Operations Manager Management Pack Authoring - Variables
This document is part of the Operations Manager Management Pack Authoring Guide. The Microsoft System Center team has validated this procedure as of the original version. We will continue to review any changes and periodically provide validations on later revisions as they are made. Please feel free to make any corrections or additions to this procedure that you think would assist other users.
Management pack variables access information that is not known until either the management pack is installed or the particular workflow is running on an agent. Different variables are used in different situations, and knowledge of the different variables, their syntax, and when they are used is very important in creating different monitoring scenarios.
Using Variables
Variables in a management pack are delimited by using a dollar sign ($). When the variable is resolved, it is replaced with its calculated value. In some cases, the Authoring console provides menus that let you select a particular variable and have the appropriate syntax automatically created. In other cases though, you must create the variable yourself by using the appropriate syntax.
Kinds of Variables
The following table lists the kinds of variables that are used in a management pack. Additional details about each kind of variable are provided in other sections of this guide where the particular variable is used.
| Variable | Syntax | Used In | Description |
|---|---|---|---|
MPElement |
$MPElement[Name="ElementName"]/SubElementName$ | Discoveries |
Resolves to the GUID of the specified management pack element. |
Target |
$Target/Property[Type="ElementName"]/PropertyName$
$Target/Host/Property[Type="ElementName"]/PropertyName$ |
Discoveries |
Retrieves the value of a property of the target object or one of the target object’s hosts. |
Data |
$Data/<XPath to Property>$ | Monitors |
Retrieves a value from the data stream. |
Config |
$Config/Parameter$ |
Modules |
Retrieves a value from a parameter on the module or monitor type. |
RunAs |
$RunAs[Name="SecureReferenceId"]PropertyName |
Modules |
Retrieves the value of a property from a RunAs account. |
| FileResource | $FileResource[Name="ResourceId"]Path]$ | Discoveries Modules |
Retrieves the path for a resource in a management pack bundle. |
Alert Description Variables
The following variables can be used when adding information to alert descriptions:
For Event Rules
| EventDisplayNumber (Event ID) | $Data/EventDisplayNumber$ |
| EventDescription (Description): | $Data/EventDescription$ |
| Publisher Name (Event Source): | $Data/PublisherName$ |
| EventCategory: | $Data/EventCategory$ |
| LoggingComputer: | $Data/LoggingComputer$ |
| EventLevel: | $Data/EventLevel$ |
| Channel: | $Data/Channel$ |
| UserName: | $Data/UserName$ |
| EventNumber: | $Data/EventNumber$ |
| Event Time: | $Data/@time$ |
For Event Monitors
| EventDisplayNumber (Event ID) | $Data/Context/EventDisplayNumber$ |
| EventDescription (Description): | $Data/Context/EventDescription$ |
| Publisher Name (Event Source): | $Data/Context/PublisherName$ |
| EventCategory: | $Data/Context/EventCategory$ |
| LoggingComputer: | $Data/Context/LoggingComputer$ |
| EventLevel: | $Data/Context/EventLevel$ |
| Channel: | $Data/Context/Channel$ |
| UserName: | $Data/Context/UserName$ |
| EventNumber: | $Data/Context/EventNumber$ |
| Event Time: | $Data/Context/@time$ |
For Repeating Event Monitors
| EventDisplayNumber (Event ID) | $Data/Context/Context/DataItem/EventDisplayNumber$ |
| EventDescription (Description): | $Data/Context/Context/DataItem/EventDescription$ |
| Publisher Name (Event Source): | $Data/Context/Context/DataItem/PublisherName$ |
| EventCategory: | $Data/Context/Context/DataItem/EventCategory$ |
| LoggingComputer: | $Data/Context/Context/DataItem/LoggingComputer$ |
| EventLevel: | $Data/Context/Context/DataItem/EventLevel$ |
| Channel: | $Data/Context/Context/DataItem/Channel$ |
| UserName: | $Data/Context/Context/DataItem/UserName$ |
| EventNumber: | $Data/Context/Context/DataItem/EventNumber$ |
For Performance Threshold Monitors
| Object (Perf Object Name): | $Data/Context/ObjectName$ |
| Counter (Perf Counter Name): | $Data/Context/CounterName$ |
| Instance (Perf Instance Name): | $Data/Context/InstanceName$ |
| *Value (Perf Counter Value): | $Data/Context/Value$ |
| **Last Sampled Value | $Data/Context/SampleValue$ |
*Value will show the actual performance value for simple and avg monitors. It will show number of samples for consecutive threshold monitors.
