If the code you've written -- or if you are simply cutting and pasting the SCOM 2007 SDK examples -- depends on the SCOM 2007 SDK, you may have to rewrite it to get it to work in SCOM 2012.
Below, is an example of 2007 SDK Code:
/// <summary>
/// Query for diagnostics.
/// </summary>
using System;
using System.Collections.ObjectModel;
using Microsoft.EnterpriseManagement;
using Microsoft.EnterpriseManagement.Configuration;
using Microsoft.EnterpriseManagement.Monitoring;
namespace SDKSamples
{
class Program
{
static void Main(string[] args)
{
ManagementGroup mg = new ManagementGroup("localhost");
// The criteria specifies that you want to collect
// all the diagnostics that contain SystemCenter in their name.
MonitoringDiagnosticCriteria diagnosticCriteria =
new MonitoringDiagnosticCriteria(
"Name LIKE '%SystemCenter%'");
Console.WriteLine("Querying for data...");
ReadOnlyCollection<MonitoringDiagnostic> diagnostics =
mg.GetMonitoringDiagnostics(diagnosticCriteria);
// Display information about each diagnostic.
foreach (MonitoringDiagnostic diagnostic in diagnostics)
{
Console.WriteLine("Diagnostic name: " + diagnostic.Name);
Console.WriteLine("Status: " + diagnostic.Status.ToString());
Console.WriteLine("Category: " + diagnostic.Category);
Console.WriteLine("Description: " + diagnostic.Description +
Environment.NewLine);
}
}
}
}
Compare that to what will work in SCOM 2012:
/// <summary>
/// Query for diagnostics.
/// </summary>
using System;
using System.Collections.ObjectModel;
using Microsoft.EnterpriseManagement;
using Microsoft.EnterpriseManagement.Configuration;
using Microsoft.EnterpriseManagement.Monitoring;
namespace SDKSamples
{
class Program
{
static void Main(string[] args)
{
EnterpriseManagementGroup mg = new EnterpriseManagementGroup("localhost");
// The criteria specifies that you want to collect
// all the diagnostics that contain SystemCenter in their name.
ManagementPackDiagnosticCriteria diagnosticCriteria =
new ManagementPackDiagnosticCriteria(
"Name LIKE '%SystemCenter%'");
Console.WriteLine("Querying for data...");
ReadOnlyCollection<ManagementPackDiagnostic> diagnostics =
mg.Monitoring.GetMonitoringDiagnostics(diagnosticCriteria);
// Display information about each diagnostic.
foreach (ManagementPackDiagnostic diagnostic in diagnostics)
{
Console.WriteLine("Diagnostic name: " + diagnostic.Name);
Console.WriteLine("Status: " + diagnostic.Status.ToString());
Console.WriteLine("Category: " + diagnostic.Category);
Console.WriteLine("Description: " + diagnostic.Description +
Environment.NewLine);
}
}
}
}
In VB.Net, the new looks like this:
Imports System
Imports System.Collections.ObjectModel
Imports Microsoft.EnterpriseManagement
Imports Microsoft.EnterpriseManagement.Configuration
Imports Microsoft.EnterpriseManagement.Monitoring
Module VbCode
Public Sub List_Diagnostics()
Dim mg As EnterpriseManagementGroup = new
EnterpriseManagementGroup("localhost")
Dim Criteria As ManagementPackDiagnosticCriteria = new
ManagementPackDiagnosticCriteria("Name LIKE '%SystemCenter%'")
Console.WriteLine("Querying for data...")
// Display information about each diagnostic.
for each diagnostic as ManagementPackDiagnostic in
mg.Monitoring.GetMonitoringDiagnostics(Criteria)
Console.WriteLine("Diagnostic name: " & diagnostic.Name)
Console.WriteLine("Status: " & diagnostic.Status.ToString())
Console.WriteLine("Category: " & diagnostic.Category)
Console.WriteLine("Description: " & diagnostic.Description
Console.WriteLine(Environment.NewLine)
Next
End Sub
End Module
Tuesday, October 23, 2012
Tuesday, October 16, 2012
SCOM 2007/2012 Cheat Sheet
What I'm about to cover is not located on anyone elses site. And if it is, they just ripped it off from here.
Cheat Sheet #1: The poor man's managementpack working environment using SCOM 2007.
