitor, use the following variables to display event properties:

Event Category:

$Data/Context/EventCategory$

Event ID:

$Data/Context/EventDisplayNumber$

Event Level (i.e. Error, Warning, Information):

$Data/Context/EventLevel$

Note: In the alert description, the Event Level variable displays 1 for Error, 2

for Warning and 4 for Information.

Event Source:

$Data/Context/PublisherName$

Full Event Number (typically the same as Event ID):

$Data/Context/EventNumber$

Logging Computer:

$Data/Context/LoggingComputer$

Logname (i.e. Application, System, Security):

$Data/Context/Channel$

User:

$Data/Context/UserName$

Event Description:

$Data/Context/EventDescription$

Custom Parameters:

$Data/Context/Params/Param[1]$

$Data/Context/Params/Param[2]$

etc.

The previous comment i posted will work for most alerts/monitors

Here is the data that will work for the text log alert:

"Log File Directory : $Data/EventData/DataItem/LogFileDirectory$

LogFile name: $Data/EventData/DataItem/LogFileName$

String: $Data/EventData/DataItem/Params/Param[1]$"