Event Reports

Applies To: System Center Operations Manager 2007

Event reports in Operations Manager 2007 access events that are collected by rules. Following is a description of each Event generic report that includes a description of its report controls and report parameters. The parameter block of each report that can be copied into the definition of a linked report is also included.

Event Analysis

This report shows a table of events and a count by server filtered by all entered parameters.

The ID of the Event Analysis report is Microsoft.SystemCenter.DataWarehouse.Report.EventAnalysis.

Controls and Parameters

The controls that are used in the Event Analysis report are shown in the following table with the parameters that each populates.

Control Control Description

Relative Date Time Picker

StartDate_BaseType

StartDate_BaseValue

StartDate_OffsetType

StartDate_OffsetValue

EndDate_BaseType

EndDate_BaseValue

EndDate_OffsetType

EndDate_OffsetValue

TimeZone

TimeZoneName

All events that were created in the date and time range are included in the report. These are the standard date parameters described in Common Parameters.

This control can be removed if a defined relative data time range is provided for the parameter.

Monitoring Object XML Picker

ObjectList

ManagementGroupId

Specifies the groups or objects that are included in the report. This includes an ID from the data warehouse so that the parameters cannot be populated without the control. This is the standard Object XML Picker control described in Common Report Controls.

This control should not be removed from the report.

Combo Box

Event Source

Specifies the event source. The valid values are described in Event Parameters. Leave blank for all.

This control can be removed from the report if one or more specific event source values are provided for the parameter.

Combo Box

Event Type

Specifies the event type. The valid values are described in Event Parameters. Leave blank for all.

This control can be removed from the report if one or more specific event type values are provided for the parameter.

Combo Box

Event Category

Specifies the event category. The valid values are described in Event Parameters. Leave blank for all.

This control can be removed from the report if one or more specific event category values are provided for the parameter.

Numeric Up Down

Event ID

Specifies the event ID. Leave blank for all.

This control can be removed from the report if one or more specific event ID values are provided for the parameter.

Parameter Block

The following is the parameter block for the Event Analysis report. You can copy it into a linked report based on the Event Analysis report to replicate the controls of the base report.

<ParameterBlock columns="6" xmlns="https://schemas.microsoft.com/mom/reporting/2007/ReportParameterSettings">
   <Controls>
      <Control rowSpan="4" columnSpan="2" type="Microsoft.SystemCenter.DataWarehouse.Report.ParameterControl.RelativeDateTimePicker">
         <ReportParameters>
            <ReportParameter name="TimeZone" binding="TimeZone">
               <Prompt>Microsoft.SystemCenter.DataWarehouse.Report.Library!Microsoft.SystemCenter.DataWarehouse.Report.ParameterPrompt.TimeZone</Prompt>
            </ReportParameter>
            <ReportParameter name="TimeZoneName" binding="TimeZoneName" />
            <ReportParameter name="StartDate_BaseType" binding="StartDate_BaseType" />
            <ReportParameter name="StartDate_BaseValue" binding="StartDate_BaseValue">
               <Prompt>Microsoft.SystemCenter.DataWarehouse.Report.Library!Microsoft.SystemCenter.DataWarehouse.Report.ParameterPrompt.StartDateTime</Prompt>
            </ReportParameter>
            <ReportParameter name="StartDate_OffsetType" binding="StartDate_OffsetType" />
            <ReportParameter name="StartDate_OffsetValue" binding="StartDate_OffsetValue" />
            <ReportParameter name="EndDate_BaseType" binding="EndDate_BaseType" />
            <ReportParameter name="EndDate_BaseValue" binding="EndDate_BaseValue">
               <Prompt>Microsoft.SystemCenter.DataWarehouse.Report.Library!Microsoft.SystemCenter.DataWarehouse.Report.ParameterPrompt.EndDateTime</Prompt>
            </ReportParameter>
            <ReportParameter name="EndDate_OffsetType" binding="EndDate_OffsetType" />
            <ReportParameter name="EndDate_OffsetValue" binding="EndDate_OffsetValue" />
         </ReportParameters>
      </Control>
      <Control rowSpan="4" columnSpan="3" type="Microsoft.SystemCenter.DataWarehouse.Report.ParameterControl.MonitoringObjectXmlPicker">
         <ReportParameters>
            <ReportParameter name="ObjectList">
               <Prompt>Microsoft.SystemCenter.DataWarehouse.Report.Library!Microsoft.SystemCenter.DataWarehouse.Report.ParameterPrompt.ObjectList</Prompt>
            </ReportParameter>
            <ReportParameter name="ManagementGroupId" binding="GroupList" />
         </ReportParameters>
      </Control>
      <Control rowSpan="1" columnSpan="1" type="Microsoft.SystemCenter.DataWarehouse.Report.ParameterControl.ComboBox">
         <ReportParameters>
            <ReportParameter name="EventSource">
               <Prompt>Microsoft.SystemCenter.DataWarehouse.Report.Library!Microsoft.SystemCenter.DataWarehouse.Report.ParameterPrompt.EventSource</Prompt>
            </ReportParameter>
            <ReportParameter name="EventSourceLookup" binding="Lookup" />
         </ReportParameters>
      </Control>
      <Control rowSpan="1" columnSpan="2" type="Microsoft.SystemCenter.DataWarehouse.Report.ParameterControl.ComboBox">
         <ReportParameters>
            <ReportParameter name="EventType">
               <Prompt>Microsoft.SystemCenter.DataWarehouse.Report.Library!Microsoft.SystemCenter.DataWarehouse.Report.ParameterPrompt.EventType</Prompt>
            </ReportParameter>
         </ReportParameters>
      </Control>
      <Control rowSpan="1" columnSpan="1" type="Microsoft.SystemCenter.DataWarehouse.Report.ParameterControl.ComboBox">
         <ReportParameters>
            <ReportParameter name="EventCategory">
               <Prompt>Microsoft.SystemCenter.DataWarehouse.Report.Library!Microsoft.SystemCenter.DataWarehouse.Report.ParameterPrompt.EventCategory</Prompt>
            </ReportParameter>
         </ReportParameters>
      </Control>
      <Control rowSpan="1" columnSpan="1" type="Microsoft.SystemCenter.DataWarehouse.Report.ParameterControl.NumericUpDown">
         <ReportParameters>
            <ReportParameter name="EventID">
               <Prompt>Microsoft.SystemCenter.DataWarehouse.Report.Library!Microsoft.SystemCenter.DataWarehouse.Report.ParameterPrompt.EventID</Prompt>
            </ReportParameter>
         </ReportParameters>
      </Control>
   </Controls>
</ParameterBlock>