Thought you had to have the SCOM Console or SCOM Authoring Console installed and working correctly just to create a ManagementPack? You thought wrong.
Manually install an SCOM 2007 agent on your computer. Copy the SDK binaries into the agent's folder, bring up a copy of Visual Studio, create a project and then add a reference to them by browsing over to the agent's folder and selecting each one of the binaries. You only need the application one.
Then, add the namespaces to your form or module or class:
VB.Net:
Imports Microsoft.EnterpriseManagement.Configuration
Imports Microsoft.EnterpriseManagement.Configuration.IO
C#.Net:
using Microsoft.EnterpriseManagement.Configuration;
using Microsoft.EnterpriseManagement.Configuration.IO;
C++.Net:
using namespace Microsoft::EnterpriseManagement::Configuration;
using namespace Microsoft::EnterpriseManagement::Configuration::IO;
Cheat Sheet #2: The poor man's managementpack working environment using SCOM 2012.
Manually install an SCOM 2012 agent on your computer. Copy the SDK binaries into the agent's folder, bring up a copy of Visual Studio, create a project and then add a reference to them by browsing over to the agent's folder and selecting each one of the binaries. You only need the core one.
Then, add the namespaces to your form or module or class:
VB.Net:
Imports Microsoft.EnterpriseManagement.Configuration
Imports Microsoft.EnterpriseManagement.Configuration.IO
C#.Net:
using Microsoft.EnterpriseManagement.Configuration;
using Microsoft.EnterpriseManagement.Configuration.IO;
C++.Net:
using namespace Microsoft::EnterpriseManagement::Configuration;
using namespace Microsoft::EnterpriseManagement::Configuration::IO;
This one is a bit trickier in that you have to change the compiler option from .Net Framework 4 Client Profile to .Net Framework 4. See picture below:
Dim mp as New ManagementPack(mpFilename)
Dim mp as New ManagementPack(xmlFilename)
Cheat Sheet #4: Covert an unsealed SCOM 2007 mp to an unsealed SCOM 2012 mp in just two lines of code but you have to use the 2012 SDK binaries. Use only a copy of your original SCOM 2007 mp (sealed or unsealed). Place it into a new folder. Below is an example of how to do this using a sealed mp:
Dim OpenFileDialog As New OpenFileDialogOpenFileDialog.InitialDirectory = My.Computer.FileSystem.SpecialDirectories.MyDocumentsOpenFileDialog.Filter =
"Sealed Managementpack (*.mp)|*.mp"If (OpenFileDialog.ShowDialog(Me) = System.Windows.Forms.DialogResult.OK) ThenDim FileName As String = OpenFileDialog.FileName
Dim mp As New ManagementPack(FileName)
Dim xmlWriter As New ManagementPackXmlWriter(Application.StartupPath)
Dim xmlFilename As String = xmlWriter.WriteManagementPack(mp)mp =
New mp(xmlFilename)mp.AcceptChanges()
End If
If you try doing the code below, you will get an error:
Dim OpenFileDialog As New OpenFileDialogOpenFileDialog.InitialDirectory = My.Computer.FileSystem.SpecialDirectories.MyDocumentsOpenFileDialog.Filter =
"Sealed Managementpack (*.mp)|*.mp"If (OpenFileDialog.ShowDialog(Me) = System.Windows.Forms.DialogResult.OK) ThenDim FileName As String = OpenFileDialog.FileName
Dim mp As New ManagementPack(FileName)mp.AcceptChanges()End If
The image below proves it is trying to write to disk:
Here's an example of doing the same thing using the unsealed xml file:
Dim OpenFileDialog As New OpenFileDialogOpenFileDialog.InitialDirectory = My.Computer.FileSystem.SpecialDirectories.MyDocumentsOpenFileDialog.Filter =
"Unsealed Managementpack (*.xml)|*.xml"If (OpenFileDialog.ShowDialog(Me) = System.Windows.Forms.DialogResult.OK) ThenDim FileName As String = OpenFileDialog.FileName
Dim mp As New ManagementPack(FileName)mp.AcceptChanges()End If
Cheat Sheet #5: You can't verify your xml. You have to use the Authoring Console. Wanna bet?
