In MOM 2005 we could add advanced criterias and for example check if a event description included a special word, “matches wildcard”. In this post I will show you how to get the same feature in Ops Mgr 2007. I want an alert when a event with “unsucessfully” is written in the local event log.
I have create a simple vbscript that writes two events to a local event log. The event ID and source are the same, and the description is almost the same, but one event includes “unsuccessfully” and the other one includes “sucessfully”. Now I want to get an alert only when events with “unsuccessfully” a written in the local event viewer.
- Start Ops Mgr Console, click Authoring
- Right-click Rules and choose to create a new Rule, create a Alert Generating Rules/Event Based/NT Event Log (Alert)
- Rule Type: Choose a suitable management pack to store your new rule, click Next
- General: Input a name, description and choose a suitable target, click Next
- Event Log Type: Choose which log, in my example events will be generated in the Application Log. Click next
- Build Event Expression: in my example
Event ID. equals. 0
Event Source. equals. WSH
- Click Insert and choose then “…” in the new parameter box. In “Select an Event Property” choose “Use parameter name not specified above” and then insert EventDescription , click OK
setup the last parameter as
EventDescription. Contains. unsuccessfully , click Next
- Configure Alerts: Configure a suitable alert, with some description. If you want the entire event shown in the alert description you can add $Data/EventDescription$. Click Create