This document is part of the Operations Manager Management Pack Authoring Guide . 

Overview

The following procedure shows how to create an event monitor using  the Operations Manager 2007 Authoring console and Visual Studio Authoring Extensions that is targeted at a class that has multiple instances on the agent. Because multiple instances are expected, additional criteria is required that includes a property of the target object. This ensures that each copy of the monitor applies to only a single instance of the target class. 

Product Versions

This exercise applies to the following products:

• System Center Operations Manager 2007 R2
• System Center 2012 Operations Manager
• System Center 2012 Operations Manager SP1

Prerequisites

Before you perform this procedure, you must first complete the following prerequisite procedures:

• Creating a New Management Pack - Create the management pack.
• Creating a Class - Create the class that is the target for the monitor.

Revisions

The Microsoft System Center team has validated this procedure as of Revision #2.  We will continue to review any changes and periodically provide validations on later revisions as they are made.  Please feel free to make any corrections or additions to this procedure that you think would assist other users

Sample Code

A sample of the completed code for each exercise is available in the TechNet Gallery.  There is a separate sample for each exercise that includes the management pack completed at the end of that exercise and each preceding exercise.  This strategy allows you to work through each exercise in order and then compare your results.  For VSAE, this also includes the Visual Studio solution. 

Details

The event monitor created in this procedure has the following characteristics:

• Runs on any computer that has an instance of MyApplicationComponent.
• Sets the monitor to a critical state when an event in the Application event log with an event source of MyApplication and an event number of 201 is detected.
• Sets the monitor to a healthy state when an event in the Application event log with an event source of MyApplication and an event number of 202 is detected.
•  The name of the component is included in parameter 1 of the event.

Authoring Console Procedure

1. In the Authoring Console, select Health Model, and then select Monitors.
2. In the Monitors pane, expand My Application Component, and then expand System.Health.EntityState.
3. Right-click System.Health.AvailabilityState, select New, select Windows Events, select Simple, and then select Event Reset.
4. On the General page, do the following:
   1. In the ElementID box, type MyMP.Monitor.MyApplicationComponentEventError.
   2. In the Display Name box, type MyApplication Component Event Error.
   3. In the Target box, select MyMP.MyApplicationComponent.
   4. In the Parent Monitor box, select System.Health.AvailabilityState.
   5. In the Category box, select AvailabilityHealth. Click Next.
5. On the Event Log (Unhealthy Event) page, do the following:
   1. In the Log Name box, keep the default value of Application.
   2. Click Next.
6. On the Event Expression (Unhealthy Event) page, do the following:
   1. For the Event ID value, type 201.
   2. For the Event Source value, type MyApplication.
   3. Click Insert.
   4. Click the button to the right side of the Parameter Name box on the new entry.
   5. Select Specify event specific parameter to use.
   6. Specify 1 for the event parameter.
   7. Click OK.
   8. In the Operator box, select equals.
   9. Click the button to the right side of the Value box and select ComponentName,
   10. Click Next.
7. On the Event Log (Healthy Event) page, do the following:
   1. In the Log Name box, keep the default value of Application.
   2. Click Next.
8. On the Event Expression (Healthy Event) page, do the following:
   1. For the Event ID value, type 202.
   2. For the Event Source value, type MyApplication.
   3. Click Insert.
   4. Click the button to the right side of the Parameter Name box on the new entry.
   5. Select Specify event specific parameter to use.
   6. Specify 1 for the event parameter.
   7. Click OK.
   8. In the Operator box, select equals.
   9. Click the button to the right side of the Value box and select ComponentName.
   10. Click Next.
9. Expand System.Health.AvailabilityState.
10. Right-click MyMP.Monitor.MyApplicationEventError and select Properties.
11. On the Health tab, for FirstEventRaised, change the Health State to Critical.
12. On the Alerting tab, check Generate alerts for this monitor.
13. Click OK.

