Event Trigger Question for Uptime report

[Cheerfull38]

Is there a way to setup a event based trigger to pull the information out of
the description field. This is the event that is generated everyday at noon.
And I want to read this logfile and set a alert if it exceeds a certain time
limit.

For example:

Event Type: Information
Event Source: EventLog
Event Category: None
Event ID: 6013
Date: 10/17/2008
Time: 12:00:00 PM
User: N/A
Computer: JDOSOMDB01
Description:
The system uptime is 167676 seconds.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
Data:

I would like to trigger an event on the below information for server uptime
over a specific amount of time say server exceeds 300000 Mins of uptime and
need to trigger a alert telling the sys admins that the server has not
rebooting within the period of time above. Is the something that can be
accomplished with SCOM 2007? If so how? Or could someone point me in right
direction on how i can do this.

Thanks
TJ

[Pete Zerger]

Hello Cheerfull38,

It involves a custom script about any way you consider it.

You'd have to use a custom script to parse the description in that event.
Given that the event looks very much the same every time, it would not be
difficult to pull the number out and make the comparison you standard VB
string functions( right(), instr() etc).

The other alternative would be to use what would be a slightly more complicated
script using WMI and the LastBootTime property of the Win32_OperatingSystem
class. Would not recommend bringing WMI into the equation.

With a custom script in a timed script rule or a 2-state monitor, you could
raise an alert if the number exceeded a certain value.

Regards,

Pete Zerger, MCSE(Messaging) | MCTS(SQL 2005) | MCTS(Opsmgr) | MVP - Opsmgr
URL:http://www.systemcenterforum.org
User Group: http://www.systemcenterusergroup.com
MP Catalog: http://www.systemcenterforum.org/mps
Tools: http://www.systemcenterforum.org/tools/

[Robert]

Create a workflow based on a Windows Event.

When specifying the Expression use EventID, Event Source and Parameter 5. Parameter 5 is the number of seconds specified in the event description.

Once you have created the workflow you will need to modify the XML. By default the expression is evaluated as a string, this needs to be changed to a number so that it is evaluated numerically.

Sample:
<Expression>
<SimpleExpression>
<ValueExpression>
<XPathQuery Type="Double">Params/Param[5}</XPathQuery>
</ValueExpression>
<Operator>Greater</Operator>
<ValueExpression>
<Value Type="Double">86400</Value>
</ValueExpression>
</SimpleExpression>
</Expression>

Cheerfull3 wrote:

Event Trigger Question for Uptime report
17-Oct-08

For example:

Thanks
TJ

Previous Posts In This Thread:

On Friday, October 17, 2008 5:23 PM
Cheerfull3 wrote:

Event Trigger Question for Uptime report

For example:

Thanks
TJ

On Saturday, October 18, 2008 9:28 AM
Pete Zerger (MVP) wrote:

Hello Cheerfull38,It involves a custom script about any way you consider it.
Hello Cheerfull38,

It involves a custom script about any way you consider it.

You'd have to use a custom script to parse the description in that event.
Given that the event looks very much the same every time, it would not be
difficult to pull the number out and make the comparison you standard VB
string functions( right(), instr() etc).

The other alternative would be to use what would be a slightly more complicated
script using WMI and the LastBootTime property of the Win32_OperatingSystem
class. Would not recommend bringing WMI into the equation.

With a custom script in a timed script rule or a 2-state monitor, you could
raise an alert if the number exceeded a certain value.

Regards,

Pete Zerger, MCSE(Messaging) | MCTS(SQL 2005) | MCTS(Opsmgr) | MVP - Opsmgr
URL:http://www.systemcenterforum.org
User Group: http://www.systemcenterusergroup.com
MP Catalog: http://www.systemcenterforum.org/mps
Tools: http://www.systemcenterforum.org/tools/

Submitted via EggHeadCafe - Software Developer Portal of Choice
Overriding Deserialization of Persisted Workflow Instances
http://www.eggheadcafe.com/tutorials/aspnet/40fe2b27-ef79-45d0-82e1-6eca3ed67df8/overriding-deserialization-of-persisted-workflow-instances.aspx