SCOM agent monitor ETL file

Question

Hello,

I have an application that saves the logs in etl format, the ask is to monitor for some EventIDs in that ETL file.

I can open the etl file with PowerShell and do some research so I can write a custom rule based on a PS that looks for that info but I prefer (if possible) to have the agent with some native module do the work.

Thanks!

Answer 1

What's the format of these ETL files? SCOM doesn't have any specific module for them, but maybe a regular text log monitor could work...

Answer 2

Hi,

ETL files are log files that have been created by the Microsoft Tracelog software application. This is in binary file format, so the regular expression cannot do the trick. (It can handles plain text gracefully)

If our self-generated log appears in the Available event logs list (see below example, which is similar to get-winevent cmdlet), then we can create a rule based on specific event id. Otherwise, it seems a rule/monitor based on PS script (to parse the .etl file) is the better choice.

For more details about rules based on event id, we may read:

https://social.technet.microsoft.com/wiki/contents/articles/51547.scom-monitor-a-specific-windows-event.aspx

Hope the above information helps.

Alex Zhu

---

If the response is helpful, please click "Accept Answer" and upvote it.

Answer 3

HI @Ionut Marius Plosceanu ,

ETL files cannot be parsed natively, I am afraid. You would like to go the PowerShell way to do the logic and then use a rule or a monitor to do the rest.

Regards,
Stoyan