System Center operations Manager logo http://www.Oostdam.infoSystem Center Operations Manager 2007 R2 is a great product. It has some difficulties, but doesn't have any products have a problem here and there? Now this article has been made here, for several reasons. First of all, I collected all these errors, installs, hits, tips and warnings for my own personal reference. But, it is always better to share knowledge, so I decided to publish these articles, with a little extra explanation on this site, through these articles. So, I hope this article will help you with your problem as well. Now, this article is not about a specific tric, but a summary of all the Data parameters that can be used in alerts, rules, notifications and custom descriptions. They are sorted by the default area they belong to, but can often be used in related parameters as long as the indexes in the (OpsMgr)(DW)house can make the relation. Due to the fact that most visitors of this page are from a lot of different countries, this article is in the english language. 

If you have any additions to this set of parameters, please be so kind to mail them to me at: ( delete the fat capital "deletethis" characters ). Because monitoring is a continuously changing business, additions are made frequently, and as a human, I cannot follow everything. Thanks in advance, your name will we added underneath this article.

Default Event rule parameters:
EventDisplayNumber (Event ID): $Data/EventDisplayNumber$
EventDescription (Description): $Data/EventDescription$
Publisher Name (Event Source): $Data/PublisherName$
EventCategory: $Data/EventCategory$
EventNumber: $Data/EventNumber$
LoggingComputer: $Data/LoggingComputer$
EventLevel: $Data/EventLevel$
Channel: $Data/Channel$
UserName: $Data/UserName$

Default Event monitor parameters:
EventDisplayNumber (Event ID): $Data/Context/EventDisplayNumber$
EventDescription (Description): $Data/Context/EventDescription$
UserName: $Data/Context/UserName$
EventNumber: $Data/Context/EventNumber$
Publisher Name (Event Source): $Data/Context/PublisherName$
EventCategory: $Data/Context/EventCategory$
LoggingComputer: $Data/Context/LoggingComputer$
EventLevel: $Data/Context/EventLevel$
Channel: $Data/Context/Channel$

Default parameters for repeating Event monitors:
EventDisplayNumber (Event ID): $Data/Context/Context/DataItem/EventDisplayNumber$
EventDescription (Description): $Data/Context/Context/DataItem/EventDescription$
Publisher Name (Event Source): $Data/Context/Context/DataItem/PublisherName$
EventCategory: $Data/Context/Context/DataItem/EventCategory$
UserName: $Data/Context/Context/DataItem/UserName$
EventNumber: $Data/Context/Context/DataItem/EventNumber$
LoggingComputer: $Data/Context/Context/DataItem/LoggingComputer$
EventLevel: $Data/Context/Context/DataItem/EventLevel$
Channel: $Data/Context/Context/DataItem/Channel$

Default performance threshold parameters:
Object (Perf Object Name): $Data/Context/ObjectName$
Counter (Perf Counter Name): $Data/Context/CounterName$
Instance (Perf Instance Name): $Data/Context/InstanceName$
Value (Perf Counter Value): $Data/Context/Value$

Default (windows)services parameters:
Service Name $Data/Context/Property[@Name='Name']$
Service Dependencies $Data/Context/Property[@Name='Dependencies']$
Service Binary Path $Data/Context/Property[@Name='BinaryPathName']$
Service Display Name $Data/Context/Property[@Name='DisplayName']$
Service Description $Data/Context/Property[@Name='Description']$

Default eventlogfile parameters:
Logfile monitor parameter for the logfile Directory : $Data/Context/LogFileDirectory$
Logfile monitor parameter for the logfile name: $Data/Context/LogFileName$
Logfile monitor parameter for the string: $Data/Context/Params/Param[1]$
Logfile rules for the logfile directory : $Data/EventData/DataItem/LogFileDirectory$
Logfile rule for the log name: $Data/EventData/DataItem/LogFileName$
Logfile rule for the specific string: $Data/EventData/DataItem/Params/Param[1]$

Default monitoring parameters:
Notification for the AlertID GUID: $Data/Context/DataItem/AlertId$
Notification for the Alert Name: $Data/Context/DataItem/AlertName$
Notification for the Alert category: $Data/Context/DataItem/Category$
PerformanceHealth, PerformanceCollection, Operations, EventCollection, StateCollection, SoftwareAndUpdates, Alert, System, Custom, AvailabilityHealth, ConfigurationHealth, SecurityHealth, Discovery, NotificationCategory and Maintenance.