Dim OpenFileDialog As New OpenFileDialog
OpenFileDialog.InitialDirectory = My.Computer.FileSystem.SpecialDirectories.MyDocuments
OpenFileDialog.Filter = "Unsealed Managementpack (*.xml)|*.xml"
If (OpenFileDialog.ShowDialog(Me) = System.Windows.Forms.DialogResult.OK) Then
Dim FileName As String = OpenFileDialog.FileNameDim mpStore as new ManagementFileStore
'I'm using SCOM 2012 as an example
mpStore.AddDirectory("C:\SC2012OMRTM\ManagementPacks")
Dim mp As New ManagementPack(FileName, mpStore)mp.Verify()End If
NOTE: This assumes you're using the standard out of the box libaray mps
Cheat Sheet #6: You don't have to have hard code every library and other referenced managementpacks.
When dynamically adding librarys and other referenced mamagmentpacks, create an a array of mps instead.
This way, your libraries can be dynamically driven by the design of your ManagementPack.
Cheat Sheet #1: The poor man's managementpack working environment using SCOM 2007.
Thought you had to have the SCOM Console or SCOM Authoring Console installed and working correctly just to create a ManagementPack? You thought wrong.
Manually install an SCOM 2007 agent on your computer. Copy the SDK binaries into the agent's folder, bring up a copy of Visual Studio, create a project and then add a reference to them by browsing over to the agent's folder and selecting each one of the binaries. You only need the application one.
Then, add the namespaces to your form or module or class:
VB.Net:
Imports Microsoft.EnterpriseManagement.Configuration
Imports Microsoft.EnterpriseManagement.Configuration.IO
C#.Net:
using Microsoft.EnterpriseManagement.Configuration;
using Microsoft.EnterpriseManagement.Configuration.IO;
C++.Net:
using namespace Microsoft::EnterpriseManagement::Configuration;
using namespace Microsoft::EnterpriseManagement::Configuration::IO;
Cheat Sheet #2: The poor man's managementpack working environment using SCOM 2012.
Manually install an SCOM 2012 agent on your computer. Copy the SDK binaries into the agent's folder, bring up a copy of Visual Studio, create a project and then add a reference to them by browsing over to the agent's folder and selecting each one of the binaries. You only need the core one.
Then, add the namespaces to your form or module or class:
VB.Net:
Imports Microsoft.EnterpriseManagement.Configuration
Imports Microsoft.EnterpriseManagement.Configuration.IO
C#.Net:
using Microsoft.EnterpriseManagement.Configuration;
using Microsoft.EnterpriseManagement.Configuration.IO;
C++.Net:
using namespace Microsoft::EnterpriseManagement::Configuration;
using namespace Microsoft::EnterpriseManagement::Configuration::IO;
This one is a bit trickier in that you have to change the compiler option from .Net Framework 4 Client Profile to .Net Framework 4. See picture below:
Cheat Sheet #3: Both sealed and unsealed Managementpacks are MPs as far as Managmentpacks are concerned. When you make reference to an mp either format is accepted by the following call:Dim mp as New ManagementPack(mpFilename)
Dim mp as New ManagementPack(xmlFilename)
Cheat Sheet #4: Covert an unsealed SCOM 2007 mp to an unsealed SCOM 2012 mp in just two lines of code but you have to use the 2012 SDK binaries. Use only a copy of your original SCOM 2007 mp (sealed or unsealed). Place it into a new folder. Below is an example of how to do this using a sealed mp:
Dim OpenFileDialog As New OpenFileDialogOpenFileDialog.InitialDirectory = My.Computer.FileSystem.SpecialDirectories.MyDocumentsOpenFileDialog.Filter =
"Sealed Managementpack (*.mp)|*.mp"If (OpenFileDialog.ShowDialog(Me) = System.Windows.Forms.DialogResult.OK) ThenDim FileName As String = OpenFileDialog.FileName
Dim mp As New ManagementPack(FileName)
Dim xmlWriter As New ManagementPackXmlWriter(Application.StartupPath)
Dim xmlFilename As String = xmlWriter.WriteManagementPack(mp)mp =
New mp(xmlFilename)mp.AcceptChanges()
End If
If you try doing the code below, you will get an error:
Dim OpenFileDialog As New OpenFileDialogOpenFileDialog.InitialDirectory = My.Computer.FileSystem.SpecialDirectories.MyDocumentsOpenFileDialog.Filter =
"Sealed Managementpack (*.mp)|*.mp"If (OpenFileDialog.ShowDialog(Me) = System.Windows.Forms.DialogResult.OK) ThenDim FileName As String = OpenFileDialog.FileName
Dim mp As New ManagementPack(FileName)mp.AcceptChanges()End If
The image below proves it is trying to write to disk:
Here's an example of doing the same thing using the unsealed xml file:
Dim OpenFileDialog As New OpenFileDialogOpenFileDialog.InitialDirectory = My.Computer.FileSystem.SpecialDirectories.MyDocumentsOpenFileDialog.Filter =
"Unsealed Managementpack (*.xml)|*.xml"If (OpenFileDialog.ShowDialog(Me) = System.Windows.Forms.DialogResult.OK) ThenDim FileName As String = OpenFileDialog.FileName
Dim mp As New ManagementPack(FileName)mp.AcceptChanges()End If
Cheat Sheet #5: You can't verify your xml. You have to use the Authoring Console. Wanna bet?
