SCOM Regular Expression

[M.R.ASHWINPRABHU, INDWAY-IS]

Hi All,

I have been trying to create a rule which will monitor for the following
criteria:
• Full Event Number - Matches regular expression - [1001-1499]
• Event Source - Equals - Health Service Script

And executes a particular script as response which would log again an entry
in the "Health Service Script".

The problem is this rule executes more than once. i.e. Let say my
application has triggered an entry in "Health Service Script" for the
Event-ID: 1003, the response script executes more than once. If instead of
regular expression, if I use static criteria like "equals to - 1003", the
response script executes only once. How I can implement this same behaviour
for regular expression. This same regular express worked in M0M but not in
SCOM.

[M.R.ASHWINPRABHU, INDWAY-IS]

Instead of specifying the regular expression, I have created an OR-expression
for the filter. i.e. My filter expression goes like the following:

And Group
Event Source - Equals - Health Services Script
OR Group
Event ID - Equals - 1001
Event ID - Equals - 1002
Event ID - Equals - 1003
Event ID - Equals - 1004
Event ID - Equals - 1005..

This holds well if the fewer filter range. In my case 1001 -1005. But in the
cause of larger range like 1001-1500, I can't afford to create a filter
expression with OR group, instead I would prefer to use Regular expression.

Though I have regular expression provision in the "Operator" clause, I can't
able to use it as expected.

Cheers
M.R.ASHWINPRABHU
http://www.indway-is.blogspot.com

Full Event Number - Matches regular expression - [1001-1499]

[Bob Lippold]

Thank you, M.R.ASHWINPRABHU. Your method worked for me when I couldn't get regular expressions to fire alerts. My rule configuration was much the same as your was, and allowed me to create an OR group of 20 members... unwieldy, but it worked.

> On Friday, May 16, 2008 9:57 AM MRASHWINPRABHUINDWAYI wrote:

> Hi All,
>
> I have been trying to create a rule which will monitor for the following
> criteria:

> ??? Full Event Number - Matches regular expression - [1001-1499]
> ??? Event Source - Equals - Health Service Script

>
> And executes a particular script as response which would log again an entry
> in the "Health Service Script".
>
> The problem is this rule executes more than once. i.e. Let say my
> application has triggered an entry in "Health Service Script" for the
> Event-ID: 1003, the response script executes more than once. If instead of
> regular expression, if I use static criteria like "equals to - 1003", the
> response script executes only once. How I can implement this same behaviour
> for regular expression. This same regular express worked in M0M but not in
> SCOM.

>> On Wednesday, May 21, 2008 7:54 AM MRASHWINPRABHUINDWAYI wrote:

>> Instead of specifying the regular expression, I have created an OR-expression
>> for the filter. i.e. My filter expression goes like the following:
>>
>> And Group
>> Event Source - Equals - Health Services Script
>> OR Group
>> Event ID - Equals - 1001
>> Event ID - Equals - 1002
>> Event ID - Equals - 1003
>> Event ID - Equals - 1004
>> Event ID - Equals - 1005..
>>
>> This holds well if the fewer filter range. In my case 1001 -1005. But in the
>> cause of larger range like 1001-1500, I can't afford to create a filter
>> expression with OR group, instead I would prefer to use Regular expression.
>>
>> Though I have regular expression provision in the "Operator" clause, I can't
>> able to use it as expected.
>>
>> Cheers
>> M.R.ASHWINPRABHU
>> http://www.indway-is.blogspot.com
>>
>> Full Event Number - Matches regular expression - [1001-1499]
>>
>>
>> "M.R.ASHWINPRABHU, INDWAY-IS" wrote:

>> Submitted via EggHeadCafe
>> ASP.NET Drawing a chart using OWC11 - Office Web Components
>> http://www.eggheadcafe.com/tutorials/aspnet/601e9bc2-40ed-405e-b1b0-f416046b6698/aspnet-drawing-a-chart-using-owc11--office-web-components.aspx