This document is part of the Operations Manager Management Pack Authoring Guide.  The Microsoft System Center team has validated this procedure as of the original version.  We will continue to review any changes and periodically provide validations on later revisions as they are made.  Please feel free to make any corrections or additions to this procedure that you think would assist other users.



Management pack variables access information that is not known until either the management pack is installed or the particular workflow is running on an agent. Different variables are used in different situations, and knowledge of the different variables, their syntax, and when they are used is very important in creating different monitoring scenarios.

Using Variables

Variables in a management pack are delimited by using a dollar sign ($). When the variable is resolved, it is replaced with its calculated value. In some cases, the Authoring console provides menus that let you select a particular variable and have the appropriate syntax automatically created. In other cases though, you must create the variable yourself by using the appropriate syntax.

Kinds of Variables

The following table lists the kinds of variables that are used in a management pack. Additional details about each kind of variable are provided in other sections of this guide where the particular variable is used.

Variable Syntax Used In Description

MPElement

$MPElement[Name="ElementName"]/SubElementName$

Discoveries

Resolves to the GUID of the specified management pack element.

Target

$Target/Property[Type="ElementName"]/PropertyName$

 

$Target/Host/Property[Type="ElementName"]/PropertyName$

Discoveries
Monitors
Rules
Tasks
Diagnostics
Recoveries
Alert
Descriptions

Retrieves the value of a property of the target object or one of the target object’s hosts.

Data

$Data/<XPath to Property>$

Monitors
Rules
Tasks
Diagnostics
Recoveries
Alert
Descriptions

Retrieves a value from the data stream.

Config

$Config/Parameter$

Modules
Monitor
Types

Retrieves a value from a parameter on the module or monitor type.

RunAs

$RunAs[Name="SecureReferenceId"]PropertyName

Modules
Monitor Types

Retrieves the value of a property from a RunAs account.

FileResource  $FileResource[Name="ResourceId"]Path]$ Discoveries
Modules
Retrieves the path for a resource in a management pack bundle.

Alert Description Variables

The following variables can be used when adding information to alert descriptions:

For Event Rules

   
EventDisplayNumber (Event ID)  $Data/EventDisplayNumber$ 
EventDescription (Description): $Data/EventDescription$
Publisher Name (Event Source):   $Data/PublisherName$ 
EventCategory: $Data/EventCategory$ 
LoggingComputer: $Data/LoggingComputer$
EventLevel: $Data/EventLevel$
Channel: $Data/Channel$
UserName: $Data/UserName$
EventNumber: $Data/EventNumber$
Event Time: $Data/@time$

For Event Monitors

   
EventDisplayNumber (Event ID)  $Data/Context/EventDisplayNumber$ 
EventDescription (Description): $Data/Context/EventDescription$
Publisher Name (Event Source):   $Data/Context/PublisherName$ 
EventCategory: $Data/Context/EventCategory$ 
LoggingComputer: $Data/Context/LoggingComputer$
EventLevel: $Data/Context/EventLevel$
Channel: $Data/Context/Channel$
UserName: $Data/Context/UserName$
EventNumber: $Data/Context/EventNumber$
Event Time: $Data/Context/@time$

For Repeating Event Monitors

   
EventDisplayNumber (Event ID)  $Data/Context/Context/DataItem/EventDisplayNumber$ 
EventDescription (Description): $Data/Context/Context/DataItem/EventDescription$
Publisher Name (Event Source):   $Data/Context/Context/DataItem/PublisherName$ 
EventCategory: $Data/Context/Context/DataItem/EventCategory$ 
LoggingComputer: $Data/Context/Context/DataItem/LoggingComputer$
EventLevel: $Data/Context/Context/DataItem/EventLevel$
Channel: $Data/Context/Context/DataItem/Channel$
UserName: $Data/Context/Context/DataItem/UserName$
EventNumber: $Data/Context/Context/DataItem/EventNumber$

For Performance Threshold Monitors

   
Object (Perf Object Name): $Data/Context/ObjectName$
Counter (Perf Counter Name): $Data/Context/CounterName$
Instance (Perf Instance Name): $Data/Context/InstanceName$
*Value (Perf Counter Value): $Data/Context/Value$
**Last Sampled Value $Data/Context/SampleValue$

*Value will show the actual performance value for simple and avg monitors. It will show number of samples for consecutive threshold monitors.
**Last Sampled Value works to show the last value evaluated in a consecutive sample value monitor.


