Using a property bag to populate an alert description part II


Over a year ago I blogged about the proper syntax required to populate an alert description with data returned from a property bag.  The syntax in the blog is correct but the idea of doing this confused some.  I will describe below how to accomplish this with a rule using the following scenario.


Lets say you have an application that creates an event (we’ll use event 9999 as an example) when it has a certain problem.  You want to get alerted when this event occurs, but you want to do some additional diagnostics before the alert is generated and populate the alert description with information collected from the diagnostics.  I have put a diagram of this scenario below:


Diagram1


I have listed each step that I used to create this management pack below.


Step 1 – Create and name a new management pack in the Authoring Console


Capture1


Step 2 – Create a new composite data source


Capture2


Step 3 – Add the Microsoft.Windows.EventProvider member module to the data source


Capture3


Step 4 – Configure the member module to look for an event id from the application event log where the id = a parameter that is passed in.


Capture4


Step 5 – Add the Microsoft.Windows.ScriptPropertyBagProbe member module to the data source


Capture5


Step 6 – Configure the member module to accept parameters for the script name, arguments, and script body.  In my example I hard code the script timeout to 30 seconds but you can also make this configurable via a parameter.


Capture6


Step 7 – Set the order of the member modules so the EventProvider runs first, the ScriptProvider runs second, and the Module Output is last. 


Capture7


Step 8 – Add all of the parameters that need to be passed into this data source.  Your data source is now complete.


Capture8


Step 9 – Create a new custom rule in the Authoring Console.  I am targeting my rule to Microsoft.Windows.Computer for example purposes.


Capture9


Step 10 – On the Modules tab, add our custom data source and then click “Edit” to configure the parameters we want to pass to this data source.  My ScriptBody parameter contains a very simple VBScript that returns a string that I want to have appear in the alert description (“This is the information that I collected for my alert”).  In the real world this string would obviously be additional useful information that was gathered by the vbscript.  I use notepad as my XML editor so this is what my configuration looks like.


Capture10


Step 11 – After the data source is configured go back to the Modules tab and add a new action of type System.Health.GenerateAlert.  Once added click “Edit” and then “Configure” to pull up the Alerting User Interface.  Now fill in the appropriate fields for the alert.  Notice that the Alert description xpath is looking for the value in the property bag which is populated in the vbscript which we configured in the last step.  After this step your rule should be created.


Capture11


Step 12 – Import the MP and create an event of 9999 in the application event log on an agent


Capture12


Step 13 – View the alert generated to ensure it contains the string from the VBScript


 Capture13


I hope this example helps explain how information from a property bag can appear in an alert description and might also be a good introduction to the authoring console for some.  I have attached the MP that was created by these steps for your reference.

DataSourceDemo.xml

Comments (3)

  1. Coen van Dijk says:

    Hi Russ,

    A great post!  One question: How can I use the data from the event in the vb script? I want to use the orinal information from the event and add some extr ainformation to it

    Thanks in advance!

    Coen

  2. Russ Slaten says:

    Hi Coen, in this example I was just using the event to trigger the action so I didn't try to read anything from it. If you wanted to use information from the event you could pass that into the script as an argument, like the script description. The script could then add something to the description as you mentioned and then return that as part of the property bag. Once in the property bag you can then create an alert based on what you put in the property bag.

Skip to main content