Share via


Applies To: Operations Manager 2007 R2

The Microsoft.Windows.EventProvider data source module type provides filtered Windows event data of type Microsoft.Windows.EventData from any event log on a Windows-based computer.


Use this module in rules that collect events or alert on events from the Windows event logs.

Type Definition

<DataSourceModuleType ID="Microsoft.Windows.EventProvider" Accessibility="Public">
    <xsd:element name="ComputerName" type="ComputerNameType" minOccurs="0" maxOccurs="1" />
    <xsd:element name="LogName" type="xsd:string" />
    <xsd:element name="AllowProxying" type="xsd:boolean" minOccurs="0" maxOccurs="1" />
    <xsd:element name="Expression" type="ExpressionType" />
        <DataSource TypeID="Microsoft.Windows.BaseEventProvider" ID="Provider">
        <ConditionDetection TypeID="System!System.ExpressionFilter" ID="Filter">
        <Node ID="Filter">
          <Node ID="Provider" />


The Microsoft.Windows.EventProvider module supports the following configuration parameters:

Parameter Type Description



Optional. Specifies the name of the computer to receive events from.



Contains the name of the Windows event log to receive events from.



Optional. Specifies whether the module should collect events that do not originate from the computer that is specified in the ComputerName parameter. The default value is false if this parameter is not specified.



Contains the filter expression to apply to the events from the event log.


The ComputerName parameter is most commonly passed to the module by using the $Target notation, although it can be specified as any string. This module attempts to connect either to the local computer’s event log or to a remove event log, depending on the configuration passed.

For a workflow that is targeted at Windows Computer, the ComputerName element is specified as shown in the following code:


If the target is a class hosted by computer hosting, references are added as required. For example:


The ComputerName parameter is optional, but as a best practice, it should be specified.

The ComputerName parameter must be specified if the workflow that is being used is run for agentless computers or for virtual computers running on a Windows cluster. If the parameter is not specified, the module runs against the local event log of the computer that is executing the workflow; this works for agent monitoring scenarios but not for agentless monitoring scenarios.

If you omit this parameter, ensure that the rule or monitor has the Remotable attribute marked as false to prevent agentless execution, because the incorrect event log is used if the computer name is not specified. Omitting this parameter also prevents running against a virtual computer that is running on a Windows cluster.


The LogName is the name of the event log to read event from. A single instance of the module can read only from a single event log, although if required it can be combined with other modules to read and correlate between multiple event logs. An example configuration is:



By default, the event provider module reads only events that are generated by the computer that is being monitored. It is possible for another computer to log an event to the monitored computer’s event log; in this case, the event is logged using the name of the computer logging the event.

If AllowProxying is set to true, events generated from computers other than the computer being monitored are generated by the module. If AllowProxying is set to false, only locally generated events are collected.

Unless there is a specific reason to enable this for your specific monitoring scenario, it is recommended that you set AllowProxyingto false or omit this setting.

The following code is an example configuration:


For more information about the Expression configuration parameter, see ExpressionType


The Microsoft.Windows.WmiProvider.EventProvider module is a composite module that contains the following member modules:

Workflow Run Order Module Type Usage



Native data source module that retrieves windows event data of type Microsoft.Windows.EventData from any event log on a Windows-based computer.



Filters the incoming Microsoft.Windows.EventData with the specified expression.

Module Type Usage


Provides the same functionality as the Microsoft.Windows.EventProvider module type except it defines the AllowProxying parameter as overrideable. Use for event collection when you want to allow the user to be able to override AllowProxying.

External Module References



The following code shows an example of an event collection rule using the Microsoft.Windows.EventProvider module type. In this example, the rule looks for an event from the EventCreate source with an event ID of 101 and with a specific instance property in parameter 1. This event is then written to the Operations database and the data warehouse.

<Rule ID="Microsoft.Samples.CollectEvent101" Target="Microsoft.Samples.ApplicationX">
    <DataSource ID="DS" TypeID="Windows!Microsoft.Windows.EventProvider">
                <XPathQuery Type="String">PublisherName</XPathQuery>
                <Value Type="String">EventCreate</Value>
                <XPathQuery Type="UnsignedInteger">EventDisplayNumber</XPathQuery>
                <Value Type="UnsignedInteger">101</Value>
                <XPathQuery Type="String">Params/Param[1]</XPathQuery>
                <Value Type="String">$Target/Property[Type="Microsoft.Samples.ApplicationX"]/ServiceName$</Value>
    <WriteAction ID="WriteToDB" TypeID="SC!Microsoft.SystemCenter.CollectEvent"/>
    <WriteAction ID="WriteToDW" TypeID="SCDW!Microsoft.SystemCenter.DataWarehouse.PublishEventData"/>



Module Type


Input Type


Output Type