How to create a WMI event monitor

  • 發行項

適用於: System Center Operations Manager 2007

The following procedure shows how to create a WMI event monitor in the Operations Manager 2007 Authoring console. Before you perform this procedure, you must first complete the prerequisite procedure How to Create a Class in which you create the target class.

注意

In this example, criteria is included in the WMI query, so no expression is required in the monitor. The WMI event wizard in the Authoring console requires an expression for each event though. Because of this requirement, dummy expressions will be provided to complete the wizard and then deleted once the monitor is created.

The monitor created in this procedure has the following characteristics:

  • Runs on any computer that has an instance of MyComputerRole1.

  • Sets the monitor to a critical state when Notepad is started on the agent computer.

  • Sets the monitor to a healthy state when Notepad is ended on the agent computer.

To create a WMI event monitor

  1. In the Authoring console, select Health Model, and then select Monitors.

  2. In the Monitors pane, expand Computer Role 1 and then System.Health.EntityState.

  3. Right-click System.Health.AvailabilityState, select New, select WMI Events, select Simple, and then select Event Reset.

  4. On the General page, do the following:

    1. In the ElementID box, type MyMP.Monitor.MyApplicationWMIEventError.

    2. In the Display Name box, type MyApplication WMI Event Error.

    3. In the Target box, select MyMP.MyComputerRole1.

    4. In the Parent Monitor box, select System.Health.AvailabilityState.

    5. In the Category box, select AvailabilityHealth. Click Next.

  5. On the First WMI Event Provider page, do the following:

    1. In the WMI Namespace box, type root\cimv2.

    2. In the Query box, paste the following WMI query.

      Select * From __InstanceCreationEvent WITHIN 60 Where TargetInstance ISA 'Win32_Process' and TargetInstance.Name = 'notepad.exe'

    3. In the Poll Interval box, type 60.

    4. Click Next.

  6. On the First Expression page, do the following:

    1. Click Insert.

    2. In the Parameter Name box type Dummy.

    3. In the Operator box select Equals.

    4. In the Value box type Dummy.

    5. Click Next.

  7. On the Second WMI Event Provider page, do the following:

    1. In the WMI Namespace box, type root\cimv2.

    2. In the Query box, paste the following WMI query.

      Select * From __InstanceDeletionEvent WITHIN 60 Where TargetInstance ISA 'Win32_Process' and TargetInstance.Name = 'notepad.exe'

    3. In the Poll Interval box, type 60.

    4. Click Next.

  8. On the Second Expression page, do the following:

    1. Click Insert.

    2. In the Parameter Name box type Dummy.

    3. In the Operator box select Equals.

    4. In the Value box type Dummy.

    5. Click Finish.

  9. Expand System.Health.AvailabilityState.

  10. Right-click MyMP.Monitor.MyApplicationWMIEventError and select Properties.

  11. On the Configuration tab, do the following:

    1. Click Configure.

    2. Select the First Expression tab.

    3. Click Delete.

    4. Select the Second Expression tab.

    5. Click Delete.

    6. Click OK.

  12. On the Health tab, for FirstEventRaised, change the Health State to Critical.

  13. On the Alerting tab, do the following:

    1. Check Generate alerts for this monitor

    2. In the Alert description box, type Stopped process: $Data/Context/Collection['TargetInstance']/Property[@Name='Caption']$

    3. Click OK.

另請參閱

概念

Events
Event Monitors