**Last Sampled Value works to show the last value evaluated in a consecutive sample value monitor.
For Service Monitors
| Service Name | $Data/Context/Property[@Name='Name']$ |
| Service Dependencies | $Data/Context/Property[@Name='Dependencies']$ |
| Service Binary Path | $Data/Context/Property[@Name='BinaryPathName']$ |
| Service Display Name | $Data/Context/Property[@Name='DisplayName']$ |
| Service Description | $Data/Context/Property[@Name='Description']$ |
For SNMP Rules
| SNMP Address of Target Network Node | $Target/Property[Type="Network!System.NetworkManagement.Node"]/SNMPAddress$ |
| SNMP Node Display Name | $Target/Property[Type="System!System.Entity"]/DisplayName$ |
| SNMP Node Description | $Target/Property[Type="Network!System.NetworkManagement.Node"]/Description$ |
| SNMP Node Location | $Target/Property[Type="Network!System.NetworkManagement.Node"]/Location$ |
| SNMP Node Port Number | $Target/Property[Type="Network!System.NetworkManagement.Node"]/PortNumber$ |
| SNMP Version | $Target/Property[Type="Network!System.NetworkManagement.Node"]/SNMPVersion$ |
| OID of Trap | $Data/EventData/DataItem/SnmpVarBinds/SnmpVarBind[OID=".1.3.6.1.6.3.1.1.4.1.0"]/Value$ |
| Data Value included in trap | $Data/EventData/DataItem/SnmpVarBinds/SnmpVarBind[OID="<PutYourOIDHere, Reference MIB>"]/Value$ |
| Data Value from SNMP GET Monitor | $Data/Context/Value$ |
In the above examples, it is assumed that the alias for the "System.NetworkManagement.Library" management pack is "Network"
For Logfile Monitors
| Logfile Directory | $Data/Context/LogFileDirectory$ |
| Logfile name: | $Data/Context/LogFileName$ |
| String (text from row of log file): | $Data/Context/Params/Param[1]$ |
For Logfile Rules
| Logfile Directory | $Data/EventData/DataItem/LogFileDirectory$ |
| Logfile name: | $Data/EventData/DataItem/LogFileName$ |
| String (text from row of log file): | $Data/EventData/DataItem/Params/Param[1]$ |
General
| To show the name of the Windows Computer host: | $Target/Host/Property[Type="Windows!Microsoft.Windows.Computer"]/NetworkName$ |
For Notifications
| AlertID GUID | $Data/Context/DataItem/AlertId$ |
| Alert Name | $Data/Context/DataItem/AlertName$ |
| Alert category | $Data/Context/DataItem/Category$ |
| Created by Monitor (True/False) | $Data/Context/DataItem/CreatedByMonitor$ |
| CustomField1 | $Data/Context/DataItem/Custom1$ |
| CustomField2 | $Data/Context/DataItem/Custom2$ |
| CustomField3 | $Data/Context/DataItem/Custom3$ |
| CustomField4 | $Data/Context/DataItem/Custom4$ |
| CustomField5 | $Data/Context/DataItem/Custom5$ |
| CustomField6 | $Data/Context/DataItem/Custom6$ |
| CustomField7 | $Data/Context/DataItem/Custom7$ |
| CustomField8 | $Data/Context/DataItem/Custom8$ |
| CustomField9 | $Data/Context/DataItem/Custom9$ |
| CustomField10 | $Data/Context/DataItem/Custom10$ |
| UTC Date/Time of Dataitem created | $Data/Context/DataItem/DataItemCreateTime$ |
| Local Date/Time of Dataitem created | $Data/Context/DataItem/DataItemCreateTimeLocal$ |
| UTC Date/Time DataItem was modified | $Data/Context/DataItem/LastModified$ |
| Local Date/Time DataItem was modified | $Data/Context/DataItem/LastModifiedLocal$ |
| ManagedEntity GUID | $Data/Context/DataItem/ManagedEntity$ |
| ManagedEntity Display name | $Data/Context/DataItem/ManagedEntityDisplayName$ |
| ManagedEntity Full name | $Data/Context/DataItem/ManagedEntityFullName$ |
| Managed Entity Path | $Data/Context/DataItem/ManagedEntityPath$ |
| The Alert Priority Number (High=1,Medium=2,Low=3) | $Data/Context/DataItem/Priority$ |
| The Alert Owner | $Data/Context/DataItem/Owner$ |
| The Alert Repeat Count | $Data/Context/DataItem/RepeatCount$ |
| Resolution state ID (0=New, 255=Closed) | $Data/Context/DataItem/ResolutionState$ |
| UTC Date/Time ResolutionState was last modified | $Data/Context/DataItem/ResolutionStateLastModified$ |
| Local Date/Time ResolutionState was last modified | $Data/Context/DataItem/ResolutionStateLastModifiedLocal$ |
| The Resolution State Name (New, Closed) | $Data/Context/DataItem/ResolutionStateName$ |
| Person resolving the alert | $Data/Context/DataItem/ResolvedBy$ |
| Alert Severity ID | $Data/Context/DataItem/Severity$ |
| TicketID | $Data/Context/DataItem/TicketId$ |
| UTC Time Added | $Data/Context/DataItem/TimeAdded$ |
| Local Time Added | $Data/Context/DataItem/TimeAddedLocal$ |
| UTC Time Raised | $Data/Context/DataItem/TimeRaised$ |
| Local Time Raised | $Data/Context/DataItem/TimeRaisedLocal$ |
| UTC Date/Time the Alert was resolved | $Data/Context/DataItem/TimeResolved$ |
| The Workflow ID (GUID) | $Data/Context/DataItem/WorkflowId$ |
| Name of the recipient | $Data/Recipients/To/Address/Address$ |
| Web Console URL | $Target/Property[Type="Notification!Microsoft.SystemCenter.AlertNotificationSubscriptionServer"/WebConsoleUrl$ |
| PrincipalName of the management server | $Target/Property[Type="Notification!Microsoft.SystemCenter.AlertNotificationSubscriptionServer"/PrincipalName$ |