System.Event.GenericDataMapper

  • Article

Applies To: Operations Manager 2007 R2

System.Event.GenericDataMapper is a condition detection module type that is used to map data of any type to event data that can be stored in the Operations Manager database and the data warehouse.

Usage

Use this module to map data in a workflow to a data type that is of the System.Event.Data data type.

Type Definition

<ConditionDetectionModuleType ID="System.Event.GenericDataMapper" Accessibility="Public" Stateful="false" PassThrough="false" Batching="false">
  <Configuration>
    <IncludeSchemaTypes>
      <SchemaType>System.ParamListSchema</SchemaType>
    </IncludeSchemaTypes>
    <xsd:element name="EventOriginId" type="xsd:string"/>
    <xsd:element name="PublisherId" type="xsd:string"/>
    <xsd:element name="PublisherName" type="xsd:string"/>
    <xsd:element name="Channel" type="xsd:string"/>
    <xsd:element name="LoggingComputer" type="xsd:string"/>
    <xsd:element name="EventNumber" type="xsd:string"/>
    <xsd:element name="EventCategory" type="xsd:string"/>
    <xsd:element name="EventLevel" type="xsd:string"/>
    <xsd:element name="UserName" type="xsd:string"/>
    <xsd:element name="Description" type="xsd:string" minOccurs="0" maxOccurs="1"/>
    <xsd:element name="Params" type="ParamListType"/>
  </Configuration>
  <ModuleImplementation Isolation="Any">
    <Native>
      <ClassID>915E1B16-C101-4C0C-85ED-4301786AE09A</ClassID>
    </Native>
  </ModuleImplementation>
  <OutputType>System.Event.Data</OutputType>
  <InputTypes>
    <InputType>System.BaseData</InputType>
  </InputTypes>
</ConditionDetectionModuleType>

Parameters

The System.Event.GenericDataMapper module supports the configuration parameters described in the following table.

Parameter Type Overrideable Description

EventOriginId

String

False

Required parameter. Identifies the source of the event by a GUID. The value of this parameter is commonly set to a $MPElement$ variable that contains a GUID that represents the ID of the rule that is running.

PublisherId

String

False

Required parameter. Identifies the event publisher by a GUID. This parameter is commonly set to a $MPElement$ variable that contains a GUID that represents the ID of the rule running.

PublisherName

String

False

Required parameter. Contains the event source.

Channel

String

False

Required parameter. Contains the name of the event log.

LoggingComputer

String

False

Required parameter. Contains the name of the computer the event was logged from.

EventNumber

String

False

Required parameter. Contains the event ID.

EventCategory

String

False

Required parameter. Contains the category of the event that is used to help correlate events to the components of an application.

EventLevel

String

False

Required parameter. Contains the severity level of the event (for example, Information, Warning, or Error).

Description

String

False

Required parameter. Contains the full-text description of the event. This string can optionally contain a parameter substitution.

UserName

String

False

Required parameter. Contains the user name of the user who generated the event.

Params

ParamListType

False

Optional parameter. Specifies one of more event parameters.

PublisherName

The PublisherName parameter contains the event source of the event that would be displayed in the Event Viewer if this was an actual generated Windows event. This value can be any string and has to be a registered event source, as shown in the following example:

<PublisherName>ApplicationX</PublisherName>

Note

It is a best practice to use a publisher name that can easily be attributed to the application you are monitoring.

Channel

The Channel parameter contains the Windows event log name that the event appears to originate from, such as the Application or System event log. This value does not have to be a registered event log on the Windows-based computer because the event is being generated only for Operations Manager use.

The following code is an example definition:

<Channel>Application</Channel>

LoggingComputer

The LoggingComputer parameter specifies the computer that the event appears to be generated from. This is usually the computer on which the workflow is executing, and it is commonly a $Target reference.

For example, if the module is being used in a rule that is targeting an instance that is hosted by Windows-based computer, the configuration of this parameter is defined as the following:

<LoggingComputer>$Target/Host/Property[Type='Windows!Microsoft.Windows.Computer']/NetworkName$</LoggingComputer>

EventNumber

The EventNumber parameter contains the ID of the event. Although the schema specifies a string for this parameter, the value should be an integer.

