Get-SCOMEvent

Get-SCOMEvent

Gets Operations Manager events.

Syntax

Parameter Set: Empty
Get-SCOMEvent [-ComputerName <String[]> ] [-Credential <PSCredential> ] [-SCSession <Connection[]> ] [ <CommonParameters>]

Parameter Set: FromEventId
Get-SCOMEvent [-Id] <Guid[]> [-ComputerName <String[]> ] [-Credential <PSCredential> ] [-SCSession <Connection[]> ] [ <CommonParameters>]

Parameter Set: FromInstance
Get-SCOMEvent [-Instance] <EnterpriseManagementObject[]> [[-EventId] <Int32[]> ] [[-EventLogName] <String[]> ] [[-EventSource] <String[]> ] [-ComputerName <String[]> ] [-Credential <PSCredential> ] [-SCSession <Connection[]> ] [ <CommonParameters>]

Parameter Set: FromManagementPackRule
Get-SCOMEvent [-Rule] <ManagementPackRule[]> [[-EventId] <Int32[]> ] [[-EventLogName] <String[]> ] [[-EventSource] <String[]> ] [-ComputerName <String[]> ] [-Credential <PSCredential> ] [-SCSession <Connection[]> ] [ <CommonParameters>]

Detailed Description

The Get-SCOMEvent cmdlet gets System Center 2012 – Operations Manager events. Rules collect events.

You can specify events by ID or by the managed object. You can also specify the rule that the event triggers.

By default, this cmdlet uses the active persistent connection to a management group. Use the SCSession parameter to specify a different persistent connection. You can create a temporary connection to a management group by using the ComputerName and Credential parameters. For more information, type Get-Help about_OpsMgr_Connections.

Parameters

-ComputerName<String[]>

Specifies an array of names of computers. The cmdlet establishes temporary connections with management groups for these computers. You can use NetBIOS names, IP addresses, or fully qualified domain names (FQDNs). To specify the local computer, type the computer name, localhost, or a dot (.).

The System Center Data Access service must be running on the computer. If you do not specify a computer, the cmdlet uses the computer for the current management group connection.

Aliases

none

Required?

false

Position?

named

Default Value

none

Accept Pipeline Input?

true (ByValue)

Accept Wildcard Characters?

false

-Credential<PSCredential>

Specifies a PSCredential object for the management group connection. To obtain a PSCredential object, use the Get-Credential cmdlet. For more information, type Get-Help Get-Credential.

If you specify a computer in the ComputerName parameter, use an account that has access to that computer. The default is the current user.

Aliases

none

Required?

false

Position?

named

Default Value

none

Accept Pipeline Input?

true (ByValue)

Accept Wildcard Characters?

false

-EventId<Int32[]>

Specifies an array of event IDs. An SCOMEvent object contains an event ID as its Number property.

Aliases

none

Required?

false

Position?

2

Default Value

none

Accept Pipeline Input?

true (ByValue)

Accept Wildcard Characters?

true

-EventLogName<String[]>

Specifies an array of names of event logs. An SCOMEvent object contains an event log name as its Channel property.

Aliases

none

Required?

false

Position?

3

Default Value

none

Accept Pipeline Input?

true (ByValue)

Accept Wildcard Characters?

true

-EventSource<String[]>

Specifies an array of event sources. An SCOMEvent object contains an event source as its PublisherName property.

Aliases

none

Required?

false

Position?

4

Default Value

none

Accept Pipeline Input?

true (ByValue)

Accept Wildcard Characters?

true

-Id<Guid[]>

Specifies an array of GUIDs of events. An SCOMEvent object contains GUID as its Id property.

Aliases

none

Required?

true

Position?

1

Default Value

none

Accept Pipeline Input?

true (ByValue)

Accept Wildcard Characters?

false

-Instance<EnterpriseManagementObject[]>

Specifies an array of monitoring objects that represent instances. To obtain monitoring objects, use the Get-SCOMClassInstance cmdlet.

This parameter also accepts group objects. To obtain a group object, use the Get-SCOMGroup cmdlet.

Aliases

none

Required?

true

Position?

1

Default Value

none

Accept Pipeline Input?

true (ByValue)

Accept Wildcard Characters?

false

-Rule<ManagementPackRule[]>

Specifies an array of rules as ManagementPackRule objects. To obtain a ManagementPackRule object, use the Get-SCOMRule cmdlet.

Aliases

none

Required?

true

Position?

1

Default Value

none

Accept Pipeline Input?

true (ByValue)

Accept Wildcard Characters?

false

-SCSession<Connection[]>

Specifies an array of Connection objects. To obtain a Connection object, use the Get-SCOMManagementGroupConnection cmdlet.

Aliases

none

Required?

false

Position?

named

Default Value

none

Accept Pipeline Input?

true (ByValue)

Accept Wildcard Characters?

false

<CommonParameters>

This cmdlet supports the common parameters: -Verbose, -Debug, -ErrorAction, -ErrorVariable, -OutBuffer, and -OutVariable. For more information, see    about_CommonParameters (https://go.microsoft.com/fwlink/p/?LinkID=113216).

Inputs

The input type is the type of the objects that you can pipe to the cmdlet.

Outputs

The output type is the type of the objects that the cmdlet emits.

Examples

Example 1: Get events for WMI rules

This example gets all the health events matching rules that contain WMI in their display names.

The first command gets all monitoring rules that have WMI in their display names and stores them in the $Rules variable.

The second command gets all classes with health in the display name and uses the pipeline operator (|) to pass the class objects to the Get-SCOMClassInstance cmdlet. That cmdlet gets the class instances for each of the class objects. Then, the command gets the events for each class instance matching the rules stored in the $Rules variable. Using the ErrorAction parameter with a value of SilentlyContinue allows the command to continue if it does not find an event that matches the specified rule.

PS C:\> $Rules = Get-SCOMRule -Name *WMI*
PS C:\> Get-SCOMClass -DisplayName *health* | Get-SCOMClassInstance | Get-SCOMEvent -Rule $Rules -ErrorAction SilentlyContinue

Example 2: Get an event by using its ID

This command gets the event that has an ID of 7413b06b-a95b-4ae3-98f2-dac9ff76dabd.

PS C:\> Get-SCOMEvent -Id 7413b06b-a95b-4ae3-98f2-dac9ff76dabd

Example 3: View events grouped by event IDs

This command gets all events and then passes them to the Group-Object cmdlet by using the pipeline operator. That cmdlet displays the events grouped by the Number property of the SCOMEvent object, which corresponds to an integer event ID. For more information, type Get-Help Group-Object.

PS C:\> Get-SCOMEvent | Group-Object -Property Number

Get-SCOMClassInstance

Get-SCOMRule

Get-SCOMManagementGroupConnection

Get-SCOMGroup

Get-SCOMClassInstance

Get-Credential