Event Views
適用於: System Center Operations Manager 2007
Event views provide a listing of events that are collected by rules in the Operations Manager database. Columns in the view can include the value of properties of each event.
Contents
The contents of an event view are determined by the following:
Target
All event views must specify a target class. An event view will list all the events associated with the target class or any classes hosted by the target class. All instances of the target class in the management group will be included unless criteria or a group is specified to limit the instance displayed. All events associated with these objects will be included unless you specify criteria to limit them.
Group
An event view does not require a group. If a group is specified, then only events associated with instances of the target class in the group will be included in the view. Even though the group may contain objects of different classes, only events from instances of the target class are displayed.
Criteria
An event view does not require criteria. If it is provided, criteria allow the included events to be limited according to the values of one or more properties. Criteria is added and configured by starting the external editor from the Authoring console or by using the dialog box in the Operations console. The properties that may be used in criteria are provided in the following table with XML samples.
Condition | Description | Example |
---|---|---|
Rules |
One more rules that collected the event. The value for Rule indicates the specific rule or monitor. If this is selected in the Operations console, it will be the actual GUID. This should be changed to an $MPElement variable to ensure that it moved between management groups. |
|
Event Number |
One or more values matching the number of event. |
|
Source |
The name of the publisher of the event. |
|
Time Generated |
The time that the event was generated. A time range or a relative duration from the current time can be specified. If a relative time is used, then the WithinLast node requires a Unit attribute. The possible values for this attribute are as follows:
|
|
Instance Name |
|
|
Severity Level |
One or more value that match the severity level of the event. Valid values are listed in the following table. |
|
User |
The user name that created the event. |
|
Computer |
Name of the computer that logged the event. |
|
The following table lists the possible values for the severity level criteria:
Value | Description |
---|---|
0 |
Success |
1 |
Error |
2 |
Warning |
4 |
Information |
8 |
Audit Success |
16 |
Audit Failure |
Columns
Each column in an event view is defined by using a ColumnInfo node in the Presentation node of the view. The XML of an example column definition is shown here:
<ColumnInfo Index="0" SortIndex="-1" Width="22" Grouped="false" Sorted="false" IsSortable="true" Visible="true" SortOrder="Ascending">
<Name>Severity</Name>
<Id>Severity</Id>
</ColumnInfo>
The content of each column is determined by its ID value with the title of the column defined by the Name. The possible contents of a state view are identified in the following table:
Column | ID | Description |
---|---|---|
Level |
LevelId |
Severity level of the event |
Date and Time |
TimeGenerated |
Date and time that the event was generated |
Source |
PublisherName |
Publisher name of the event |
Name |
MonitoringObjectDisplayName |
Name of the monitoring object that the event is associated with |
User |
User |
User name that generated the event |
Event Number |
Number |
Number of the event |
Log Name |
Channel |
Name of the log that the event was collected from |
Logging Computer |
LoggingComputer |
Name of the computer that logged the event |
Rule Name |
MonitoringRuleDisplayName |
Name of the rule that collected the event |
The order of the columns can be specified by using the dialog box in the Operations console. This corresponds to the Index attribute in the XML for the column.
If no columns are specified for the view, then by default, the following columns are displayed:
Level
Date and Time
Source
Name
User
Event Number
Log Name
Formatting
The formatting of an event view is accomplished by modifying the attributes of each column definition. This is performed by starting the external editor from the Authoring console or with the dialog box in the Operations console. The different characteristics each column and their corresponding attributes are listed in the following table:
Characteristic | Description |
---|---|
Column Order |
The order of how the columns are positioned can be specified with the Index attribute for the column. This can also be performed by using the Display tab in the Properties dialog box for the view in the Operations console. |
Column Width |
Each column has a width attribute defining the width of the column in pixels. The column width in the dialog box will be used the first time that you open the Operations console. If you change the width in the Operations console, then the new settings will be saved on the local workstation. You cannot guarantee that the column width in the management pack is retained on any workstation. |
Column Visibility |
Each column has a Visible attribute that defines whether the column will be visible in the Operations console. If a column should not be displayed, then it should still be included in the view by using the Visible attribute set to false. If the column is not included in the view, then it is not available as an option for the user to add it to the view in the Operations console. For this reason, all columns are typically included in the view with the visibility of the columns that should not be displayed set to false. |
Sorting |
The events listed in an event view can be sorted by any of the included columns. The sorting configuration in the dialog box will be used the first time that you open the Operations console. If you change the sort order in the Operations console, then the new settings will be saved on the local workstation. There is no way to guarantee that the sort order in the management pack is retained on any workstation. The dialog box in the Operations console allows for the view to be sorted by a single column. Sorting may be performed on multiple columns by modifying the XML of the view. This is performed by changing the value of the Sorted attribute of the column entry to true. The SortIndex attribute defines the order that the columns will be sorted, and its value must be changed to a value of 0 or more. The SortOrder attribute must be either Ascending or Descending depending on the desired sort order for the column. |
Grouping |
Event views can be grouped by any of the included columns. The Operations console dialog box allows for up to three fields that you can use for grouping, but any number may be used when you edit the XML. To use a column for grouping, change the value of its Grouped attribute to true. The SortIndex attribute is used to determine the order for the grouping of multiple columns and must be changed to a value larger than 0. |