none
Is it possible to override event collection for a singe event?

    Question

  • Is there an option to override the event collection rule for just one particular event ID? The only option I see is to disable the whole collection rule itself.
    Thursday, February 7, 2019 12:30 PM

All replies

  • Hi

    What collection rule are you talking about? Can you show us it's configuration?

    Cheers


    Sam (Please take a moment to "Vote as Helpful" and/or "Mark as Answer" wherever applicable. Thanks!) Blog:AnalyticOps Insights Twitter:Sameer Mhaisekar

    Thursday, February 7, 2019 12:32 PM
  • Hi,

    Do you write the event collection rule in Authoring pane, or this is a built-in rule we're talking about?

    Regards,

    Alex Zhu
    -----------------------------------------------
    Please remember to mark the replies as answers if they help.
    If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com.
    Friday, February 8, 2019 8:09 AM
  • This is from ADFS management pack which collects all the administrative event.
    Friday, February 8, 2019 8:39 AM
  • This is from ADFS management pack which collects all the administrative event.
    Friday, February 8, 2019 8:39 AM
  • I believe you can't. What you can possibly do is to unseal the the MP, and change the XML configuration. But I wouldn't recommend doing that.

    So I guess the only option left is to disable the complete rule and create new.

    Cheers


    Sam (Please take a moment to "Vote as Helpful" and/or "Mark as Answer" wherever applicable. Thanks!) Blog:AnalyticOps Insights Twitter:Sameer Mhaisekar

    • Proposed as answer by CyrAz Friday, February 8, 2019 2:09 PM
    Friday, February 8, 2019 2:05 PM
  • Hi,

    Agree with Sam, for the built-in rule, we need unseal the MP, find the rule, modify it and seal it again.

    If we are interested to convert the .mp to .xml, we may refer to the below article

    https://blogs.technet.microsoft.com/servicemanager/2009/05/20/hacking-management-pack-xml-like-a-pro/

    Hope the above information helps.

    Regards,

    Alex Zhu
    -----------------------------------------------
    Please remember to mark the replies as answers if they help.
    If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com.
    Monday, February 11, 2019 9:19 AM