Dim OpenFileDialog As New OpenFileDialog
OpenFileDialog.InitialDirectory = My.Computer.FileSystem.SpecialDirectories.MyDocuments
OpenFileDialog.Filter = "Unsealed Managementpack (*.xml)|*.xml"
If (OpenFileDialog.ShowDialog(Me) = System.Windows.Forms.DialogResult.OK) Then
Dim FileName As String = OpenFileDialog.FileNameDim mpStore as new ManagementFileStore
'I'm using SCOM 2012 as an example
mpStore.AddDirectory("C:\SC2012OMRTM\ManagementPacks")
Dim mp As New ManagementPack(FileName, mpStore)mp.Verify()End If
NOTE: This assumes you're using the standard out of the box libaray mps
Cheat Sheet #6: You don't have to have hard code every library and other referenced managementpacks.
When dynamically adding librarys and other referenced mamagmentpacks, create an a array of mps instead.
This way, your libraries can be dynamically driven by the design of your ManagementPack.
Saturday, February 18, 2012
Rules Template -- WOW
Okay, I know nothing can replace sex.
But, really, having a template file that enables you to see around 20 of the most used Managementpack rules is pretty exciting, too.
Let's take a look at what's under the hood:
Okay, that's not very exciting as it looks without expanding one of these. So, let's take a look at the Microsoft.SystemCenter.RuleTemplates.Windows.EventAlert.
As you can see, if you have used this provider before, this template really does cover the bases.
So let's take a look at the mapping of the elements:
ID
Name
Enabled
Description
Target
Category
LocalId
ComputerName
LogName
While below is an example from the 2003 mp, it is also the best way to show you were all the attributes.
<Rule
ID="Microsoft.Windows.Server.2003.OperatingSystem.ServiceOrDriverFailedToStart.Alert" Enabled="false"
Target="Microsoft.Windows.Server.2003.OperatingSystem"
ConfirmDelivery="false"
Remotable="true"
Priority="Normal"
DiscardLevel="100"
>
<Category>EventCollection</Category>
<DataSources>
<DataSource ID="EventDS" TypeID="Windows!Microsoft.Windows.EventProvider">
<ComputerName>$Target/Host/Property[Type="Windows!Microsoft.Windows.Computer"]/NetworkName$</ComputerName>
<LogName>System</LogName>
</DataSource>
</DataSources>
Okay, so where does ConfirmDelivery, Remotable, Priority snd DiscardLevel Come from?
The rule properties:
Dim rule as ManagementPackRule
rule.ConfirmDelivery = True
rule.DiscardLevel = "100"
rule.Priority = ManagementPackWorkflowPriority.Normal
rule.Remotable = True
Also notice that the rule.Priority is not the same as the priority and severity used once the alert gets raised.
Typically, the DisplayName, Description, Alert Name, Alert Description are properties designed to create Display strings. Of course, these strings not only make the mp easier to understand they also serve to explain why the alert occurred.
Now, how can we find out, if we didn't know what the Priority and Severity values come from?
By Going through each of the IncludeSchemaTypes, we find our answer in the System.Health.Library.mp:
<xsd:simpleType name="System.Health.AlertPriority">
<xsd:restriction base="xsd:string">
<xsd:enumeration value="Low" />
<xsd:enumeration value="Normal" />
<xsd:enumeration value="High" />
</xsd:restriction>
</xsd:simpleType>
<xsd:simpleType name="System.Health.AlertSeverity">
<xsd:restriction base="xsd:string">
<xsd:enumeration value="Information" />
<xsd:enumeration value="Warning" />
<xsd:enumeration value="Error" />
<xsd:enumeration value="MatchMonitorHealth" />
</xsd:restriction>
</xsd:simpleType>
Now, let's take a look at the expression portion of the mp. Below are the values used in the expression. There's a lot of "OR" pairs which I've listed below.