Custom Event

The Custom Event report includes collected events containing specific information. The list of event details is defined by the rules collecting the events. By selecting the check box, you can select to print a detail of the event on the report. The controls to the right allow for defining the order of the selected items from left (higher in the parameter list) to right (lower in the parameter list).

The ID of the Custom Event report is Microsoft.SystemCenter.DataWarehouse.Report.EventTemplate.

Controls and Parameters

The controls that are used in the Custom Event report are shown in the following table with the parameters that each populates.

Control Parameters Description

Relative Date Time Picker

StartDate_BaseType

StartDate_BaseValue

StartDate_OffsetType

StartDate_OffsetValue

EndDate_BaseType

EndDate_BaseValue

EndDate_OffsetType

EndDate_OffsetValue

TimeZone

TimeZoneName

All events that were created in the date and time range are included in the report. These are the standard date parameters described in Common Parameters.

This control can be removed if a defined relative data time range is provided for the parameter.

Object Picker

ObjectList

ManagementGroupId

Specifies the groups or objects that are included in the report. This includes an ID from the data warehouse so that the parameters cannot be populated without the control. This is the standard Object XML Picker control described in Common Report Controls.

This control should not be removed from the report.

Report Column Picker

Columns

Specifies the columns to be included in the output of the report and the columns that are used to filter the returned data. This is described in more detail later in this section.

This control can be removed if a set of column definitions is provided for this parameter.

Columns Parameter

The Columns parameter defines the columns to include in the output of the report and the columns that are used to filter the output. The table below lists the values that are required to define each column:

ID Element

Element that defines the ID of the property. If the Operations console is used, this will be the GUID of the property. This must be changed to an $MPElement variable so that the management pack can be transferred between management groups.

Visible Attribute

Attribute with a value of True or False specifying whether the column should be displayed. If the value is False, it is expected that the column is only used to filter the output.

Filter Element

If used, this element identifies the column as being used for filtering the output. The Type attribute can be either Contains or Equals, and the content of the element includes the text to match.

If the column should only be displayed and not used for filtering, the filter element is not included.

All properties are included as a single parameter entry using the syntax shown in the following example. This example shows a report that uses the following details:

  • Displays the columns EventDisplayNumber, DateTime, and EventPublisherName.

  • Only includes events with a level of Error and a Publisher Name of Health Service.

<Data>
   <Columns>
      <Column Visible="False">
         <ID>EventLevelTitle</ID>
         <Filter Type="Equals">Error</Filter>
      </Column>
      <Column Visible="True">
         <ID>EventDisplayNumber</ID>
      </Column>
      <Column Visible="True">
         <ID>DateTime</ID>
      </Column>
      <Column Visible="True">
         <ID>EventPublisherName</ID>
         <Filter Type="Contains">Health Service</Filter>
   </Column>
   </Columns>
</Data>

Parameter Block

The following is the parameter block for the Custom Event report. You can copy it into a linked report based on the Custom Event report to replicate the controls of the base report.

