Share via

SDKEventView

  • Article

SDKEventView displays the properties of events captured by MOM.

Note that the SDKEventView included in the MOM Operations database does not return events that appear to be invalid, such as events associated with unrecognized or deleted computers. The SDKEventView included in the Reporting Database does not filter events in the same way, and it could return some events that were not returned by the corresponding view in the Operations Database.

The following table describes the columns of the view.

Column SQL Server type Null values allowed? Description

EventGUID

uniqueidentifier

No

A GUID identifying the event.

ComputerDomain

nvarchar(100)

Yes

The domain name of the computer where the event occurred.

ComputerName

nvarchar(255)

No

The name of the computer where the event occurred.

Category

nvarchar(50)

Yes

The category of the event.

CategoryString

nvarchar(3500)

Yes

The category string of the event.

Data

image

Yes

The event data.

DomainWhereLogged

nvarchar(100)

Yes

The name of the domain where the event was initially collected.

Type

tinyint

No

The event type. Possible types include the following:

  • 0 — Success
  • 1 — Error
  • 2 — Warning
  • 4 — Information
  • 8 — Audit Success
  • 16 — Audit Failure

GeneratedAlert

bit

No

Indicates whether the event generated an alert. Values include the following:

  • 0 — False (not generated)

  • 1 — True (generated)

Message

nvarchar(3500)

Yes

The message describing the details of the event.

NTEventID

int

Yes

The Windows event log ID corresponding to the MOM event.

ProviderName

nvarchar(255)

No

The event provider name, such as System. See also the ProviderType column.

ProviderType

nvarchar(255)

No

The source of the event information, such as one of the Windows event logs.

ServerWhereLogged

nvarchar(255)

No

The server running MOM that was responsible for logging the event.

Source

nvarchar(255)

Yes

The name of the Windows service that was the source of the event.

TimeGenerated

datetime

No

The time the source event, for example, an NT event log entry, was generated. Time is always measured using the clock settings on the server running MOM.

TimeStored

datetime

No

The time the event was added to the MOM database.

UserName

nvarchar(255)

Yes

The user account for the process that generated the event.

TimeStarted

datetime

Yes

For consolidated events, the date and time the event consolidation started.

TimeOfFirstEvent

datetime

Yes

For consolidated events, the time the first event was generated.

TimeOfLastEvent

datetime

Yes

For consolidated events, the time the last event was generated.

RepeatCount

int

Yes

For multiple events, the number of duplicates that occurred.

IsConsolidated

bit

No

Indicates whether multiple events of the same kind are being reported as a single event. Values include the following:

  • 0 — False (not consolidated)

  • 1 — True (consolidated)

Examples

The following example shows how to query SDKEventView for the GUIDs of all events that were created by the MOM service and resulted in an alert.

SELECT SDKEventView.EventGUID
FROM SDKEventView
WHERE SDKEventView.Source = 'Microsoft Operations Manager'
    AND SDKEventView.GeneratedAlert = 1

Requirements

Platforms: Requires Windows 2000 Server or later

Version: Requires MOM 2000 SP1 or later

Database: OnePoint (MOM 2000 SP1 or later) or SystemCenterReporting (MOM 2004 or later)

See Also

MOM SQL Views