PublisherName Equal Service Control Manager
EventDisplayNumber Equal 7000
EventDisplayNumber Equal 7001
EventDisplayNumber Equal 7002
EventDisplayNumber Equal 7003
EventDisplayNumber Equal 7008
EventDisplayNumber Equal 7013
EventDisplayNumber Equal 7014
EventDisplayNumber Equal 7022
EventDisplayNumber Equal 7023
EventDisplayNumber Equal 7025
EventDisplayNumber Equal 7026
EventDisplayNumber Equal 7038
To finish the rule up:
<WriteActions>
<WriteAction ID="GenerateAlert" TypeID="SystemHealth!System.Health.GenerateAlert">
<Priority>1</Priority>
<Severity>1</Severity>
<AlertMessageId>$MPElement[Name="Microsoft.Windows.Server.2003.OperatingSystem.ServiceOrDriverFailedToStart.Alert.AlertMessage"]$</AlertMessageId>
<AlertParameters>
<AlertParameter1>$Data/EventDescription$</AlertParameter1>
</AlertParameters>
<Suppression>
<SuppressionValue />
</Suppression>
</WriteAction>
</WriteActions>
All of this combined creates this:
<Rule ID="Microsoft.Windows.Server.2003.OperatingSystem.ServiceOrDriverFailedToStart.Alert" Enabled="false" Target="Microsoft.Windows.Server.2003.OperatingSystem">
<Category>EventCollection</Category>
<DataSources>
<DataSource ID="EventDS" TypeID="Windows!Microsoft.Windows.EventProvider">
<ComputerName>$Target/Host/Property[Type="Windows!Microsoft.Windows.Computer"]/NetworkName$</ComputerName>
<LogName>System</LogName>
<Expression>
<And>
<Expression>
<SimpleExpression>
<ValueExpression>
<XPathQuery>PublisherName</XPathQuery>
</ValueExpression>
<Operator>Equal</Operator>
<ValueExpression>
<Value>Service Control Manager</Value>
</ValueExpression>
</SimpleExpression>
</Expression>
<Expression>
<Or>
<Expression>
<Or>
<Expression>
<Or>
<Expression>
<Or>
<Expression>
<SimpleExpression>
<ValueExpression>
<XPathQuery>EventDisplayNumber</XPathQuery>
</ValueExpression>
<Operator>Equal</Operator>
<ValueExpression>
<Value>7000</Value>
</ValueExpression>
</SimpleExpression>
</Expression>
<Expression>
<SimpleExpression>
<ValueExpression>
<XPathQuery>EventDisplayNumber</XPathQuery>
</ValueExpression>
<Operator>Equal</Operator>
<ValueExpression>
<Value>7001</Value>
</ValueExpression>
</SimpleExpression>
</Expression>
</Or>
</Expression>
<Expression>
<Or>
<Expression>
<SimpleExpression>
<ValueExpression>
<XPathQuery>EventDisplayNumber</XPathQuery>
</ValueExpression>
<Operator>Equal</Operator>
<ValueExpression>
<Value>7002</Value>
</ValueExpression>
</SimpleExpression>
</Expression>
<Expression>
<SimpleExpression>
<ValueExpression>
<XPathQuery>EventDisplayNumber</XPathQuery>
</ValueExpression>
<Operator>Equal</Operator>
<ValueExpression>
<Value>7003</Value>
</ValueExpression>
</SimpleExpression>
</Expression>
</Or>
</Expression>
</Or>
</Expression>
<Expression>
<Or>
<Expression>
<Or>
<Expression>
<SimpleExpression>
<ValueExpression>
<XPathQuery>EventDisplayNumber</XPathQuery>
</ValueExpression>
<Operator>Equal</Operator>
<ValueExpression>
<Value>7008</Value>
</ValueExpression>
</SimpleExpression>
</Expression>
<Expression>
<SimpleExpression>
<ValueExpression>
<XPathQuery>EventDisplayNumber</XPathQuery>
</ValueExpression>
<Operator>Equal</Operator>
<ValueExpression>
<Value>7013</Value>
</ValueExpression>
</SimpleExpression>
</Expression>
</Or>
</Expression>
<Expression>
<Or>
<Expression>
<SimpleExpression>
<ValueExpression>
<XPathQuery>EventDisplayNumber</XPathQuery>
</ValueExpression>
<Operator>Equal</Operator>
<ValueExpression>
<Value>7014</Value>
