locked
SQL query to extract Event description from OperationsManager DB (not DW) RRS feed

  • Question

  • Hello,

    I have a rule that is collecting events and posting only to OperationsManager DB and not DW.

    I know there are several SQL queries over there but from my search I could't find one that is giving the Event Description same as event viewer .

    The one that I found are giving back the Event Parameters form [OperationsManager].[dbo].[EventView] or [OperationsManager].[dbo].[[EventAllView]]

    Friday, August 7, 2020 2:32 PM

All replies

  • Hi,

    To check the alert description via SQL query, we can use the following command:

    SELECT  AlertStringName AS 'AlertName',
     AlertStringDescription AS 'Description',
     Name,
     MonitoringRuleId
    FROM Alertview 



    Here is an article for SCOM SQL queries, you can read it as reference:
    https://kevinholman.com/2016/11/11/scom-sql-queries/

    Note: Non-Microsoft link, just for the reference.

    Tips: This SCOM Forum will be migrating to a new home on Microsoft Q&A, please refer to this sticky post for more details.


    Hope it can help.

    Best regards.
    Crystal

       

    "SCOM" forum will be migrating to a new home on   Microsoft Q&A!
      We invite you to post new questions in the "SCOM" forum's new home on   Microsoft Q&A!
      For more information, please refer to the sticky post.


    Monday, August 10, 2020 2:10 AM
  • Hi,

    How's everything going? Was the previous command we provided helpful? if there's anything else we can help, feel free to let us know.

    Best regards.

    Crystal


    "SCOM" forum will be migrating to a new home on   Microsoft Q&A!
      We invite you to post new questions in the "SCOM" forum's new home on   Microsoft Q&A!
      For more information, please refer to the sticky post.

    Thursday, August 13, 2020 9:32 AM
  • Hey Crystal,

    Thanks for replay, my initial query was regarding Events (not alerts).

    I set the DB in trace mode and saw what the SCOM console is using to display the events.

    I did find the view EventView has a field EventNumberStringId that I can Join with LocalizedText and extract LTValue field.

    But I still have to parse that and replace the parameters.

    I was looking for a pure SQL query.

    Saturday, August 22, 2020 2:38 AM
  • Hi,

    Based on my test on the lab, I find we can using the following command to combine the two tables:

    select 
    number,
    loggingcomputer,
    EventData,
    EventParameters
    from EventView
    left outer join LocalizedText
    on LocalizedText.LTStringid = EventView.EventNumberStringId

    In the Eventparameters, some events have description but others not. Not sure if it is the one you want. You can refer to it:

    Best regards.

    Crystal


    "SCOM" forum will be migrating to a new home on   Microsoft Q&A!
      We invite you to post new questions in the "SCOM" forum's new home on   Microsoft Q&A!
      For more information, please refer to the sticky post.


    Monday, August 24, 2020 6:09 AM