question

HS-2676 avatar image
0 Votes"
HS-2676 asked HS-2676 edited

SCOM Rule Query for EventData

Hello!

I want to create a EventLog Monitor for the TaskScheduler.
EventLog: Microsoft-Windows-TaskScheduler/Operational

But I only want the Logs for EventID 201 where ResultCode is not 0

 <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
  <Provider Name="Microsoft-Windows-TaskScheduler" Guid="{xxx}" /> 
  <EventID>201</EventID> 
  <Version>2</Version> 
  <Level>4</Level> 
  <Task>201</Task> 
  <Opcode>2</Opcode> 
  <Keywords>0x8000000000000000</Keywords> 
  <TimeCreated SystemTime="2021-03-19T10:42:27.549098200Z" /> 
  <EventRecordID>72562</EventRecordID> 
  <Correlation ActivityID="{xxx}" /> 
  <Execution ProcessID="1200" ThreadID="360" /> 
  <Channel>Microsoft-Windows-TaskScheduler/Operational</Channel> 
  <Computer>xxx</Computer> 
  <Security UserID="xxx" /> 
    </System>
  <EventData Name="ActionSuccess">
  <Data Name="TaskName">\Test</Data> 
  <Data Name="TaskInstanceId">{xxx}</Data> 
  <Data Name="ActionName">C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe</Data> 
  <Data Name="ResultCode">2147942401</Data> 
  <Data Name="EnginePID">11100</Data> 
  </EventData>
 </Event>

I have tried with
EventID Equals 201 AND EventData/DataItem/[name()='EventData']/[name=()='Data' and @Name='ResultCode'] DoesNotMatch 0

But I got this Error:
The Microsoft Operations Manager Expression Filter Module failed to query the delivered item, item was dropped.
Property Expression: EventData/DataItem/
[name()='EventData' and @Name='ActionSuccess']/[name=()='Data' and @Name='ResultCode']
Error: 0x80004005

Is it possible to create a query where I can get the <Data Name="ResultCode">2147942401</Data> without using Params/Param[<<INT>>]?

rg
Hansi



msc-operations-manager-authoring
5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

0 Answers