Create a workflow based on a Windows Event.
When specifying the Expression use EventID, Event Source and Parameter 5. Parameter 5 is the number of seconds specified in the event description.
Once you have created the workflow you will need to modify the XML. By default the expression is evaluated as a string, this needs to be changed to a number so that it is evaluated numerically.
Sample:
<Expression>
<SimpleExpression>
<ValueExpression>
<XPathQuery Type="Double">Params/Param[5}</XPathQuery>
</ValueExpression>
<Operator>Greater</Operator>
<ValueExpression>
<Value Type="Double">86400</Value>
</ValueExpression>
</SimpleExpression>
</Expression>
Cheerfull3 wrote:
Event Trigger Question for Uptime report
17-Oct-08
Is there a way to setup a event based trigger to pull the information out of
the description field. This is the event that is generated everyday at noon.
And I want to read this logfile and set a alert if it exceeds a certain time
limit
For example:
Event Type: Informatio
Event Source: EventLo
Event Category: Non
Event ID: 601
Date: 10/17/200
Time: 12:00:00 P
User: N/
Computer: JDOSOMDB0
Description
The system uptime is 167676 seconds
For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp
Data
I would like to trigger an event on the below information for server uptime
over a specific amount of time say server exceeds 300000 Mins of uptime and
need to trigger a alert telling the sys admins that the server has not
rebooting within the period of time above. Is the something that can be
accomplished with SCOM 2007? If so how? Or could someone point me in right
direction on how i can do this
Thank
TJ
Previous Posts In This Thread:
On Friday, October 17, 2008 5:23 PM
Cheerfull3 wrote:
Event Trigger Question for Uptime report
Is there a way to setup a event based trigger to pull the information out of
the description field. This is the event that is generated everyday at noon.
And I want to read this logfile and set a alert if it exceeds a certain time
limit
For example:
Event Type: Informatio
Event Source: EventLo
Event Category: Non
Event ID: 601
Date: 10/17/200
Time: 12:00:00 P
User: N/
Computer: JDOSOMDB0
Description
The system uptime is 167676 seconds
For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp
Data
I would like to trigger an event on the below information for server uptime
over a specific amount of time say server exceeds 300000 Mins of uptime and
need to trigger a alert telling the sys admins that the server has not
rebooting within the period of time above. Is the something that can be
accomplished with SCOM 2007? If so how? Or could someone point me in right
direction on how i can do this
Thank
TJ
On Saturday, October 18, 2008 9:28 AM
Pete Zerger (MVP) wrote:
Hello Cheerfull38,It involves a custom script about any way you consider it.
Hello Cheerfull38
It involves a custom script about any way you consider it
You'd have to use a custom script to parse the description in that event.
Given that the event looks very much the same every time, it would not be
difficult to pull the number out and make the comparison you standard VB
string functions( right(), instr() etc).
The other alternative would be to use what would be a slightly more complicated
script using WMI and the LastBootTime property of the Win32_OperatingSystem
class. Would not recommend bringing WMI into the equation
With a custom script in a timed script rule or a 2-state monitor, you could
raise an alert if the number exceeded a certain value
Regards
Pete Zerger, MCSE(Messaging) | MCTS(SQL 2005) | MCTS(Opsmgr) | MVP - Opsmg
URL:http://www.systemcenterforum.or
User Group: http://www.systemcenterusergroup.co
MP Catalog: http://www.systemcenterforum.org/mp
Tools: http://www.systemcenterforum.org/tools/
Submitted via EggHeadCafe - Software Developer Portal of Choice
Overriding Deserialization of Persisted Workflow Instances
http://www.eggheadcafe.com/tutorials/aspnet/40fe2b27-ef79-45d0-82e1-6eca3ed67df8/overriding-deserialization-of-persisted-workflow-instances.aspx