The following code example shows the use of a static value:

<EventNumber>200</EventNumber>

The following code example shows the use of a value from the incoming data item, which is a property bag in this specific example:

<EventNumber>$Data/Property[@Name='EventIDValue']$</EventNumber>

EventCategory

The value of the EventCategory parameter (an integer from 0 to 65535) is an index into a category dynamic-link library (DLL) message table that contains a localized string. Each publisher defines its own set of categories. These categories commonly correspond to individual components (for example: a connector, module host, or data warehouse).

This value can also be set to 0 and ignored.

EventLevel

The EventLevel parameter specifies the severity level of the event. The values defined in the following table are valid.

Value Definition

0

Success

1

Critical

2

Warning

4

Information

8

Success Audit

16

Failure Audit

UserName

The UserName parameter contains the user name of the user that the event appears to be generated from. This element must be present, but it can be empty.

Description

The Description parameter contains the full text description. This value can optionally use parameter substitution from the Params section of the configuration. The full substituted string is stored in the database and is visible in the Operations console.

Important

This text is not localizable.

The following code shows an example static description:

<Description>Application X has a problem</Description>

The following code shows an example that uses two parameters that are substituted into the description:

<Description>Value1 is: %1; Value 2 is %2</Description>

The preceding example requires that you set a minimum of two parameters in the Params configuration value for the mapper module. If you specify a parameter in the description and it is not populated in the parameters element, the description is empty for that parameter.

For more detailed information about escape sequences and parameter substitution, see the FormatMessage Function.

Params

The Params parameter contains the set of event parameters used to simulate a parameterized event. These parameters can be used to build the description of the event if required. This element is optional, but if it is used, it should contain at least one Param element. For more information about the Params element, see ParamListType.

Composition

The System.Event.GenericDataMapper module is a native module.

None.

External Module References

The System.Event.GenericDataMapper module is a member of the public module described in the following table.

Module Type Library Usage

Microsoft.Windows.WmiProvider.FilteredEventProvider

Microsoft.Windows.Library

Queries a WMI namespace at a scheduled frequency and returns the filtered results as System.Event.Data type data.

Sample

The following XML sample shows how you can use the System.Event.GenericDataMapper module in a DataSourceModuleType element definition. The mapper module is used to convert WMI object data into event data.

<DataSourceModuleType ID="Microsoft.Windows.WmiProvider.FilteredEventProvider" Accessibility="Public">
  <Configuration>
    <IncludeSchemaTypes>
      <SchemaType>System!System.ExpressionEvaluatorSchema</SchemaType>
    </IncludeSchemaTypes>
    <xsd:element name="NameSpace" type="xsd:string" />
    <xsd:element name="Query" type="xsd:string" />
    <xsd:element name="Frequency" type="xsd:integer" />
    <xsd:element name="Expression" type="ExpressionType" />
  </Configuration>
  <OverrideableParameters>
    <OverrideableParameter ID="Frequency" Selector="$Config/Frequency$" ParameterType="int" />
  </OverrideableParameters>
  <ModuleImplementation>
    <Composite>
      <MemberModules>
        <DataSource TypeID="Microsoft.Windows.WmiProvider" ID="DataSource">
          <NameSpace>$Config/NameSpace$</NameSpace>
          <Query>$Config/Query$</Query>
          <Frequency>$Config/Frequency$</Frequency>
        </DataSource>
        <ConditionDetection TypeID="System!System.ExpressionFilter" ID="Filter">
          <Expression>$Config/Expression$</Expression>
        </ConditionDetection>
        <ConditionDetection TypeID="System!System.Event.GenericDataMapper" ID="Mapper">
          <EventOriginId>$Target/Id$</EventOriginId>
          <PublisherId>$MPElement$</PublisherId>
          <PublisherName>WmiProvider</PublisherName>
          <Channel>WmiProvider</Channel>
          <LoggingComputer />
          <EventNumber>0</EventNumber>
          <EventCategory>3</EventCategory>
          <EventLevel>0</EventLevel>
          <UserName />
          <Params />
        </ConditionDetection>
      </MemberModules>
      <Composition>
        <Node ID="Mapper">
          <Node ID="Filter">
            <Node ID="DataSource" />
          </Node>
        </Node>
      </Composition>
    </Composite>
  </ModuleImplementation>
  <OutputType>System!System.Event.Data</OutputType>
</DataSourceModuleType>

Information

   

Module Type

ConditionDetectionModuleType

Input Type

System.BaseData

Output Type

System.Event.Data

Implementation

Native

Library

System.Library