<ParameterBlock columns="7" xmlns="https://schemas.microsoft.com/mom/reporting/2007/ReportParameterSettings">
   <Controls>
      <Control rowSpan="4" columnSpan="2" type="Microsoft.SystemCenter.DataWarehouse.Report.ParameterControl.RelativeDateTimePicker">
         <ReportParameters>
            <ReportParameter name="TimeZone" binding="TimeZone">
               <Prompt>Microsoft.SystemCenter.DataWarehouse.Report.Library!Microsoft.SystemCenter.DataWarehouse.Report.ParameterPrompt.TimeZone</Prompt>
            </ReportParameter>
            <ReportParameter name="TimeZoneName" binding="TimeZoneName" />
            <ReportParameter name="StartDate_BaseType" binding="StartDate_BaseType" />
            <ReportParameter name="StartDate_BaseValue" binding="StartDate_BaseValue">
               <Prompt>Microsoft.SystemCenter.DataWarehouse.Report.Library!Microsoft.SystemCenter.DataWarehouse.Report.ParameterPrompt.StartDateTime</Prompt>
            </ReportParameter>
            <ReportParameter name="StartDate_OffsetType" binding="StartDate_OffsetType" />
            <ReportParameter name="StartDate_OffsetValue" binding="StartDate_OffsetValue" />
            <ReportParameter name="EndDate_BaseType" binding="EndDate_BaseType" />
            <ReportParameter name="EndDate_BaseValue" binding="EndDate_BaseValue">
               <Prompt>Microsoft.SystemCenter.DataWarehouse.Report.Library!Microsoft.SystemCenter.DataWarehouse.Report.ParameterPrompt.EndDateTime</Prompt>
            </ReportParameter>
            <ReportParameter name="EndDate_OffsetType" binding="EndDate_OffsetType" />
            <ReportParameter name="EndDate_OffsetValue" binding="EndDate_OffsetValue" />
         </ReportParameters>
      </Control>
      <Control rowSpan="4" columnSpan="3" type="Microsoft.SystemCenter.DataWarehouse.Report.ParameterControl.MonitoringObjectXmlPicker">
         <ReportParameters>
            <ReportParameter name="ObjectList">
               <Prompt>Microsoft.SystemCenter.DataWarehouse.Report.Library!Microsoft.SystemCenter.DataWarehouse.Report.ParameterPrompt.ObjectList</Prompt>
            </ReportParameter>
            <ReportParameter name="ManagementGroupId" binding="GroupList" />
         </ReportParameters>
      </Control>
      <Control columnSpan="2" rowSpan="4" type="Microsoft.SystemCenter.DataWarehouse.Report.ParameterControl.ReportColumnPicker">
         <ReportParameters>
            <ReportParameter name="Columns" />
            <ReportParameter name="ColumnList" binding="ColumnList" />
         </ReportParameters>
      </Control>
   </Controls>
</ParameterBlock>

Most Common Events

The Most Common Events report helps identify high-volume events, the agent they originated from, and the volume that a distinct event contributes to the total number of events. This report helps tune events.

The ID of the Most Common Events report is Microsoft.SystemCenter.DataWarehouse.Report.MostCommonEvents.

Controls and Parameters

The controls that are used in the Most Common Events report are shown in the following table with the parameters that each populates.

Control Parameters Description

Relative Date Time Picker

StartDate_BaseType

StartDate_BaseValue

StartDate_OffsetType

StartDate_OffsetValue

EndDate_BaseType

EndDate_BaseValue

EndDate_OffsetType

EndDate_OffsetValue

TimeZone

TimeZoneName

All events that were created in the date and time range are included in the report. These are the standard date parameters described in Common Parameters.

This control can be removed if a defined relative data time range is provided for the parameter.

Object Picker

ObjectList

ManagementGroupId

Specifies the groups or objects that are included in the report. This includes an ID from the data warehouse so that the parameters cannot be populated without the control. This is the standard Object XML Picker control described in Common Report Controls.

This control should not be removed from the report.

Checked List Box

EventChannel

Specifies ene or more values indicating the event channel.

Checked List Box

EventSource

Specifies one or more values for the event source. The valid values are described in Event Parameters.

This control can be removed from the report if one or more specific event source values are provided for the parameter.

Checked List Box

EventType

Specifies one or more values for the event type. The valid values are described in Event Parameters. Leave blank for all.

This control can be removed from the report if one or more specific event type values are provided for the parameter.

Numeric Up Down

EventThreshold

Specifies the number of events to include in the report. This is any numeric value between 1 and 100.

Parameter Block

The following is the parameter block for the Most Common Events report. You can copy it into a linked report based on the Most Common Events report to replicate the controls of the base report.

