本文件已封存並已停止維護。

Event Views

更新日期: 2010年7月

適用於: System Center Operations Manager 2007

Event views provide a listing of events that are collected by rules in the Operations Manager database. Columns in the view can include the value of properties of each event.

Contents

The contents of an event view are determined by the following:

Target

All event views must specify a target class. An event view will list all the events associated with the target class or any classes hosted by the target class. All instances of the target class in the management group will be included unless criteria or a group is specified to limit the instance displayed. All events associated with these objects will be included unless you specify criteria to limit them.

Group

An event view does not require a group. If a group is specified, then only events associated with instances of the target class in the group will be included in the view. Even though the group may contain objects of different classes, only events from instances of the target class are displayed.

Criteria

An event view does not require criteria. If it is provided, criteria allow the included events to be limited according to the values of one or more properties. Criteria is added and configured by starting the external editor from the Authoring console or by using the dialog box in the Operations console. The properties that may be used in criteria are provided in the following table with XML samples.

 

Condition Description Example

Rules

One more rules that collected the event. The value for Rule indicates the specific rule or monitor. If this is selected in the Operations console, it will be the actual GUID. This should be changed to an $MPElement variable to ensure that it moved between management groups.

<RuleList> <Rule>$MPElement[Name='MyMP.MyRule']$</Rule>
</RuleList>

Event Number

One or more values matching the number of event.

<EventNumberList>
   <EventNumber>1234</EventNumber>
</EventNumberList>

Source

The name of the publisher of the event.

<PublisherName>MyApp</PublisherName>

Time Generated

The time that the event was generated. A time range or a relative duration from the current time can be specified. If a relative time is used, then the WithinLast node requires a Unit attribute. The possible values for this attribute are as follows:

  • Second

  • Minute

  • Hour

  • Day

<TimeGenerated>
   <Range>
      <After>2010-05-16T12:00:00</After>
      <Before>2010-05-27T18:00:00</Before>
   </Range>
</TimeGenerated>
<TimeGenerated>
   <WithinLast Unit="Hour">2</WithinLast>
</TimeGenerated>

Instance Name

<ManagedEntityName>name</ManagedEntityName>

Severity Level

One or more value that match the severity level of the event. Valid values are listed in the following table.

<LevelIdList>
   <Level>2</Level>
   <Level>1</Level>
</LevelIdList>

User

The user name that created the event.

<User>NT AUTHORITY\SYSTEM</User>

Computer

Name of the computer that logged the event.

<LoggingComputer>svr01.contoso.com</LoggingComputer>

The following table lists the possible values for the severity level criteria:

 

Value Description

0

Success

1

Error

2

Warning

4

Information

8

Audit Success

16

Audit Failure

Columns

Each column in an event view is defined by using a ColumnInfo node in the Presentation node of the view. The XML of an example column definition is shown here:

<ColumnInfo Index="0" SortIndex="-1" Width="22" Grouped="false" Sorted="false" IsSortable="true" Visible="true" SortOrder="Ascending">
   <Name>Severity</Name>
   <Id>Severity</Id>
</ColumnInfo>

The content of each column is determined by its ID value with the title of the column defined by the Name. The possible contents of a state view are identified in the following table:

 

Column ID Description

Level

LevelId

Severity level of the event

Date and Time

TimeGenerated

Date and time that the event was generated

Source

PublisherName

Publisher name of the event

Name

MonitoringObjectDisplayName

Name of the monitoring object that the event is associated with

User

User

User name that generated the event

Event Number

Number

Number of the event

Log Name

Channel

Name of the log that the event was collected from

Logging Computer

LoggingComputer

Name of the computer that logged the event

Rule Name

MonitoringRuleDisplayName

Name of the rule that collected the event

The order of the columns can be specified by using the dialog box in the Operations console. This corresponds to the Index attribute in the XML for the column.

If no columns are specified for the view, then by default, the following columns are displayed:

  • Level

  • Date and Time

  • Source

  • Name

  • User

  • Event Number

  • Log Name

Formatting

The formatting of an event view is accomplished by modifying the attributes of each column definition. This is performed by starting the external editor from the Authoring console or with the dialog box in the Operations console. The different characteristics each column and their corresponding attributes are listed in the following table:

 

Characteristic Description

Column Order

The order of how the columns are positioned can be specified with the Index attribute for the column. This can also be performed by using the Display tab in the Properties dialog box for the view in the Operations console.

Column Width

Each column has a width attribute defining the width of the column in pixels. The column width in the dialog box will be used the first time that you open the Operations console. If you change the width in the Operations console, then the new settings will be saved on the local workstation. You cannot guarantee that the column width in the management pack is retained on any workstation.

Column Visibility

Each column has a Visible attribute that defines whether the column will be visible in the Operations console. If a column should not be displayed, then it should still be included in the view by using the Visible attribute set to false. If the column is not included in the view, then it is not available as an option for the user to add it to the view in the Operations console. For this reason, all columns are typically included in the view with the visibility of the columns that should not be displayed set to false.

Sorting

The events listed in an event view can be sorted by any of the included columns. The sorting configuration in the dialog box will be used the first time that you open the Operations console. If you change the sort order in the Operations console, then the new settings will be saved on the local workstation. There is no way to guarantee that the sort order in the management pack is retained on any workstation.

The dialog box in the Operations console allows for the view to be sorted by a single column. Sorting may be performed on multiple columns by modifying the XML of the view. This is performed by changing the value of the Sorted attribute of the column entry to true. The SortIndex attribute defines the order that the columns will be sorted, and its value must be changed to a value of 0 or more. The SortOrder attribute must be either Ascending or Descending depending on the desired sort order for the column.

Grouping

Event views can be grouped by any of the included columns. The Operations console dialog box allows for up to three fields that you can use for grouping, but any number may be used when you edit the XML. To use a column for grouping, change the value of its Grouped attribute to true. The SortIndex attribute is used to determine the order for the grouping of multiple columns and must be changed to a value larger than 0.

顯示: