this is relatively simple to do, but i wanted to post it here in case you need to do this yourself. after you get the alert rule set up, we’ll diverge into using notification channel command to handle the emails. why? it’s easier in my case.
the first thing we need to do is create an appropriate rule to pick up the events. there are so many sources of information on how to do this that i’ll just provide a link to them. here you go: http://tinyurl.com/kv9ddg. shout out to “stefan the stranger” for showing me that site.
here are some things to note.
- some sources indicate using event description. if you can get away from doing this, for performance reasons, it’s recommended.
- parameter 3 holds the group name if you want to do a group name comparison.
- if you’re searching for multiple events, use a regex statement.
- if you want to capture the parameter value, you’ll need to push it into a custom field.
here’s the statement i’m using for my criteria:
( ( Event ID Matches regular expression ^(631|632|633|634|635|636|637|638|650|651|655|656|660|661|665|666)$ ) AND ( Parameter 3 Matches wildcard myGroup* ) )
in the last bullet above, i mentioned pushing the parameter to a custom field. simply change the alert for the responses. the custom alert field (in my case 1) should contain this string:
$Data/Params/Param[3]$
at this point, you should be picking up the alerts. if not, keep trying. :)
i was challenged with either having to create multiple notification subscriptions or using a script to handle the notifications. i chose the latter. however, either can be managed fairly well. if you choose to create notification subscriptions, you may want to view this post.
in order to make a script work, we’ll need to create a command channel. here are the properties you should include:
- full path
c:\windows\system32\cmd.exe (or whatever is appropriate for you)
- command line parameters
/c cscript.exe c:\scripts\scom_groupmonitor.vbs "$Data/Context/DataItem/Custom1$" "$Data/Context/DataItem/TimeRaisedLocal$" "$Data/Context/DataItem/AlertDescription$" "$Data/Context/DataItem/AlertName$"
- startup folder
c:\scripts (or wherever your script is)
as you can see, we’re pushing different fields as arguments into the script. i can’t figure out how to use the values directly from the script, so why not? anders details this pretty well on his blog.
after that, create your subscriber and your subscription which should be tied to the alert rule you created above. now, i didn’t detail the contents of the script yet because we had to get through the minutia. it’s really pretty simple. the work happens in the select case statement so we’ll go over that part.
Select Case LCase(Left(sGroup,8)) <-- modify this to match the case
Case "myGroup1"
EmailMe "mygroup1@mydomain.com"
Case "myGroup2"
EmailMe "mygroup2@mydomain.com" <-- if there's a match, email
WriteMe "mygroup2@mydomain.com" <-- or log to a file
Case "myGroup3"
EmailMe "mygroup3@mydomain.com"
Case "myGroup4"
EmailMe "mygroup4@mydomain.com"
Case "myGroup5"
EmailMe "mygroup5@mydomain.com"
Case Else
EmailMe "allmygroups@mydomain.com"
End Select
that’s pretty much it. i marked it with <—. the top portion of the select case is what you’d modify to match your group name. in my example, i want to match the first 8 characters. if my group was myGroup2200, it would match myGroup2. hope that makes sense. you’ll notice there’s a “writeme” sub called too. this is because i had to make sure the thing was working. long story.
next, modify the sub below for your mail environment.
Sub EmailMe(sRecipient)
Set oMessage = CreateObject("CDO.Message")
oMessage.Subject = sGroup & " - Group Changed" <-- your subject
oMessage.From = "myMOM@mydomain.com" <-- your sender
oMessage.To = sRecipient
oMessage.TextBody = sMessageBody
oMessage.Configuration.Fields.Item("http://schemas.microsoft.com/cdo/configuration/sendusing") = 2
oMessage.Configuration.Fields.Item("http://schemas.microsoft.com/cdo/configuration/smtpserver") = "smtp.mydomain.com" <-- your mail server
oMessage.Configuration.Fields.Item("http://schemas.microsoft.com/cdo/configuration/smtpserverport") = 25
oMessage.Configuration.Fields.Update
oMessage.Send
End Sub
that’s it. i condensed the list, but my environment has about 30 different cases to build from. this is why i thought scripting would be the easier approach. hope you find it useful. the full script is below.
'==========================================================================
' NAME: scom_groupmonitor.vbs
' AUTHOR: Marcus Oh
' DATE: 6/23/2009
' COMMENT: Emails SG admins when group changes are detected.
'==========================================================================
' Alert Name - $Data/Context/DataItem/AlertName$
' CustomField1 - $Data/Context/DataItem/Custom1$
' Local Time Raised - $Data/Context/DataItem/TimeRaisedLocal$
' Description - $Data/Context/DataItem/AlertDescription$
sGroup = Wscript.Arguments.Item(0)
sTime = WScript.Arguments.Item(1)
sEventDesc = WScript.Arguments.Item(2)
sAlertName = WScript.Arguments.Item(3)
' Redeem the value of our soul by massaging the description to be legible
myTempString = Split(sEventDesc,"\n \n")
For Each line In myTempString
myNewStuff = myNewStuff & VbCrLf & line
Next
sEventDesc = myNewStuff
sMessageBody = "Time: " & sTime & VbCrLf &_
sAlertName & VbCrLf &_
VbCrLf & sEventDesc
Select Case LCase(Left(sGroup,5))
Case "mygroup1"
EmailMe "mygroup1@mydomain.com"
Case "mygroup2"
EmailMe "mygroup2@mydomain.com"
WriteMe "mygroup2@mydomain.com"
Case "mygroup3"
EmailMe "mygroup3@mydomain.com"
Case "mygroup4"
EmailMe "mygroup4@mydomain.com"
Case "mygroup5"
EmailMe "mygroup5@mydomain.com"
Case Else
EmailMe "allmygroups@mydomain.com"
End Select
Sub EmailMe(sRecipient)
Set oMessage = CreateObject("CDO.Message")
oMessage.Subject = sGroup & " - Group Changed"
oMessage.From = "myMOM@mydomain.com"
oMessage.To = sRecipient
oMessage.TextBody = sMessageBody
oMessage.Configuration.Fields.Item("http://schemas.microsoft.com/cdo/configuration/sendusing") = 2
oMessage.Configuration.Fields.Item("http://schemas.microsoft.com/cdo/configuration/smtpserver") = "smtp.mydomain.com"
oMessage.Configuration.Fields.Item("http://schemas.microsoft.com/cdo/configuration/smtpserverport") = 25
oMessage.Configuration.Fields.Update
oMessage.Send
End Sub
Sub WriteMe(sRecipient)
Dim oFSO, oLogFile
Set oFSO = CreateObject("Scripting.FileSystemObject")
Set oLogFile = oFSO.OpenTextFile("GroupMonitor.log", 8, True)
oLogFile.WriteLine(vbcrlf & sRecipient & " : " & sGroup & VbCrLf & sMessageBody)
oLogFile.Close
End Sub
Comments
Post a Comment