Monitoring & Alert Content parameters:
$Data/Context/DataItem/CreatedByMonitor$ True/False
$Data/Context/DataItem/Custom1$ CustomField1
$Data/Context/DataItem/Custom2$ CustomField2
$Data/Context/DataItem/Custom3$ CustomField3
$Data/Context/DataItem/Custom4$ CustomField4
$Data/Context/DataItem/Custom5$ CustomField5
$Data/Context/DataItem/Custom6$ CustomField6
$Data/Context/DataItem/Custom7$ CustomField7
$Data/Context/DataItem/Custom8$ CustomField8
$Data/Context/DataItem/Custom9$ CustomField9
$Data/Context/DataItem/Custom10$ CustomField10
$Data/Context/DataItem/Priority$ The Alert Priority Number (High=1,Medium=2,Low=3)
$Data/Context/DataItem/Owner$ The Alert Owner
$Data/Context/DataItem/RepeatCount$ The Alert Repeat Count
$Data/Context/DataItem/ResolutionState$ Resolution state ID (0=New, 255= Closed)
$Data/Context/DataItem/ResolutionStateLastModified$ UTC Date/Time ResolutionState was last modified
$Data/Context/DataItem/ResolutionStateLastModifiedLocal$ Local Date/Time ResolutionState was last modified
$Data/Context/DataItem/ResolutionStateName$ The Resolution State Name (New, Closed)
$Data/Context/DataItem/ResolvedBy$ Person resolving the alert
$Data/Context/DataItem/Severity$ The Alert Severity ID
$Data/Context/DataItem/TicketId$ The TicketID
$Data/Context/DataItem/DataItemCreateTime$ UTC Date/Time of Dataitem created
$Data/Context/DataItem/DataItemCreateTimeLocal$ LocalTime Date/Time of Dataitem created
$Data/Context/DataItem/LastModified$ UTC Date/Time DataItem was modified
$Data/Context/DataItem/LastModifiedLocal$ Local Date/Time DataItem was modified
$Data/Context/DataItem/ManagedEntity$ ManagedEntity GUID
$Data/Context/DataItem/ManagedEntityDisplayName$ ManagedEntity Display name
$Data/Context/DataItem/ManagedEntityFullName$ ManagedEntity Full name
$Data/Context/DataItem/ManagedEntityPath$ Managed Entity Path
$Data/Context/DataItem/TimeAdded$ UTC Time Added
$Data/Context/DataItem/TimeAddedLocal$ Local Time Added
$Data/Context/DataItem/TimeRaised$ UTC Time Raised
$Data/Context/DataItem/TimeRaisedLocal$ Local Time Raised
$Data/Context/DataItem/TimeResolved$ UTC Date/Time the Alert was resolved
$Data/Context/DataItem/WorkflowId$ The Workflow ID (GUID) $Target/Property[Type=”Notification!Microsoft.SystemCenter.AlertNotificationSubscriptionServer”/WebConsoleUrl$

Console parameters:
( which is actually the principalname of the management server generating the alert )
( which holds the name string of the recipient of the email notification.

Hope that this article will have helped you a bit further............ and looking forward your further input for this list. 
Have fun, using System Center Operation Manager R2!

Ben OostdamBen Oostdam has been working with Windows systems since 1993. Worked for several companies as a system administrator, and is currently a Senior Support Engineer for Qurius Customer Care in the Netherlands, specialized in System Center Solutions.

Disclaimer: The information contained in this website/article is for general information purposes only. The information is provided as is, by Ben Oostdam and others, and while we endeavour to keep the information up to date and correct, we make no representations or warranties of any kind, express or implied, about the completeness, accuracy, reliability, suitability or availability with respect to the website or the information, products, services, or related graphics contained on the website for any purpose. Any reliance you place on such information is therefore strictly at your own risk. In no event will we be liable for any loss or damage including without limitation, indirect or consequential loss or damage, or any loss or damage whatsoever arising from loss of data or profits arising out of, or in connection with, the use of this website. Through this website you are sometimes able to link to other websites which are not under my control. I have no control over the nature, content and availability of those sites. The inclusion of any links does not necessarily imply a recommendation or endorse the views expressed within them. Every effort is made to keep the website up and running smoothly. However, I take no responsibility for, and will not be liable for, the website being temporarily unavailable due to technical issues beyond our control. All entries in these articles, are my individual opinion, or from co-writers, and they don't necessary reflect the opinion of my employer.


Friday the 7th, May 2021. All rights reserved.. // Oostdam WebDesign