Scribd
Upload
158 views5 pages

XML Cheat Sheet: For Operations Manager and Essentials 2007

This document provides an XML cheat sheet for Operations Manager and Essentials 2007. It lists various monitor types like event rules, performance monitors, service monitors and the corresponding XML properties that can be used for each. It also provides XML properties for notifications, SNMP, syslog, log file monitors and WMI. The cheat sheet is intended to help users build XML queries and expressions for different monitor types in Operations Manager.

Uploaded by

djpetry
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PDF, TXT or read online on Scribd
158 views5 pages

XML Cheat Sheet: For Operations Manager and Essentials 2007

This document provides an XML cheat sheet for Operations Manager and Essentials 2007. It lists various monitor types like event rules, performance monitors, service monitors and the corresponding XML properties that can be used for each. It also provides XML properties for notifications, SNMP, syslog, log file monitors and WMI. The cheat sheet is intended to help users build XML queries and expressions for different monitor types in Operations Manager.

Uploaded by

djpetry
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PDF, TXT or read online on Scribd
You are on page 1/ 5

XML Cheat Sheet

For Operations Manager and Essentials 2007

Contents:
Event Rules Notifications
Event Monitors SNMP
Repeating Event Monitors SYSLOG
Performance Threshold Monitors Log File Monitor
Service Monitors WMI

Event Rules:
Property XML
EventDisplayNumber (Event ID): $Data/EventDisplayNumber$
EventDescription (Description): $Data/EventDescription$
Publisher Name (Event Source): $Data/PublisherName$
Publisher Name (Event Source): $Data/PublisherName$
EventCategory: $Data/EventCategory$
LoggingComputer: $Data/LoggingComputer$
EventLevel: $Data/EventLevel$
Channel: $Data/Channel$
EventNumber: $Data/EventNumber$

Event Monitors:
Property XML
EventDisplayNumber (Event ID): $Data/Context/EventDisplayNumber$
EventDescription (Description): $Data/Context/EventDescription$
Publisher Name (Event Source): $Data/Context/PublisherName$
EventCategory: $Data/Context/EventCategory$
LoggingComputer: $Data/Context/LoggingComputer$
EventLevel: $Data/Context/EventLevel$
Channel: $Data/Context/Channel$
UserName: $Data/Context/UserName$
EventNumber: $Data/Context/EventNumber$

1 System Center Forum | http://www.systemcenterfourm.org


Repeating Event Monitors:
Property XML
EventDisplayNumber (Event ID): $Data/Context/DataItem/EventDisplayNumber$
EventDescription (Description): $Data/Context/DataItem/EventDescription$
Publisher Name (Event Source): $Data/Context/DataItem/PublisherName$
EventCategory: $Data/Context/DataItem/EventCategory$
LoggingComputer: $Data/Context/DataItem/LoggingComputer$
EventLevel: $Data/Context/DataItem/EventLevel$
Channel $Data/Context/DataItem/Channel$
UserName: $Data/Context/Context/DataItem/UserName$
EventNumber: $Data/Context/DataItem/EventNumber$

Performance Threshold Monitors


Property XML
Object (Perf Object Name): $Data/Context/ObjectName$
Counter (Perf Counter Name): $Data/Context/CounterName$
Instance (Perf Instance Name): $Data/Context/InstanceName$
Value (Perf Counter Value): $Data/Context/Value$

Service Monitors
Property XML
Service Name $Data/Context/Property[@Name='Name']$
Service Dependencies $Data/Context/Property[@Name='Dependencies']$
Service Binary Path $Data/Context/Property[@Name='BinaryPathName']$
Service Display Name $Data/Context/Property[@Name='DisplayName']$
Service Description $Data/Context/Property[@Name='Description']$

SNMP

SNMP Probe-based Monitoring


In SNMP probe-based or trap monitors, this is value youll need to add to the Parameter Name
field when comparing a value returned from the probe (GET) operation.