<ParameterBlock columns="8" xmlns="https://schemas.microsoft.com/mom/reporting/2007/ReportParameterSettings">
   <Controls>
      <Control rowSpan="3" columnSpan="2" type="Microsoft.SystemCenter.DataWarehouse.Report.ParameterControl.RelativeDateTimePicker">
         <ReportParameters>
            <ReportParameter name="TimeZone" binding="TimeZone">
               <Prompt>Microsoft.SystemCenter.DataWarehouse.Report.Library!Microsoft.SystemCenter.DataWarehouse.Report.ParameterPrompt.TimeZone</Prompt>
            </ReportParameter>
            <ReportParameter name="TimeZoneName" binding="TimeZoneName" />
            <ReportParameter name="StartDate_BaseType" binding="StartDate_BaseType" />
            <ReportParameter name="StartDate_BaseValue" binding="StartDate_BaseValue">
               <Prompt>Microsoft.SystemCenter.DataWarehouse.Report.Library!Microsoft.SystemCenter.DataWarehouse.Report.ParameterPrompt.StartDateTime</Prompt>
            </ReportParameter>
            <ReportParameter name="StartDate_OffsetType" binding="StartDate_OffsetType" />
            <ReportParameter name="StartDate_OffsetValue" binding="StartDate_OffsetValue" />
            <ReportParameter name="EndDate_BaseType" binding="EndDate_BaseType" />
            <ReportParameter name="EndDate_BaseValue" binding="EndDate_BaseValue">
               <Prompt>Microsoft.SystemCenter.DataWarehouse.Report.Library!Microsoft.SystemCenter.DataWarehouse.Report.ParameterPrompt.EndDateTime</Prompt>
            </ReportParameter>
            <ReportParameter name="EndDate_OffsetType" binding="EndDate_OffsetType" />
            <ReportParameter name="EndDate_OffsetValue" binding="EndDate_OffsetValue" />
         </ReportParameters>
      </Control>
      <Control rowSpan="4" columnSpan="3" type="Microsoft.SystemCenter.DataWarehouse.Report.ParameterControl.MonitoringObjectXmlPicker">
         <ReportParameters>
            <ReportParameter name="ObjectList">
               <Prompt>Microsoft.SystemCenter.DataWarehouse.Report.Library!Microsoft.SystemCenter.DataWarehouse.Report.ParameterPrompt.ObjectList</Prompt>
            </ReportParameter>
            <ReportParameter name="ManagementGroupId" binding="GroupList" />
         </ReportParameters>
      </Control>
      <Control rowSpan="4" columnSpan="1" type="Microsoft.SystemCenter.DataWarehouse.Report.ParameterControl.CheckedListBox">
         <ReportParameters>
            <ReportParameter name="EventChannel">
               <Prompt>Microsoft.SystemCenter.DataWarehouse.Report.Library!Microsoft.SystemCenter.DataWarehouse.Report.ParameterPrompt.EventChannel</Prompt>
            </ReportParameter>
         </ReportParameters>
      </Control>
      <Control rowSpan="4" columnSpan="1" type="Microsoft.SystemCenter.DataWarehouse.Report.ParameterControl.CheckedListBox">
         <ReportParameters>
            <ReportParameter name="EventSource">
               <Prompt>Microsoft.SystemCenter.DataWarehouse.Report.Library!Microsoft.SystemCenter.DataWarehouse.Report.ParameterPrompt.EventSource</Prompt>
            </ReportParameter>
         </ReportParameters>
      </Control>
      <Control rowSpan="4" columnSpan="1" type="Microsoft.SystemCenter.DataWarehouse.Report.ParameterControl.CheckedListBox">
         <ReportParameters>
            <ReportParameter name="EventType">
               <Prompt>Microsoft.SystemCenter.DataWarehouse.Report.Library!Microsoft.SystemCenter.DataWarehouse.Report.ParameterPrompt.EventType</Prompt>
            </ReportParameter>
         </ReportParameters>
      </Control>
      <Control rowSpan="1" columnSpan="2" type="Microsoft.SystemCenter.DataWarehouse.Report.ParameterControl.NumericUpDown">
         <ReportParameters>
            <ReportParameter name="EventThreshold">
               <Prompt>Microsoft.SystemCenter.DataWarehouse.Report.Library!Microsoft.SystemCenter.DataWarehouse.Report.ParameterPrompt.TopAlgorithmParameter</Prompt>
            </ReportParameter>
         </ReportParameters>
            <Properties>
               <Property name="Minimum">
               <Value>1</Value>
                </Property>
               <Property name="Maximum">
            <Value>100</Value>
               </Property>
            </Properties>
      </Control>
   </Controls>
</ParameterBlock>

See Also

Concepts

Common Parameters
Event Parameters
Common Report Controls
Date Report Controls