Event Views

發行項
05/13/2011

適用於: System Center Operations Manager 2007

Event views provide a listing of events that are collected by rules in the Operations Manager database. Columns in the view can include the value of properties of each event.

The contents of an event view are determined by the following:

Target

All event views must specify a target class. An event view will list all the events associated with the target class or any classes hosted by the target class. All instances of the target class in the management group will be included unless criteria or a group is specified to limit the instance displayed. All events associated with these objects will be included unless you specify criteria to limit them.

Group

An event view does not require a group. If a group is specified, then only events associated with instances of the target class in the group will be included in the view. Even though the group may contain objects of different classes, only events from instances of the target class are displayed.

Criteria

An event view does not require criteria. If it is provided, criteria allow the included events to be limited according to the values of one or more properties. Criteria is added and configured by starting the external editor from the Authoring console or by using the dialog box in the Operations console. The properties that may be used in criteria are provided in the following table with XML samples.

Condition	Description	Example
Rules	One more rules that collected the event. The value for Rule indicates the specific rule or monitor. If this is selected in the Operations console, it will be the actual GUID. This should be changed to an $MPElement variable to ensure that it moved between management groups.	`<RuleList> <Rule>$MPElement[Name='MyMP.MyRule']$</Rule> </RuleList>`
Event Number	One or more values matching the number of event.	`<EventNumberList> <EventNumber>1234</EventNumber> </EventNumberList>`
Source	The name of the publisher of the event.	`<PublisherName>MyApp</PublisherName>`
Time Generated	The time that the event was generated. A time range or a relative duration from the current time can be specified. If a relative time is used, then the WithinLast node requires a Unit attribute. The possible values for this attribute are as follows: Second Minute Hour Day	`<TimeGenerated> <Range> <After>2010-05-16T12:00:00</After> <Before>2010-05-27T18:00:00</Before> </Range> </TimeGenerated>` `<TimeGenerated> <WithinLast Unit="Hour">2</WithinLast> </TimeGenerated>`
Instance Name		`<ManagedEntityName>name</ManagedEntityName>`
Severity Level	One or more value that match the severity level of the event. Valid values are listed in the following table.	`<LevelIdList> <Level>2</Level> <Level>1</Level> </LevelIdList>`
User	The user name that created the event.	`<User>NT AUTHORITY\SYSTEM</User>`
Computer	Name of the computer that logged the event.	`<LoggingComputer>svr01.contoso.com</LoggingComputer>`

The following table lists the possible values for the severity level criteria:

Value	Description
0	Success
1	Error
2	Warning
4	Information
8	Audit Success
16	Audit Failure

Columns

Each column in an event view is defined by using a ColumnInfo node in the Presentation node of the view. The XML of an example column definition is shown here:

<ColumnInfo Index="0" SortIndex="-1" Width="22" Grouped="false" Sorted="false" IsSortable="true" Visible="true" SortOrder="Ascending">
   <Name>Severity</Name>
   <Id>Severity</Id>
</ColumnInfo>

The content of each column is determined by its ID value with the title of the column defined by the Name. The possible contents of a state view are identified in the following table:

Column	ID	Description
Level	LevelId	Severity level of the event
Date and Time	TimeGenerated	Date and time that the event was generated
Source	PublisherName	Publisher name of the event
Name	MonitoringObjectDisplayName	Name of the monitoring object that the event is associated with
User	User	User name that generated the event
Event Number	Number	Number of the event
Log Name	Channel	Name of the log that the event was collected from
Logging Computer	LoggingComputer	Name of the computer that logged the event
Rule Name	MonitoringRuleDisplayName	Name of the rule that collected the event

The order of the columns can be specified by using the dialog box in the Operations console. This corresponds to the Index attribute in the XML for the column.

If no columns are specified for the view, then by default, the following columns are displayed:

Level
Date and Time
Source
Name
User
Event Number
Log Name

Formatting

The formatting of an event view is accomplished by modifying the attributes of each column definition. This is performed by starting the external editor from the Authoring console or with the dialog box in the Operations console. The different characteristics each column and their corresponding attributes are listed in the following table:

Characteristic	Description
Column Order	The order of how the columns are positioned can be specified with the Index attribute for the column. This can also be performed by using the Display tab in the Properties dialog box for the view in the Operations console.
Column Width	Each column has a width attribute defining the width of the column in pixels. The column width in the dialog box will be used the first time that you open the Operations console. If you change the width in the Operations console, then the new settings will be saved on the local workstation. You cannot guarantee that the column width in the management pack is retained on any workstation.
Column Visibility	Each column has a Visible attribute that defines whether the column will be visible in the Operations console. If a column should not be displayed, then it should still be included in the view by using the Visible attribute set to false. If the column is not included in the view, then it is not available as an option for the user to add it to the view in the Operations console. For this reason, all columns are typically included in the view with the visibility of the columns that should not be displayed set to false.
Sorting	The events listed in an event view can be sorted by any of the included columns. The sorting configuration in the dialog box will be used the first time that you open the Operations console. If you change the sort order in the Operations console, then the new settings will be saved on the local workstation. There is no way to guarantee that the sort order in the management pack is retained on any workstation. The dialog box in the Operations console allows for the view to be sorted by a single column. Sorting may be performed on multiple columns by modifying the XML of the view. This is performed by changing the value of the Sorted attribute of the column entry to true. The SortIndex attribute defines the order that the columns will be sorted, and its value must be changed to a value of 0 or more. The SortOrder attribute must be either Ascending or Descending depending on the desired sort order for the column.
Grouping	Event views can be grouped by any of the included columns. The Operations console dialog box allows for up to three fields that you can use for grouping, but any number may be used when you edit the XML. To use a column for grouping, change the value of its Grouped attribute to true. The SortIndex attribute is used to determine the order for the grouping of multiple columns and must be changed to a value larger than 0.