$data/SnmpVarBinds/SnmpVarBind[1]/Value$

2 System Center Forum | http://www.systemcenterfourm.org


SNMP Rules

SYSLOG
Property XML
Facility $Data/EventData/DataItem/Facility$
Severity $Data/EventData/DataItem/Severity$
Priority $Data/EventData/DataItem/Priority$
PriorityName $Data/EventData/DataItem/PriorityName$
TimeStamp $Data/EventData/DataItem/TimeStamp$
HostName $Data/EventData/DataItem/HostName$
Message $Data/EventData/DataItem/Message$

Log File Monitor


Property XML
Log File Directory: $Data/EventData/DataItem/LogFileDirectory$
LogFile name: $Data/EventData/DataItem/LogFileName$
String: $Data/EventData/DataItem/Params/Param[1]$

Notifications
Property XML
AlertID GUID $Data/Context/DataItem/AlertId$
Alert Name $Data/Context/DataItem/AlertName$
Alert category $Data/Context/DataItem/Category$
UTC Date/Time of Dataitem created $Data/Context/DataItem/DataItemCreateTime$
LocalTime Date/Time of Dataitem $Data/Context/DataItem/DataItemCreateTimeLocal$
created
UTC Date/Time DataItem was $Data/Context/DataItem/LastModified$
modified
Local Date/Time DataItem was $Data/Context/DataItem/LastModifiedLocal$
modified
CustomField1 $Data/Context/DataItem/Custom1$
CustomField2 $Data/Context/DataItem/Custom2$
CustomField3 $Data/Context/DataItem/Custom3$
CustomField4 $Data/Context/DataItem/Custom4$
CustomField5 $Data/Context/DataItem/Cust2m5$
CustomField6 $Data/Context/DataItem/Custom6$
CustomField7 $Data/Context/DataItem/Custom7$
CustomField8 $Data/Context/DataItem/Custom8$
CustomField9 $Data/Context/DataItem/Custom9$
CustomField10 $Data/Context/DataItem/Custom10$
Created by monitor? (true/false) $Data/Context/DataItem/CreatedByMonitor$

3 System Center Forum | http://www.systemcenterfourm.org


Property XML
Recipient Name $Data/Recipients/To/Address/Address$
Mgmt Server Principal Name $Target/Property[Type="Notification!Microsoft.SystemCenter.
AlertNotificationSubscriptionServer"]/PrincipalName$
Web Console URL $Target/Property[Type="Notification!Microsoft.SystemCenter.
AlertNotificationSubscriptionServer"]/WebConsoleUrl$
Workflow ID (GUID) $Data/Context/DataItem/WorkflowId$
Date/Time the Alert was resolved $Data/Context/DataItem/TimeResolved$
(UTC)
Time Raised (Local) $Data/Context/DataItem/TimeRaisedLocal$
Time Raised (UTC) $Data/Context/DataItem/TimeRaised$
Time Added (Local) $Data/Context/DataItem/TimeAddedLocal$
UTC Time Added $Data/Context/DataItem/TimeAdded$
TicketID $Data/Context/DataItem/TicketId$
Alert Severity ID $Data/Context/DataItem/Severity$
Person resolving the alert $Data/Context/DataItem/ResolvedBy$
The Resolution State Name (New, $Data/Context/DataItem/ResolutionStateName$
Closed)
Date/Time Resolution State was last $Data/Context/DataItem/ResolutionStateLastModifiedLocal$
modified (Local)
Date/Time Resolution State was last $Data/Context/DataItem/ResolutionStateLastModified$
modified (UTC)
Resolution state ID (0=New 255= $Data/Context/DataItem/ResolutionState$
Closed)
Alert Repeat Count $Data/Context/DataItem/RepeatCount$
Alert Owner $Data/Context/DataItem/Owner$
Managed Entity Path $Data/Context/DataItem/ManagedEntityPath$
ManagedEntity Full name $Data/Context/DataItem/ManagedEntityFullName$
ManagedEntity Display name $Data/Context/DataItem/ManagedEntityDisplayName$
ManagedEntity GUID $Data/Context/DataItem/ManagedEntity$

WMI
The following are expression matching and discovery mapper XPATH strings. In the examples below,
replace WMI_PROP_NAME according to the query performed in the rule or monitor.

Alert Parameter: $Data/Context/Property[@Name=WMI_PROP_NAME]$


Discovery Mapper: $Data/Property[@Name=WMI_PROP_NAME]$
Condition Expression: Property[@Name=WMI_PROP_NAME]

Feedback
4 System Center Forum | http://www.systemcenterfourm.org
Send any suggestions to [email protected]

5 System Center Forum | http://www.systemcenterfourm.org

You might also like