</ValueExpression>
</SimpleExpression>
</Expression>
<Expression>
<SimpleExpression>
<ValueExpression>
<XPathQuery>EventDisplayNumber</XPathQuery>
</ValueExpression>
<Operator>Equal</Operator>
<ValueExpression>
<Value>7022</Value>
</ValueExpression>
</SimpleExpression>
</Expression>
</Or>
</Expression>
</Or>
</Expression>
</Or>
</Expression>
<Expression>
<Or>
<Expression>
<Or>
<Expression>
<SimpleExpression>
<ValueExpression>
<XPathQuery>EventDisplayNumber</XPathQuery>
</ValueExpression>
<Operator>Equal</Operator>
<ValueExpression>
<Value>7023</Value>
</ValueExpression>
</SimpleExpression>
</Expression>
<Expression>
<SimpleExpression>
<ValueExpression>
<XPathQuery>EventDisplayNumber</XPathQuery>
</ValueExpression>
<Operator>Equal</Operator>
<ValueExpression>
<Value>7025</Value>
</ValueExpression>
</SimpleExpression>
</Expression>
</Or>
</Expression>
<Expression>
<Or>
<Expression>
<SimpleExpression>
<ValueExpression>
<XPathQuery>EventDisplayNumber</XPathQuery>
</ValueExpression>
<Operator>Equal</Operator>
<ValueExpression>
<Value>7026</Value>
</ValueExpression>
</SimpleExpression>
</Expression>
<Expression>
<SimpleExpression>
<ValueExpression>
<XPathQuery>EventDisplayNumber</XPathQuery>
</ValueExpression>
<Operator>Equal</Operator>
<ValueExpression>
<Value>7038</Value>
</ValueExpression>
</SimpleExpression>
</Expression>
</Or>
</Expression>
</Or>
</Expression>
</Or>
</Expression>
</And>
</Expression>
</DataSource>
</DataSources>
<WriteActions>
<WriteAction ID="GenerateAlert" TypeID="SystemHealth!System.Health.GenerateAlert">
<Priority>1</Priority>
<Severity>1</Severity>
<AlertMessageId>$MPElement[Name="Microsoft.Windows.Server.2003.OperatingSystem.ServiceOrDriverFailedToStart.Alert.AlertMessage"]$</AlertMessageId>
<AlertParameters>
<AlertParameter1>$Data/EventDescription$</AlertParameter1>
</AlertParameters>
<Suppression>
<SuppressionValue />
</Suppression>
</WriteAction>
</WriteActions>
</Rule>
Additional features of the templates are shown as below:
As you can see, the library references are listed as well as the layout of the rule, StringResource, and DisplayStrings.
But, really, having a template file that enables you to see around 20 of the most used Managementpack rules is pretty exciting, too.
Let's take a look at what's under the hood:
Okay, that's not very exciting as it looks without expanding one of these. So, let's take a look at the Microsoft.SystemCenter.RuleTemplates.Windows.EventAlert.
As you can see, if you have used this provider before, this template really does cover the bases.
So let's take a look at the mapping of the elements:
ID
Name
Enabled
Description
Target
Category
LocalId
ComputerName
LogName
While below is an example from the 2003 mp, it is also the best way to show you were all the attributes.
<Rule
ID="Microsoft.Windows.Server.2003.OperatingSystem.ServiceOrDriverFailedToStart.Alert" Enabled="false"
Target="Microsoft.Windows.Server.2003.OperatingSystem"
ConfirmDelivery="false"
Remotable="true"
Priority="Normal"
DiscardLevel="100"
>
<Category>EventCollection</Category>
<DataSources>
<DataSource ID="EventDS" TypeID="Windows!Microsoft.Windows.EventProvider">
<ComputerName>$Target/Host/Property[Type="Windows!Microsoft.Windows.Computer"]/NetworkName$</ComputerName>
<LogName>System</LogName>
</DataSource>
</DataSources>
Okay, so where does ConfirmDelivery, Remotable, Priority snd DiscardLevel Come from?
