SCOM event monitoring using event type


  • Hello,

    I received request to monitor Event type "error". Since the same Event ID and Source are occurring for Information and Warning in application event log.

    I tried as shown below but its not working. any help or suggestions



    Tuesday, December 24, 2013 8:43 PM


All replies

  • That should work.  What class is this rule targeting?  Also, how often is this alert with this criteria occurring?  If the event is logged in rapid sequence, then the workflow that looks for this event will be disabled by the agent, and ultimately you will have to come up with a better solution, like maybe a monitor that counts the number of events in X time and alerts once for that criteria.

    Regards, Blake Email: mengotto<at> Blog: If my response was helpful, please mark it as so, if it answered your question, then please also mark it accordingly. Thank you.

    Tuesday, December 24, 2013 10:22 PM
  • Which version of SCOM are you using. Why don't you try using the inbuilt 'Event Level' condition rather than 'EventType'?



    Wednesday, December 25, 2013 2:11 PM
  • Its SCOM 2007 R2.

    Can you provide me the steps.


    Wednesday, December 25, 2013 3:58 PM
  • Click on three dots (...) you see next to the parameter name, which will open up a window with a drop down list. Select 'Event Level' from it, then you can specify the condition and value in the adjacent columns.

    Browse through the console, we can learn much. :)



    Thursday, December 26, 2013 8:00 AM
  • Hi 

    in addition refer below link for how to find xpath for event id monitor


    sridhar v

    Friday, December 27, 2013 5:03 AM
  • I think that your situation is refer to event level rather than event type. As a result, modify the condition to event level equals to error.


    Friday, December 27, 2013 8:14 AM
  • Thanks Roger,

    Will try and update you.


    Friday, December 27, 2013 4:01 PM