System.ExpressionFilter.EventSuppression
Applies To: System Center 2012 - Operations Manager, System Center 2012 R2 Operations Manager, System Center 2012 SP1 - Operations Manager
The System.ExpressionFilter.EventSuppression condition detection module is a filtering module that takes any input data type and outputs the same data type. There are no changes to the data item flowing through a module of this type. The module either allows the data item through or stops the data item based on the expression and the suppression settings specified in the configuration.
Usage
Use this module within a workflow to filter any type of data type. Use the suppression settings for event monitoring workflows so that the workflow will only proceed if the specified event occurs a certain number of times in a given period of time.
Type Definition
<ConditionDetectionModuleType ID="System.ExpressionFilter.EventSuppression" Accessibility="Public" Batching="true" Stateful="false" PassThrough="true">
<Configuration>
<IncludeSchemaTypes>
<SchemaType>System.ExpressionEvaluatorSchema</SchemaType>
</IncludeSchemaTypes>
<xsd:element name="Expression" type="ExpressionType" xmlns:xsd="http://www.w3.org/2001/XMLSchema" />
<xsd:element name="SuppressionSettings" xmlns:xsd="http://www.w3.org/2001/XMLSchema">
<xsd:complexType>
<xsd:sequence>
<xsd:element name="MatchCount" type="xsd:unsignedByte" />
<xsd:element name="WithinSeconds" type="xsd:unsignedInt" />
</xsd:sequence>
</xsd:complexType>
</xsd:element>
</Configuration>
<OverrideableParameters>
<OverrideableParameter ID="MatchCount" Selector="$Config/SuppressionSettings/MatchCount$" ParameterType="int" />
<OverrideableParameter ID="WithinSeconds" Selector="$Config/SuppressionSettings/WithinSeconds$" ParameterType="int" />
</OverrideableParameters>
<ModuleImplementation Isolation="Any">
<Native>
<ClassID>C6410789-C1BB-4AF1-B818-D01A5367781D</ClassID>
</Native>
</ModuleImplementation>
<OutputType>System.BaseData</OutputType>
<InputTypes>
<InputType>System.BaseData</InputType>
</InputTypes>
</ConditionDetectionModuleType>
Parameters
The System.ExpressionFilter.EventSuppression module supports the following configuration parameters:
| Parameter | Type | Overrideable | Description |
|---|---|---|---|
Expression |
False |
Required parameter. Defines an expression that evaluates to true or false. |
|
SuppressionSettings |
Complex type |
False |
Required parameter. Indicates how many matches are necessary in a set interval before the workflow continues. |
If the expression defined in the Expression parameter evaluates to true, and if the suppression settings do not take effect, the workflow will continue and the data will be passed on to the subsequent module in the workflow. If false, then the data will not be passed to the next module and the workflow will end. For more information on the ExpressionType data type, see ExpressionType.
The SuppressionSettings parameter allows some expression matches to be suppressed, depending on how many times they occur in a set interval. This parameter is a complex type that consists of two elements:
| Element | Type | Overrideable | Description |
|---|---|---|---|
MatchCount |
Integer |
True |
Required element. Indicates how many positive matches the expression filter requires before outputting a data item. A value of 1 or 0 here defaults to the original behavior of the Expression Filter which is to output on all matches. |
WithinSeconds |
Integer |
True |
Required element. Indicates the time period during which a match increments a repeat count from the current item. This means that there need to be MatchCount matches of the expression within WithinSeconds in order for the expression filter to produce a data item. |
The purpose of using System.ExpressionFilter.EventSuppression instead of System.ExpressionFilter is that the suppression settings parameters can be overridden in System.ExpressionFilter.EventSuppression. If you do not want users to override these parameters, use System.ExpressionFilter instead. If you are using a data source that runs on a fixed interval, use System.ExpressionFilter.IntervalSuppression instead.
Composition
The System.ExpressionFilter.EventSuppression module is a native module.
