HS-2676 avatar image
0 Votes"
HS-2676 asked HS-2676 edited

SCOM Rule Query for EventData


I want to create a EventLog Monitor for the TaskScheduler.
EventLog: Microsoft-Windows-TaskScheduler/Operational

But I only want the Logs for EventID 201 where ResultCode is not 0

 <Event xmlns="">
  <Provider Name="Microsoft-Windows-TaskScheduler" Guid="{xxx}" /> 
  <TimeCreated SystemTime="2021-03-19T10:42:27.549098200Z" /> 
  <Correlation ActivityID="{xxx}" /> 
  <Execution ProcessID="1200" ThreadID="360" /> 
  <Security UserID="xxx" /> 
  <EventData Name="ActionSuccess">
  <Data Name="TaskName">\Test</Data> 
  <Data Name="TaskInstanceId">{xxx}</Data> 
  <Data Name="ActionName">C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe</Data> 
  <Data Name="ResultCode">2147942401</Data> 
  <Data Name="EnginePID">11100</Data> 

I have tried with
EventID Equals 201 AND EventData/DataItem/[name()='EventData']/[name=()='Data' and @Name='ResultCode'] DoesNotMatch 0

But I got this Error:
The Microsoft Operations Manager Expression Filter Module failed to query the delivered item, item was dropped.
Property Expression: EventData/DataItem/
[name()='EventData' and @Name='ActionSuccess']/[name=()='Data' and @Name='ResultCode']
Error: 0x80004005

Is it possible to create a query where I can get the <Data Name="ResultCode">2147942401</Data> without using Params/Param[<<INT>>]?


5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

0 Answers