System.Event.GenericDataMapper
Applies To: Operations Manager 2007 R2
System.Event.GenericDataMapper is a condition detection module type that is used to map data of any type to event data that can be stored in the Operations Manager database and the data warehouse.
Usage
Use this module to map data in a workflow to a data type that is of the System.Event.Data data type.
Type Definition
<ConditionDetectionModuleType ID="System.Event.GenericDataMapper" Accessibility="Public" Stateful="false" PassThrough="false" Batching="false">
<Configuration>
<IncludeSchemaTypes>
<SchemaType>System.ParamListSchema</SchemaType>
</IncludeSchemaTypes>
<xsd:element name="EventOriginId" type="xsd:string"/>
<xsd:element name="PublisherId" type="xsd:string"/>
<xsd:element name="PublisherName" type="xsd:string"/>
<xsd:element name="Channel" type="xsd:string"/>
<xsd:element name="LoggingComputer" type="xsd:string"/>
<xsd:element name="EventNumber" type="xsd:string"/>
<xsd:element name="EventCategory" type="xsd:string"/>
<xsd:element name="EventLevel" type="xsd:string"/>
<xsd:element name="UserName" type="xsd:string"/>
<xsd:element name="Description" type="xsd:string" minOccurs="0" maxOccurs="1"/>
<xsd:element name="Params" type="ParamListType"/>
</Configuration>
<ModuleImplementation Isolation="Any">
<Native>
<ClassID>915E1B16-C101-4C0C-85ED-4301786AE09A</ClassID>
</Native>
</ModuleImplementation>
<OutputType>System.Event.Data</OutputType>
<InputTypes>
<InputType>System.BaseData</InputType>
</InputTypes>
</ConditionDetectionModuleType>
Parameters
The System.Event.GenericDataMapper module supports the configuration parameters described in the following table.
| Parameter | Type | Overrideable | Description |
|---|---|---|---|
EventOriginId |
String |
False |
Required parameter. Identifies the source of the event by a GUID. The value of this parameter is commonly set to a $MPElement$ variable that contains a GUID that represents the ID of the rule that is running. |
PublisherId |
String |
False |
Required parameter. Identifies the event publisher by a GUID. This parameter is commonly set to a $MPElement$ variable that contains a GUID that represents the ID of the rule running. |
PublisherName |
String |
False |
Required parameter. Contains the event source. |
Channel |
String |
False |
Required parameter. Contains the name of the event log. |
LoggingComputer |
String |
False |
Required parameter. Contains the name of the computer the event was logged from. |
EventNumber |
String |
False |
Required parameter. Contains the event ID. |
EventCategory |
String |
False |
Required parameter. Contains the category of the event that is used to help correlate events to the components of an application. |
EventLevel |
String |
False |
Required parameter. Contains the severity level of the event (for example, Information, Warning, or Error). |
Description |
String |
False |
Required parameter. Contains the full-text description of the event. This string can optionally contain a parameter substitution. |
UserName |
String |
False |
Required parameter. Contains the user name of the user who generated the event. |
Params |
False |
Optional parameter. Specifies one of more event parameters. |
PublisherName
The PublisherName parameter contains the event source of the event that would be displayed in the Event Viewer if this was an actual generated Windows event. This value can be any string and has to be a registered event source, as shown in the following example:
<PublisherName>ApplicationX</PublisherName>
Note
It is a best practice to use a publisher name that can easily be attributed to the application you are monitoring.
Channel
The Channel parameter contains the Windows event log name that the event appears to originate from, such as the Application or System event log. This value does not have to be a registered event log on the Windows-based computer because the event is being generated only for Operations Manager use.
The following code is an example definition:
<Channel>Application</Channel>
LoggingComputer
The LoggingComputer parameter specifies the computer that the event appears to be generated from. This is usually the computer on which the workflow is executing, and it is commonly a $Target reference.
For example, if the module is being used in a rule that is targeting an instance that is hosted by Windows-based computer, the configuration of this parameter is defined as the following:
<LoggingComputer>$Target/Host/Property[Type='Windows!Microsoft.Windows.Computer']/NetworkName$</LoggingComputer>
EventNumber
The EventNumber parameter contains the ID of the event. Although the schema specifies a string for this parameter, the value should be an integer.