The rule properties:
Dim rule as ManagementPackRule
rule.ConfirmDelivery = True
rule.DiscardLevel = "100"
rule.Priority = ManagementPackWorkflowPriority.Normal
rule.Remotable = True
Also notice that the rule.Priority is not the same as the priority and severity used once the alert gets raised.
Typically, the DisplayName, Description, Alert Name, Alert Description are properties designed to create Display strings. Of course, these strings not only make the mp easier to understand they also serve to explain why the alert occurred.
Now, how can we find out, if we didn't know what the Priority and Severity values come from?
By Going through each of the IncludeSchemaTypes, we find our answer in the System.Health.Library.mp:
<xsd:simpleType name="System.Health.AlertPriority">
<xsd:restriction base="xsd:string">
<xsd:enumeration value="Low" />
<xsd:enumeration value="Normal" />
<xsd:enumeration value="High" />
</xsd:restriction>
</xsd:simpleType>
<xsd:simpleType name="System.Health.AlertSeverity">
<xsd:restriction base="xsd:string">
<xsd:enumeration value="Information" />
<xsd:enumeration value="Warning" />
<xsd:enumeration value="Error" />
<xsd:enumeration value="MatchMonitorHealth" />
</xsd:restriction>
</xsd:simpleType>
Now, let's take a look at the expression portion of the mp. Below are the values used in the expression. There's a lot of "OR" pairs which I've listed below.
PublisherName Equal Service Control Manager
EventDisplayNumber Equal 7000
EventDisplayNumber Equal 7001
EventDisplayNumber Equal 7002
EventDisplayNumber Equal 7003
EventDisplayNumber Equal 7008
EventDisplayNumber Equal 7013
EventDisplayNumber Equal 7014
EventDisplayNumber Equal 7022
EventDisplayNumber Equal 7023
EventDisplayNumber Equal 7025
EventDisplayNumber Equal 7026
EventDisplayNumber Equal 7038
To finish the rule up:
<WriteActions>
<WriteAction ID="GenerateAlert" TypeID="SystemHealth!System.Health.GenerateAlert">
<Priority>1</Priority>
<Severity>1</Severity>
<AlertMessageId>$MPElement[Name="Microsoft.Windows.Server.2003.OperatingSystem.ServiceOrDriverFailedToStart.Alert.AlertMessage"]$</AlertMessageId>
<AlertParameters>
<AlertParameter1>$Data/EventDescription$</AlertParameter1>
</AlertParameters>
<Suppression>
<SuppressionValue />
</Suppression>
</WriteAction>
</WriteActions>
All of this combined creates this:
<Rule ID="Microsoft.Windows.Server.2003.OperatingSystem.ServiceOrDriverFailedToStart.Alert" Enabled="false" Target="Microsoft.Windows.Server.2003.OperatingSystem">
<Category>EventCollection</Category>
<DataSources>
<DataSource ID="EventDS" TypeID="Windows!Microsoft.Windows.EventProvider">
<ComputerName>$Target/Host/Property[Type="Windows!Microsoft.Windows.Computer"]/NetworkName$</ComputerName>
<LogName>System</LogName>
<Expression>
<And>
<Expression>
<SimpleExpression>
<ValueExpression>
<XPathQuery>PublisherName</XPathQuery>
</ValueExpression>
<Operator>Equal</Operator>
<ValueExpression>
<Value>Service Control Manager</Value>
</ValueExpression>
</SimpleExpression>
</Expression>
<Expression>
<Or>
<Expression>
<Or>
<Expression>
<Or>
<Expression>
<Or>
<Expression>
<SimpleExpression>
<ValueExpression>
<XPathQuery>EventDisplayNumber</XPathQuery>
</ValueExpression>
<Operator>Equal</Operator>
<ValueExpression>
<Value>7000</Value>
</ValueExpression>
</SimpleExpression>
</Expression>
<Expression>
<SimpleExpression>
<ValueExpression>
<XPathQuery>EventDisplayNumber</XPathQuery>
</ValueExpression>
<Operator>Equal</Operator>
<ValueExpression>
<Value>7001</Value>
</ValueExpression>
</SimpleExpression>
</Expression>
</Or>
</Expression>
<Expression>
<Or>
<Expression>
<SimpleExpression>
<ValueExpression>
<XPathQuery>EventDisplayNumber</XPathQuery>
</ValueExpression>
<Operator>Equal</Operator>
<ValueExpression>
<Value>7002</Value>
</ValueExpression>
</SimpleExpression>
</Expression>
<Expression>
<SimpleExpression>
<ValueExpression>
<XPathQuery>EventDisplayNumber</XPathQuery>
</ValueExpression>
<Operator>Equal</Operator>
<ValueExpression>
<Value>7003</Value>
</ValueExpression>
</SimpleExpression>
</Expression>
</Or>
</Expression>
</Or>
</Expression>
<Expression>
<Or>
<Expression>
<Or>
<Expression>
<SimpleExpression>
<ValueExpression>
<XPathQuery>EventDisplayNumber</XPathQuery>
</ValueExpression>
<Operator>Equal</Operator>
<ValueExpression>
<Value>7008</Value>
</ValueExpression>
</SimpleExpression>
</Expression>
<Expression>
<SimpleExpression>
<ValueExpression>
<XPathQuery>EventDisplayNumber</XPathQuery>
</ValueExpression>
<Operator>Equal</Operator>
<ValueExpression>
<Value>7013</Value>
</ValueExpression>
</SimpleExpression>
</Expression>
</Or>
</Expression>
<Expression>
<Or>
<Expression>
<SimpleExpression>
<ValueExpression>
<XPathQuery>EventDisplayNumber</XPathQuery>
</ValueExpression>
<Operator>Equal</Operator>
<ValueExpression>
<Value>7014</Value>
</ValueExpression>
</SimpleExpression>
</Expression>
<Expression>
<SimpleExpression>
<ValueExpression>
<XPathQuery>EventDisplayNumber</XPathQuery>
</ValueExpression>
<Operator>Equal</Operator>
<ValueExpression>
<Value>7022</Value>
</ValueExpression>
</SimpleExpression>
</Expression>
</Or>
</Expression>
</Or>
</Expression>
</Or>
</Expression>
<Expression>
<Or>
<Expression>
<Or>
<Expression>
<SimpleExpression>
<ValueExpression>
<XPathQuery>EventDisplayNumber</XPathQuery>
</ValueExpression>
<Operator>Equal</Operator>
<ValueExpression>
<Value>7023</Value>
</ValueExpression>
</SimpleExpression>
</Expression>
<Expression>
<SimpleExpression>
<ValueExpression>
<XPathQuery>EventDisplayNumber</XPathQuery>
</ValueExpression>
<Operator>Equal</Operator>
<ValueExpression>
<Value>7025</Value>
</ValueExpression>
</SimpleExpression>
</Expression>
</Or>
</Expression>
<Expression>
<Or>
<Expression>
<SimpleExpression>
<ValueExpression>
<XPathQuery>EventDisplayNumber</XPathQuery>
</ValueExpression>
<Operator>Equal</Operator>
<ValueExpression>
<Value>7026</Value>
</ValueExpression>
</SimpleExpression>
</Expression>
<Expression>
<SimpleExpression>
<ValueExpression>
<XPathQuery>EventDisplayNumber</XPathQuery>
</ValueExpression>
<Operator>Equal</Operator>
<ValueExpression>
<Value>7038</Value>
</ValueExpression>
</SimpleExpression>
</Expression>
</Or>
</Expression>
</Or>
</Expression>
</Or>
</Expression>
</And>
</Expression>
</DataSource>
</DataSources>
<WriteActions>
<WriteAction ID="GenerateAlert" TypeID="SystemHealth!System.Health.GenerateAlert">
<Priority>1</Priority>
<Severity>1</Severity>
<AlertMessageId>$MPElement[Name="Microsoft.Windows.Server.2003.OperatingSystem.ServiceOrDriverFailedToStart.Alert.AlertMessage"]$</AlertMessageId>
<AlertParameters>
<AlertParameter1>$Data/EventDescription$</AlertParameter1>
</AlertParameters>
<Suppression>
<SuppressionValue />
</Suppression>
</WriteAction>
</WriteActions>
</Rule>
Additional features of the templates are shown as below:
As you can see, the library references are listed as well as the layout of the rule, StringResource, and DisplayStrings.
Subscribe to:
Posts (Atom)
