Script Generated Event Collection – the proper way to use

I want to share my experience on using the Microsoft.Windows.TimedScript.EventProvider data source module type (https://msdn.microsoft.com/en-us/library/jj130481.aspx).

I will suggest here a simplification of the sample provided in the online documentation, just to quickly illustrate the symptom.

Here is the code for a rule that should start collecting script generated events capturing in the Description the current date and time.

<Rule ID="TestingScriptGeneratedEventCollection" Enabled="true" Target="SC!Microsoft.SystemCenter.RootManagementServer" ConfirmDelivery="false" Remotable="true" Priority="Normal" DiscardLevel="100">
        <Category>EventCollection</Category>
        <DataSources>
          <DataSource ID="DS" TypeID="Windows!Microsoft.Windows.TimedScript.EventProvider">
            <IntervalSeconds>300</IntervalSeconds>
            <SyncTime />
            <ScriptName>TestingScriptGeneratedEventCollection.vbs</ScriptName>
            <Arguments />
            <ScriptBody>
              <![CDATA[ Dim oAPI, oBag Set oAPI = CreateObject("MOM.ScriptAPI") Set oBag = oAPI.CreatePropertyBag() Call oBag.AddValue("Description",CStr(Now())) Call oAPI.Return(oBag) ]]>
            </ScriptBody>
            <TimeoutSeconds>10</TimeoutSeconds>
            <EventOriginId>$MPElement$</EventOriginId>
            <PublisherId>$MPElement$</PublisherId>
            <PublisherName>TimedScript.EventProvider</PublisherName>
            <Channel></Channel>
            <LoggingComputer>$Target/Host/Property[Type="Windows!Microsoft.Windows.Computer"]/NetworkName$</LoggingComputer>
            <EventNumber>1001</EventNumber>
            <EventCategory>1</EventCategory>
            <EventLevel>2</EventLevel>
            <UserName />
            <Description>$Data/Property[@Name="Description"]$</Description>
            <Params></Params>
          </DataSource>
        </DataSources>
        <WriteActions>
          <WriteAction ID="WriteToDB" TypeID="SC!Microsoft.SystemCenter.CollectEvent" />
          <!--<WriteAction ID="WriteToDW" TypeID="SCDW!Microsoft.SystemCenter.DataWarehouse.PublishEventData" />-->
        </WriteActions>
</Rule>

As you can see the Description property bag value goes directly into Description of the Event.

The result of this configuration is weird: either using an Event View in the OpsMgr console or by querying events using OM PowerShell you will notice that all the events have same description, despite the fact that Event Data is correct.

More precisely the Description will be the value for the last execution, updated for all events!

ev1

So here is the proper way to use this module:

<Rule ID="TestingScriptGeneratedEventCollection" Enabled="true" Target="SC!Microsoft.SystemCenter.RootManagementServer" ConfirmDelivery="false" Remotable="true" Priority="Normal" DiscardLevel="100">
        <Category>EventCollection</Category>
        <DataSources>
          <DataSource ID="DS" TypeID="Windows!Microsoft.Windows.TimedScript.EventProvider">
            <IntervalSeconds>300</IntervalSeconds>
            <SyncTime />
            <ScriptName>TestingScriptGeneratedEventCollection.vbs</ScriptName>
            <Arguments />
            <ScriptBody>
              <![CDATA[ Dim oAPI, oBag Set oAPI = CreateObject("MOM.ScriptAPI") Set oBag = oAPI.CreatePropertyBag() Call oBag.AddValue("Description",CStr(Now())) Call oAPI.Return(oBag) ]]>
            </ScriptBody>
            <TimeoutSeconds>10</TimeoutSeconds>
            <EventOriginId>$MPElement$</EventOriginId>
            <PublisherId>$MPElement$</PublisherId>
            <PublisherName>TimedScript.EventProvider</PublisherName>
            <Channel></Channel>
            <LoggingComputer>$Target/Host/Property[Type="Windows!Microsoft.Windows.Computer"]/NetworkName$</LoggingComputer>
            <EventNumber>1001</EventNumber>
            <EventCategory>1</EventCategory>
            <EventLevel>2</EventLevel>
            <UserName />
            <Description>%1</Description>
            <Params>
              <Param>$Data/Property[@Name="Description"]$</Param>
            </Params>
          </DataSource>
        </DataSources>
        <WriteActions>
          <WriteAction ID="WriteToDB" TypeID="SC!Microsoft.SystemCenter.CollectEvent" />
          <WriteAction ID="WriteToDW" TypeID="SCDW!Microsoft.SystemCenter.DataWarehouse.PublishEventData" />
        </WriteActions>
</Rule>

Please note making use of Parameters and then inserting Param into Description.

With the changes above everything looks back to normal.

ev2

Advertisements

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s

%d bloggers like this: