How to include information from the data item that generates an alert in the alert description - Sampa @ Work - Site Home

This works for an alert generating rule. This is an example for a generic CSV rule generated through the UI using "Create a New Rule" using "Alert Generating Rules" -> "Event Based" -> "Generic CSV Text Log (Alert)"

Here is a line from the log file that we will use for the example.

parameter1,ERROR,parameter3

To include the 1st parameter of a the Data Item, use the following expression.

$Data/EventData/DataItem/Params/Param[1]$

The full description string could look like

This is an alert about $Data/EventData/DataItem/Params/Param[1]$

The reason this works is because the data source for this rule outputs System.Event.Data data items. The data source is System.ApplicationLog.GenericCSVLog.FilteredEventProvider. It reads the specified logs and outputs System.Event.Data items. Here is an example System.Event.Data that contains information from a CSV log file. Notice that the log file parameters are nested fairly deeply in the data item. I've marked them with underline.

<DataItem type="System.Event.Data" time="2007-05-22T10:07:41.6416394-07:00" sourceHealthServiceId="A9BB62D3-BEF2-5208-E680-1EE489235408">
  <EventOriginId>{8ED89955-E479-40A9-E83A-BB4A37A48499}</EventOriginId>
  <PublisherId>{1F68E240-153F-3990-0560-2AC472836C4A}</PublisherId>
  <PublisherName>GenericCSVLog</PublisherName>
  <Channel>GenericCSVLog</Channel>
  <LoggingComputer />
  <EventNumber>0</EventNumber>
  <EventCategory>3</EventCategory>
  <EventLevel>0</EventLevel>
  <UserName />
  <RawDescription />
  <CollectDescription Type="Boolean">true</CollectDescription>
  <EventData>
    <DataItem type="System.ApplicationLog.GenericLogEntryData" time="2007-05-22T10:07:41.6416394-07:00" sourceHealthServiceId="A9BB62D3-BEF2-5208-E680-1EE489235408">
    <LogFileDirectory>d:\genericlogs</LogFileDirectory>
    <LogFileType>Generic CSV Log File Format</LogFileType>
    <LogFileName>d:\genericlogs\generic1.log</LogFileName>
    <Params>
      <Param>parameter1</Param>
      <Param>ERROR</Param>
      <Param>parameter3</Param>
    </Params>
    <DataItem>
  </EventData>
 <EventDisplayNumber>0</EventDisplayNumber>
 <EventDescription />
</DataItem>