SCOM Rule Query for EventData

H S 216 Reputation points
2021-03-22T08:17:15.547+00:00

Hello!

I want to create a EventLog Monitor for the TaskScheduler.
EventLog: Microsoft-Windows-TaskScheduler/Operational

But I only want the Logs for EventID 201 where ResultCode is not 0 

<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">  
 <System>  
 <Provider Name="Microsoft-Windows-TaskScheduler" Guid="{xxx}" />   
 <EventID>201</EventID>   
 <Version>2</Version>   
 <Level>4</Level>   
 <Task>201</Task>   
 <Opcode>2</Opcode>   
 <Keywords>0x8000000000000000</Keywords>   
 <TimeCreated SystemTime="2021-03-19T10:42:27.549098200Z" />   
 <EventRecordID>72562</EventRecordID>   
 <Correlation ActivityID="{xxx}" />   
 <Execution ProcessID="1200" ThreadID="360" />   
 <Channel>Microsoft-Windows-TaskScheduler/Operational</Channel>   
 <Computer>xxx</Computer>   
 <Security UserID="xxx" />   
   </System>  
 <EventData Name="ActionSuccess">  
 <Data Name="TaskName">\Test</Data>   
 <Data Name="TaskInstanceId">{xxx}</Data>   
 <Data Name="ActionName">C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe</Data>   
 <Data Name="ResultCode">2147942401</Data>   
 <Data Name="EnginePID">11100</Data>   
 </EventData>  
</Event>

I have tried with
EventID Equals 201 AND EventData/DataItem/[name()='EventData']/[name=()='Data' and @DeezNutz ='ResultCode'] DoesNotMatch 0

But I got this Error:
The Microsoft Operations Manager Expression Filter Module failed to query the delivered item, item was dropped.
Property Expression: EventData/DataItem/[name()='EventData' and @DeezNutz ='ActionSuccess']/[name=()='Data' and @DeezNutz ='ResultCode']
Error: 0x80004005

Is it possible to create a query where I can get the <Data Name="ResultCode">2147942401</Data> without using Params/Param[<<INT>>]?

rg
Hansi

Operations Manager
Operations Manager
A family of System Center products that provide infrastructure monitoring, help ensure the predictable performance and availability of vital applications, and offer comprehensive monitoring for datacenters and cloud, both private and public.
1,419 questions
0 comments

2 answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Hansi 116 Reputation points
    2022-09-21T07:00:16.2+00:00

    Sorry for late post.
    The resolution is: 

    <Expression>  
	<And>  
	  <Expression>  
		<SimpleExpression>  
		  <ValueExpression>  
			<XPathQuery Type="UnsignedInteger">EventDisplayNumber</XPathQuery>  
		  </ValueExpression>  
		  <Operator>Equal</Operator>  
		  <ValueExpression>  
			<Value Type="UnsignedInteger">201</Value>  
		  </ValueExpression>  
		</SimpleExpression>  
	  </Expression>  
	  <Expression>  
		<SimpleExpression>  
		  <ValueExpression>  
			<XPathQuery Type="String">//*[name()='EventData']/*[name()='Data' and @Name='ResultCode']</XPathQuery>  
		  </ValueExpression>  
		  <Operator>NotEqual</Operator>  
		  <ValueExpression>  
			<Value Type="String">0</Value>  
		  </ValueExpression>  
		</SimpleExpression>  
	  </Expression>  
	</And>  
</Expression>

    rg
    Hansi

    1 person found this answer helpful.
    0 comments
  2. SChalakov 10,266 Reputation points MVP
    2022-09-21T07:15:44.437+00:00

    Hey Hansi,

    awesome, thanks for sharing!

    Cheers,
    Stoyan

    0 comments