SCOM – Alert parameter summary
// February 1st, 2012 // No Comments » // SCOM
Default Event rule parameters:
EventDisplayNumber (Event ID): $Data/EventDisplayNumber$ EventDescription (Description): $Data/EventDescription$ Publisher Name (Event Source): $Data/PublisherName$ EventCategory: $Data/EventCategory$ EventNumber: $Data/EventNumber$ LoggingComputer: $Data/LoggingComputer$ EventLevel: $Data/EventLevel$ Channel: $Data/Channel$ UserName: $Data/UserName$
Default Event monitor parameters:
EventDisplayNumber (Event ID): $Data/Context/EventDisplayNumber$ EventDescription (Description): $Data/Context/EventDescription$ UserName: $Data/Context/UserName$ EventNumber: $Data/Context/EventNumber$ Publisher Name (Event Source): $Data/Context/PublisherName$ EventCategory: $Data/Context/EventCategory$ LoggingComputer: $Data/Context/LoggingComputer$ EventLevel: $Data/Context/EventLevel$ Channel: $Data/Context/Channel$
Default parameters for repeating Event monitors:
EventDisplayNumber (Event ID): $Data/Context/Context/DataItem/EventDisplayNumber$ EventDescription (Description): $Data/Context/Context/DataItem/EventDescription$ Publisher Name (Event Source): $Data/Context/Context/DataItem/PublisherName$ EventCategory: $Data/Context/Context/DataItem/EventCategory$ UserName: $Data/Context/Context/DataItem/UserName$ EventNumber: $Data/Context/Context/DataItem/EventNumber$ LoggingComputer: $Data/Context/Context/DataItem/LoggingComputer$ EventLevel: $Data/Context/Context/DataItem/EventLevel$ Channel: $Data/Context/Context/DataItem/Channel$
Default performance threshold parameters:
Object (Perf Object Name): $Data/Context/ObjectName$ Counter (Perf Counter Name): $Data/Context/CounterName$ Instance (Perf Instance Name): $Data/Context/InstanceName$ Value (Perf Counter Value): $Data/Context/Value$
Default (windows)services parameters:
Service Name $Data/Context/Property[@Name='Name']$ Service Dependencies $Data/Context/Property[@Name='Dependencies']$ Service Binary Path $Data/Context/Property[@Name='BinaryPathName']$ Service Display Name $Data/Context/Property[@Name='DisplayName']$ Service Description $Data/Context/Property[@Name='Description']$
Default eventlogfile parameters:
Logfile monitor parameter for the logfile Directory : $Data/Context/LogFileDirectory$ Logfile monitor parameter for the logfile name: $Data/Context/LogFileName$ Logfile monitor parameter for the string: $Data/Context/Params/Param[1]$ Logfile rules for the logfile directory : $Data/EventData/DataItem/LogFileDirectory$ Logfile rule for the log name: $Data/EventData/DataItem/LogFileName$ Logfile rule for the specific string: $Data/EventData/DataItem/Params/Param[1]$
Default monitoring parameters:
Notification for the AlertID GUID: $Data/Context/DataItem/AlertId$ Notification for the Alert Name: $Data/Context/DataItem/AlertName$ Notification for the Alert category: $Data/Context/DataItem/Category$ PerformanceHealth, PerformanceCollection, Operations, EventCollection, StateCollection, SoftwareAndUpdates, Alert, System, Custom, AvailabilityHealth, ConfigurationHealth, SecurityHealth, Discovery, NotificationCategory and Maintenance.
Monitoring & Alert Content parameters:
$Data/Context/DataItem/CreatedByMonitor$ True/False $Data/Context/DataItem/Custom1$ CustomField1 $Data/Context/DataItem/Custom2$ CustomField2 $Data/Context/DataItem/Custom3$ CustomField3 $Data/Context/DataItem/Custom4$ CustomField4 $Data/Context/DataItem/Custom5$ CustomField5 $Data/Context/DataItem/Custom6$ CustomField6 $Data/Context/DataItem/Custom7$ CustomField7 $Data/Context/DataItem/Custom8$ CustomField8 $Data/Context/DataItem/Custom9$ CustomField9 $Data/Context/DataItem/Custom10$ CustomField10 $Data/Context/DataItem/Priority$ The Alert Priority Number (High=1,Medium=2,Low=3) $Data/Context/DataItem/Owner$ The Alert Owner $Data/Context/DataItem/RepeatCount$ The Alert Repeat Count $Data/Context/DataItem/ResolutionState$ Resolution state ID (0=New, 255= Closed) $Data/Context/DataItem/ResolutionStateLastModified$ UTC Date/Time ResolutionState was last modified $Data/Context/DataItem/ResolutionStateLastModifiedLocal$ Local Date/Time ResolutionState was last modified $Data/Context/DataItem/ResolutionStateName$ The Resolution State Name (New, Closed) $Data/Context/DataItem/ResolvedBy$ Person resolving the alert $Data/Context/DataItem/Severity$ The Alert Severity ID $Data/Context/DataItem/TicketId$ The TicketID $Data/Context/DataItem/DataItemCreateTime$ UTC Date/Time of Dataitem created $Data/Context/DataItem/DataItemCreateTimeLocal$ LocalTime Date/Time of Dataitem created $Data/Context/DataItem/LastModified$ UTC Date/Time DataItem was modified $Data/Context/DataItem/LastModifiedLocal$ Local Date/Time DataItem was modified $Data/Context/DataItem/ManagedEntity$ ManagedEntity GUID $Data/Context/DataItem/ManagedEntityDisplayName$ ManagedEntity Display name $Data/Context/DataItem/ManagedEntityFullName$ ManagedEntity Full name $Data/Context/DataItem/ManagedEntityPath$ Managed Entity Path $Data/Context/DataItem/TimeAdded$ UTC Time Added $Data/Context/DataItem/TimeAddedLocal$ Local Time Added $Data/Context/DataItem/TimeRaised$ UTC Time Raised $Data/Context/DataItem/TimeRaisedLocal$ Local Time Raised $Data/Context/DataItem/TimeResolved$ UTC Date/Time the Alert was resolved $Data/Context/DataItem/WorkflowId$ The Workflow ID (GUID) $Target/Property[Type=”Notification!Microsoft.SystemCenter.AlertNotificationSubscriptionServer”/WebConsoleUrl$
Console parameters:
Target/Property[Type=”Notification!Microsoft.SystemCenter.AlertNotificationSubscriptionServer”/PrincipalName$
( which is actually the principalname of the management server generating the alert )
$Data/Recipients/To/Address/Address$
( which holds the name string of the recipient of the email notification.
