Monitors and rules in Operations Manager each start with a data source which defines where it will get the data to evaluate or collect. The first decision to make when you are defining a rule or monitor is the data source that it will use. The most straightforward method to answer this question is to determine where the information is that you want to collect or that indicates the condition you want to detect.
For example, an application may create an event in the Windows Event Log when a particular error occurs. You could create a rule that watches for this particular event and generates an alert when it detects one. If detection of the event is not possible through an event, a log, or a performance counter, then you may need to run a script on a periodic basis to retrieve the required information.
The same set of data sources is available for both monitors and rules as shown in the table below.
Events in the Windows event log matching specified criteria.
Text log file that has a single line per entry.
Events created by Windows Management Instrumentation (WMI).
Traps sent from an SNMP device.
Events from Unix systems and other devices.
Monitor a threshold or collect a performance value from Windows.
Monitor a threshold or collect a performance value from a WMI query.
Monitor a value from a script that runs on a schedule.
Collect events or performance data from a script that runs on a schedule.