Why cant I configure an event view to show events collected only by my rule?

  • Article

While writing a management pack today, I came across an interesting issue. When you create an event view, you can specify in the criteria of the event view that it should only show events collected by a specific rule. When you do this, a dialog comes up that lists all the rules that you can filter by. Looks like this dialog only show rules where the rule category is EventCollection. If you create a rule and dont specify its category as EventCollection, it does not show up and you cant make the UI filter by this rule.

If you are creating the rule in the Operations Console, be sure to configure the category of the rule as “EventCollection”. By default its set to “Custom”.

From an XML perspective, here is how it looks:

<Rule ID="SampleEventCollectionRule" Enabled="onEssentialMonitoring" Target="TargetXyz" ConfirmDelivery="false" Remotable="true" Priority="Normal" DiscardLevel="100">

< Category > EventCollection</Category>

So if you want your rule to show up in the list of rules that the user can filter by, be sure to mark it as an EventCollection rule.

One more thing, if you are writing a management pack and want to define a view in the MP that only shows events generated by a particular rule, here is what you need to put in the view criteria:

<View ID="EventView1" Accessibility="Internal" Enabled="true" Target="TargetXyz" TypeID="SC!Microsoft.SystemCenter.EventViewType" Visible="true">

        <Category>Operations</Category>

        <Criteria>

          <RuleList>

<Rule>$MPElement[Name='SampleEventCollectionRule']$</Rule>

          </RuleList>

        </Criteria> the rest of the view xml follows…

This will cause the view to show only events collected by the specified rule.

However if you don’t mark the rule as an “EventCollection” rule then, in the view properties, the GUID of the rule will be shown rather than the rule name.