none
SCOM event monitoring using event type

    Question

  • Hello,

    I received request to monitor Event type "error". Since the same Event ID and Source are occurring for Information and Warning in application event log.

    I tried as shown below but its not working. any help or suggestions

    



    Vishu

    Tuesday, December 24, 2013 8:43 PM

Answers

All replies

  • That should work.  What class is this rule targeting?  Also, how often is this alert with this criteria occurring?  If the event is logged in rapid sequence, then the workflow that looks for this event will be disabled by the agent, and ultimately you will have to come up with a better solution, like maybe a monitor that counts the number of events in X time and alerts once for that criteria.

    Regards, Blake Email: mengotto<at>hotmail.com Blog: http://discussitnow.wordpress.com/ If my response was helpful, please mark it as so, if it answered your question, then please also mark it accordingly. Thank you.

    Tuesday, December 24, 2013 10:22 PM
    Moderator
  • Which version of SCOM are you using. Why don't you try using the inbuilt 'Event Level' condition rather than 'EventType'?

    Regards,

    Saravanan

    Wednesday, December 25, 2013 2:11 PM
  • Its SCOM 2007 R2.

    Can you provide me the steps.


    Vishu

    Wednesday, December 25, 2013 3:58 PM
  • Click on three dots (...) you see next to the parameter name, which will open up a window with a drop down list. Select 'Event Level' from it, then you can specify the condition and value in the adjacent columns.

    Browse through the console, we can learn much. :)

    Regards,

    Saravanan

    Thursday, December 26, 2013 8:00 AM
  • Hi 

    in addition refer below link for how to find xpath for event id monitor 

    http://blogs.technet.com/b/momteam/archive/2008/02/01/authoring-event-rules-in-opsmgr.aspx

    Regards


    sridhar v

    Friday, December 27, 2013 5:03 AM
  • I think that your situation is refer to event level rather than event type. As a result, modify the condition to event level equals to error.

    Roger

    Friday, December 27, 2013 8:14 AM
  • Thanks Roger,

    Will try and update you.


    Vishu

    Friday, December 27, 2013 4:01 PM