Visual Studio Authoring Extensions Procedure

1. Create the Monitor:
   
   1. In Solution Explorer, right click Monitors.mptg and then select Open.
   2. Right click in the  template window and select Add Template.
   3. Change the name of the template to Monitors.mptg and click Add.
   4. Select Monitor (Unit) and click OK.
2. Configure the Monitor Properties:
   
   1. Right click the entry for NewUnitMonitor and select Properties Window.
   2. Change the ID to Monitor.MyApplicationComponentEventError.
   3. Change the Display Name to My Application Component Event Error.
3. Select the Monitor Target:
   
   1. Select Target and click the ellipse (...) button on the right of the field. 
   2. Select MyMP.MyApplicationComponent and click OK.
4. Select the Monitor Type:
   
   1. Select Monitor Type ID and click the ellipse (...) button on the right of the field. 
   2. Select Microsoft.Windows.2SingleEventLog2StateMonitorType and click OK.
   3. Select Parent Monitor ID and click the ellipse (...) button on the right of the field.
   4. Select System.Health.AvailabilityState and click OK.
5. Configure the Monitor:
   
   1. Select Monitor Configuration and click the ellipse (...) button on the right of the field. 
   2. Copy the following XML into the configuration window between the <Configuration> tags.  Note that you can use Intellisense to manually type in each entry.
      
      
      <!-- Computer name for the first event.  We will use a variable to get the target computer name. -->

      <FirstComputerName>$Target/Host/Host/Property[Type="Windows!Microsoft.Windows.Computer"]/NetworkName$</FirstComputerName>

      <!-- Name of the log containing the first event. -->

      <FirstLogName>Application</FirstLogName>

       

      <!-- Expression for the first event -->

      <FirstExpression>

        <And>

          <!-- Expression for the first event number -->

          <Expression>

            <SimpleExpression>

              <ValueExpression>

                <XPathQuery Type="UnsignedInteger">EventDisplayNumber</XPathQuery>

              </ValueExpression>

              <Operator>Equal</Operator>

              <ValueExpression>

                <Value Type="UnsignedInteger">201</Value>

              </ValueExpression>

            </SimpleExpression>

          </Expression>

          <!-- Expression for the first event source -->

          <Expression>

            <SimpleExpression>

              <ValueExpression>

                <XPathQuery Type="String">PublisherName</XPathQuery>

              </ValueExpression>

              <Operator>Equal</Operator>

              <ValueExpression>

                <Value Type="String">MyApplication</Value>

              </ValueExpression>

            </SimpleExpression>

          </Expression>

          <!-- Expression for the first event parameter -->

          <Expression>

            <SimpleExpression>

              <ValueExpression>

                <XPathQuery Type="String">Params/Param[1]</XPathQuery>

              </ValueExpression>

              <Operator>Equal</Operator>

              <ValueExpression>

                <Value Type="String">ComponentName</Value>

              </ValueExpression>

            </SimpleExpression>

          </Expression>

        </And>
</FirstExpression>

<!-- Computer name for the second event.  We will use a variable to get the target computer name. -->
      <SecondComputerName>$Target/Host/Host/Property[Type="Windows!Microsoft.Windows.Computer"]/NetworkName$</SecondComputerName>

      <!-- Name of the log containing the first event. -->

      <SecondLogName>Application</SecondLogName>

       

      <!-- Expression for the second event -->         

      <SecondExpression>

        <And>

          <!-- Expression for the second event number -->

          <Expression>

            <SimpleExpression>

              <ValueExpression>

                <XPathQuery Type="UnsignedInteger">EventDisplayNumber</XPathQuery>

              </ValueExpression>

              <Operator>Equal</Operator>

              <ValueExpression>

                <Value Type="UnsignedInteger">202</Value>

              </ValueExpression>

            </SimpleExpression>

          </Expression>

          <!-- Expression for the second event source -->

          <Expression>

            <SimpleExpression>

              <ValueExpression>

                <XPathQuery Type="String">PublisherName</XPathQuery>

              </ValueExpression>

              <Operator>Equal</Operator>

              <ValueExpression>

                <Value Type="String">MyApplication</Value>

              </ValueExpression>

            </SimpleExpression>

          </Expression>

          <!-- Expression for the second event parameter -->

          <Expression>

            <SimpleExpression>

              <ValueExpression>

                <XPathQuery Type="String">Params/Param[1]</XPathQuery>

              </ValueExpression>

              <Operator>Equal</Operator>

              <ValueExpression>

                <Value Type="String">ComponentName</Value>

              </ValueExpression>

            </SimpleExpression>

          </Expression>

        </And>

      </SecondExpression>


   3. Select Monitor Operational States and click the ellipse (...) button on the right of the field.
   4. Next to FirstEventRaised, select Critical.
   5. Next to SecondEventRaised, select Healthy.
   6. Click OK,
6. Save and Compile the Project:
   1. Select File, and then click Save Monitors.mptg.
   2. Select Build and then Build Solution.
   3. Ensure that you don't receive any errors.

See Also

• Unit Monitors
• Events