Data Sources


Updated: May 13, 2016

Applies To: System Center 2012 R2 Operations Manager, System Center 2012 - Operations Manager, System Center 2012 SP1 - Operations Manager

Monitors and rules in Operations Manager each start with a data source which defines where it will get the data to evaluate or collect. The first decision to make when you are defining a rule or monitor is the data source that it will use. The most straightforward method to answer this question is to determine where the information is that you want to collect or that indicates the condition you want to detect.

For example, an application may create an event in the Windows Event Log when a particular error occurs. You could create a rule that watches for this particular event and generates an alert when it detects one. If detection of the event is not possible through an event, a log, or a performance counter, then you may need to run a script on a periodic basis to retrieve the required information.

The same set of data sources is available for both monitors and rules as shown in the table below.


Data Source


Event Monitors and Rules

Windows Events

Events in the Windows event log matching specified criteria.

Text Logs

Text log file that has a single line per entry.

WMI Events

Events created by Windows Management Instrumentation (WMI).

SNMP Events

Traps sent from an SNMP device.

Syslog Events

Events from Unix systems and other devices.

Performance Monitors and Rules

Windows Performance Collection Rules

Monitor a threshold or collect a performance value from Windows.

WMI Performance

Monitor a threshold or collect a performance value from a WMI query.

Script Monitors and Rules

Script Monitors

Monitor a value from a script that runs on a schedule.

Script Collection Rules

Collect events or performance data from a script that runs on a schedule.