The following code example shows the use of a static value:
<EventNumber>200</EventNumber>
The following code example shows the use of a value from the incoming data item, which is a property bag in this specific example:
<EventNumber>$Data/Property[@Name='EventIDValue']$</EventNumber>
EventCategory
The value of the EventCategory parameter (an integer from 0 to 65535) is an index into a category dynamic-link library (DLL) message table that contains a localized string. Each publisher defines its own set of categories. These categories commonly correspond to individual components (for example: a connector, module host, or data warehouse).
This value can also be set to 0 and ignored.
EventLevel
The EventLevel parameter specifies the severity level of the event. The values defined in the following table are valid.
| Value | Definition |
|---|---|
0 |
Success |
1 |
Critical |
2 |
Warning |
4 |
Information |
8 |
Success Audit |
16 |
Failure Audit |
UserName
The UserName parameter contains the user name of the user that the event appears to be generated from. This element must be present, but it can be empty.
Description
The Description parameter contains the full text description. This value can optionally use parameter substitution from the Params section of the configuration. The full substituted string is stored in the database and is visible in the Operations console.
Important
This text is not localizable.
The following code shows an example static description:
<Description>Application X has a problem</Description>
The following code shows an example that uses two parameters that are substituted into the description:
<Description>Value1 is: %1; Value 2 is %2</Description>
The preceding example requires that you set a minimum of two parameters in the Params configuration value for the mapper module. If you specify a parameter in the description and it is not populated in the parameters element, the description is empty for that parameter.
For more detailed information about escape sequences and parameter substitution, see the FormatMessage Function.
Params
The Params parameter contains the set of event parameters used to simulate a parameterized event. These parameters can be used to build the description of the event if required. This element is optional, but if it is used, it should contain at least one Param element. For more information about the Params element, see ParamListType.
Composition
The System.Event.GenericDataMapper module is a native module.
Related Modules
None.
External Module References
The System.Event.GenericDataMapper module is a member of the public module described in the following table.
| Module Type | Library | Usage |
|---|---|---|
Microsoft.Windows.Library |
Queries a WMI namespace at a scheduled frequency and returns the filtered results as System.Event.Data type data. |
Sample
The following XML sample shows how you can use the System.Event.GenericDataMapper module in a DataSourceModuleType element definition. The mapper module is used to convert WMI object data into event data.
<DataSourceModuleType ID="Microsoft.Windows.WmiProvider.FilteredEventProvider" Accessibility="Public">
<Configuration>
<IncludeSchemaTypes>
<SchemaType>System!System.ExpressionEvaluatorSchema</SchemaType>
</IncludeSchemaTypes>
<xsd:element name="NameSpace" type="xsd:string" />
<xsd:element name="Query" type="xsd:string" />
<xsd:element name="Frequency" type="xsd:integer" />
<xsd:element name="Expression" type="ExpressionType" />
</Configuration>
<OverrideableParameters>
<OverrideableParameter ID="Frequency" Selector="$Config/Frequency$" ParameterType="int" />
</OverrideableParameters>
<ModuleImplementation>
<Composite>
<MemberModules>
<DataSource TypeID="Microsoft.Windows.WmiProvider" ID="DataSource">
<NameSpace>$Config/NameSpace$</NameSpace>
<Query>$Config/Query$</Query>
<Frequency>$Config/Frequency$</Frequency>
</DataSource>
<ConditionDetection TypeID="System!System.ExpressionFilter" ID="Filter">
<Expression>$Config/Expression$</Expression>
</ConditionDetection>
<ConditionDetection TypeID="System!System.Event.GenericDataMapper" ID="Mapper">
<EventOriginId>$Target/Id$</EventOriginId>
<PublisherId>$MPElement$</PublisherId>
<PublisherName>WmiProvider</PublisherName>
<Channel>WmiProvider</Channel>
<LoggingComputer />
<EventNumber>0</EventNumber>
<EventCategory>3</EventCategory>
<EventLevel>0</EventLevel>
<UserName />
<Params />
</ConditionDetection>
</MemberModules>
<Composition>
<Node ID="Mapper">
<Node ID="Filter">
<Node ID="DataSource" />
</Node>
</Node>
</Composition>
</Composite>
</ModuleImplementation>
<OutputType>System!System.Event.Data</OutputType>
</DataSourceModuleType>
Information
Module Type |
|
Input Type |
|
Output Type |
|
Implementation |
Native |
Library |
System.Library |