For Service Monitors

   
Service Name $Data/Context/Property[@Name='Name']$
Service Dependencies $Data/Context/Property[@Name='Dependencies']$
Service Binary Path $Data/Context/Property[@Name='BinaryPathName']$
Service Display Name $Data/Context/Property[@Name='DisplayName']$
Service Description $Data/Context/Property[@Name='Description']$

For SNMP Rules

   
SNMP Address of Target Network Node $Target/Property[Type="Network!System.NetworkManagement.Node"]/SNMPAddress$
SNMP Node Display Name $Target/Property[Type="System!System.Entity"]/DisplayName$
SNMP Node Description $Target/Property[Type="Network!System.NetworkManagement.Node"]/Description$
SNMP Node Location $Target/Property[Type="Network!System.NetworkManagement.Node"]/Location$
SNMP Node Port Number $Target/Property[Type="Network!System.NetworkManagement.Node"]/PortNumber$
SNMP Version $Target/Property[Type="Network!System.NetworkManagement.Node"]/SNMPVersion$
OID of Trap $Data/EventData/DataItem/SnmpVarBinds/SnmpVarBind[OID=".1.3.6.1.6.3.1.1.4.1.0"]/Value$
Data Value included in trap $Data/EventData/DataItem/SnmpVarBinds/SnmpVarBind[OID="<PutYourOIDHere, Reference MIB>"]/Value$
Data Value from SNMP GET Monitor $Data/Context/Value$
       
In the above examples, it is assumed that the alias for the "System.NetworkManagement.Library" management pack is "Network"

For Logfile Monitors

   
Logfile Directory  $Data/Context/LogFileDirectory$
Logfile name: $Data/Context/LogFileName$
String (text from row of log file): $Data/Context/Params/Param[1]$

For Logfile Rules

   
Logfile Directory  $Data/EventData/DataItem/LogFileDirectory$
Logfile name: $Data/EventData/DataItem/LogFileName$
String (text from row of log file): $Data/EventData/DataItem/Params/Param[1]$

General

   
To show the name of the Windows Computer host: $Target/Host/Property[Type="Windows!Microsoft.Windows.Computer"]/NetworkName$

For Notifications

   
AlertID GUID $Data/Context/DataItem/AlertId$ 
Alert Name $Data/Context/DataItem/AlertName$ 
Alert category $Data/Context/DataItem/Category$
Created by Monitor (True/False) $Data/Context/DataItem/CreatedByMonitor$
CustomField1 $Data/Context/DataItem/Custom1$
CustomField2 $Data/Context/DataItem/Custom2$
CustomField3 $Data/Context/DataItem/Custom3$ 
CustomField4 $Data/Context/DataItem/Custom4$
CustomField5 $Data/Context/DataItem/Custom5$
CustomField6 $Data/Context/DataItem/Custom6$
CustomField7 $Data/Context/DataItem/Custom7$
CustomField8  $Data/Context/DataItem/Custom8$
CustomField9 $Data/Context/DataItem/Custom9$
CustomField10 $Data/Context/DataItem/Custom10$
UTC Date/Time of Dataitem created $Data/Context/DataItem/DataItemCreateTime$
Local Date/Time of Dataitem created $Data/Context/DataItem/DataItemCreateTimeLocal$
UTC Date/Time DataItem was modified $Data/Context/DataItem/LastModified$
Local Date/Time DataItem was modified $Data/Context/DataItem/LastModifiedLocal$
ManagedEntity GUID $Data/Context/DataItem/ManagedEntity$
ManagedEntity Display name $Data/Context/DataItem/ManagedEntityDisplayName$
ManagedEntity Full name $Data/Context/DataItem/ManagedEntityFullName$
Managed Entity Path $Data/Context/DataItem/ManagedEntityPath$
The Alert Priority Number (High=1,Medium=2,Low=3) $Data/Context/DataItem/Priority$ 
The Alert Owner $Data/Context/DataItem/Owner$
The Alert Repeat Count $Data/Context/DataItem/RepeatCount$
Resolution state ID (0=New, 255=Closed) $Data/Context/DataItem/ResolutionState$
UTC Date/Time ResolutionState was last modified $Data/Context/DataItem/ResolutionStateLastModified$
Local Date/Time ResolutionState was last modified $Data/Context/DataItem/ResolutionStateLastModifiedLocal$
The Resolution State Name (New, Closed) $Data/Context/DataItem/ResolutionStateName$
Person resolving the alert $Data/Context/DataItem/ResolvedBy$
Alert Severity ID $Data/Context/DataItem/Severity$
TicketID  $Data/Context/DataItem/TicketId$
UTC Time Added $Data/Context/DataItem/TimeAdded$
Local Time Added $Data/Context/DataItem/TimeAddedLocal$
UTC Time Raised $Data/Context/DataItem/TimeRaised$
Local Time Raised $Data/Context/DataItem/TimeRaisedLocal$
UTC Date/Time the Alert was resolved $Data/Context/DataItem/TimeResolved$
The Workflow ID (GUID) $Data/Context/DataItem/WorkflowId$
Name of the recipient $Data/Recipients/To/Address/Address$
Web Console URL $Target/Property[Type="Notification!Microsoft.SystemCenter.AlertNotificationSubscriptionServer"/WebConsoleUrl$
PrincipalName of the management server $Target/Property[Type="Notification!Microsoft.SystemCenter.AlertNotificationSubscriptionServer"/PrincipalName$