Can Alert Names contain dynamic data?

Disclaimer: Dynamic data in the Alert Name is not supported by Microsoft nor the Product Group. This post is to show what is possible, and the potential drawbacks. Regardless, like many customizations possible in SCOM, it does not mean they are supported or recommended by Microsoft. Additionally, this will not work for all Alert/Rule/Monitor types.

———————-

It works the same way that we display resolved dataitems in the workflow, into the alert description. For instance, here is an alert description that uses many resolved dataitems from the workflow:

What this does in the XML – is define each DataItem as an Alert parameter in the Alert write action:

<WriteAction ID="Alert" TypeID="Health!System.Health.GenerateAlert"> 
<Priority>1</Priority> 
<Severity>1</Severity> 
<AlertOwner /> 
<AlertMessageId>$MPElement[Name="opsmgrnet.Custom.Rules.TestRuleEvent100.AlertMessage"]$</AlertMessageId> 
<AlertParameters> 
<AlertParameter1>$Data/EventNumber$</AlertParameter1> 
<AlertParameter2>$Data/LoggingComputer$</AlertParameter2> 
<AlertParameter3>$Data/EventSourceName$</AlertParameter3> 
<AlertParameter4>$Data/EventLevel$</AlertParameter4> 
<AlertParameter5>$Data/EventDescription$</AlertParameter5> 
<AlertParameter6>$Data/@time$</AlertParameter6> 
<AlertParameter7>$Target/Host/Property[Type="MicrosoftWindowsLibrary6062780!Microsoft.Windows.Computer"]/IPAddress$</AlertParameter7> 
</AlertParameters> 
<Custom1>$Data/Params/Param[1]$</Custom1> 
<Custom2 /> 
<Custom3 /> 
<Custom4 /> 
<Custom5 /> 
<Custom6 /> 
<Custom7 /> 
<Custom8 /> 
<Custom9 /> 
<Custom10 /> 
</WriteAction>

However, when you look at the DisplayString, which is how the text will be viewed into the console – you will see:

<DisplayString ElementID="opsmgrnet.Custom.Rules.TestRuleEvent100.AlertMessage"> 
<Name>{0} Custom - Test alert on event 100 from rule {1}</Name> 
<Description>A test event was detected. The Event ID is: {0}. The Logging Computer is: {1}. The Event Source is: {2}. The Event Level is: {3}. Event Description = {4} Time event generated = {5} Custom IP Address: {6}</Description> 
</DisplayString>

As you can see, {0} corresponds to the first alert parameter, {1} corresponds to the second, etc…

So – in the Alert Name field, we can do something like this:

Which turns out really nice looking alerts in the console:

Now – the big downside? Email notifications and connector subscriptions display this field as text, and do not resolve the Alert Data Items. Sad smile

Can Alert Names contain dynamic data?

1 Comment

Leave a Reply Cancel reply