Related Modules
| Module Type | Usage |
|---|---|
Filtering module with suppression settings that can be omitted, set specific to a time period, or specific to the number of matches. |
|
Filtering module with suppression settings specific to number of matches. |
External Module References
None
Sample
The following example shows a simple rule that runs a script that returns a random integer value between 0 and 1,000. Any value over 500 is considered “above the threshold,” and could potentially trigger an alert. However, the suppression settings are configured such that an alert will only be triggered if the random number is over 500 five times out of ten samples. Therefore, this rule uses the <SampleCount> parameter to track the number of matches five times in 30 minutes. This number could be adjusted lower or higher depending on the sensitivity you want for the threshold.
<TypeDefinitions>
<ModuleTypes>
<DataSourceModuleType ID="MPAuthor.ExpressionFilter.ScheduledProbeDS" Accessibility="Public" Batching="false">
<Configuration>
<xsd:element minOccurs="1" name="Interval" type="xsd:integer" xmlns:xsd="http://www.w3.org/2001/XMLSchema" />
<xsd:element minOccurs="0" name="SyncTime" type="xsd:string" xmlns:xsd="http://www.w3.org/2001/XMLSchema" />
</Configuration>
<OverrideableParameters>
<OverrideableParameter ID="Interval" Selector="$Config/Interval$" ParameterType="int" />
<OverrideableParameter ID="SyncTime" Selector="$Config/SyncTime$" ParameterType="string" />
</OverrideableParameters>
<ModuleImplementation Isolation="Any">
<Composite>
<MemberModules>
<DataSource ID="Scheduler" TypeID="System!System.Scheduler">
<Scheduler>
<SimpleReccuringSchedule>
<Interval>$Config/Interval$</Interval>
<SyncTime>$Config/SyncTime$</SyncTime>
</SimpleReccuringSchedule>
<ExcludeDates />
</Scheduler>
</DataSource>
<ProbeAction ID="Script" TypeID="Windows!Microsoft.Windows.PowerShellPropertyBagProbe">
<ScriptName>NetworkSpeed.ps1</ScriptName>
<ScriptBody>
$api = new-object -comObject "MOM.ScriptAPI"
$bag = $api.CreatePropertyBag()
$randomValue = Get-Random -minimum 1 -maximum 1001
$bag.AddValue("value",$randomValue)
$bag
</ScriptBody>
<TimeoutSeconds>300</TimeoutSeconds>
</ProbeAction>
</MemberModules>
<Composition>
<Node ID="Script">
<Node ID="Scheduler" />
</Node>
</Composition>
</Composite>
</ModuleImplementation>
<OutputType>System!System.PropertyBagData</OutputType>
</DataSourceModuleType>
</ModuleTypes>
</TypeDefinitions>
<Monitoring>
<Rules>
<Rule ID="MPAuthor.ExpressionFilter.RandomNumberAlertRule" Enabled="true" Target="Windows!Microsoft.Windows.Computer" ConfirmDelivery="false" Remotable="true" Priority="Normal" DiscardLevel="100">
<Category>Alert</Category>
<DataSources>
<DataSource ID="DS" TypeID="MPAuthor.ExpressionFilter.ScheduledProbeDS">
<Interval>120</Interval>
<SyncTime />
</DataSource>
</DataSources>
<ConditionDetection ID="CD" TypeID="System!System.ExpressionFilter.EventSuppression">
<Expression>
<SimpleExpression>
<ValueExpression>
<XPathQuery Type="Integer">Property[@Name='value']</XPathQuery>
</ValueExpression>
<Operator>Greater</Operator>
<ValueExpression>
<Value Type="Integer">500</Value>
</ValueExpression>
</SimpleExpression>
</Expression>
<SuppressionSettings>
<MatchCount>5</MatchCount>
<WithinSeconds>1800</WithinSeconds>
</SuppressionSettings>
</ConditionDetection>
<WriteActions>
<WriteAction ID="Alert" TypeID="Health!System.Health.GenerateAlert">
<Priority>1</Priority>
<Severity>2</Severity>
<AlertMessageId>$MPElement[Name="MPAuthor.ExpressionFilter.RandomNumberAlertRule.AlertMessage"]$</AlertMessageId>
</WriteAction>
</WriteActions>
</Rule>
</Rules>
</Monitoring>
Information
Module Type |
|
Input Type |
|
Output Type |
|
Implementation |
Native |
Library |
System.Library |