How-To
      Back to home
      1. Knowledge Base | OpsLogix
      2. Operations Manager
      3. How-To

      How to use the SCOM module: System.ExpressionFilter

      How to use the SCOM module System.ExpressionFilter with XML samples

      Introduction

      The System.ExpressionFilter module is a key component of System Center Operations Manager (SCOM), providing developers with a versatile tool for creating customized monitoring criteria. This developer reference will provide an overview of the System.ExpressionFilter module and its various options and properties.

      Understanding System.ExpressionFilter

      The System.ExpressionFilter module is used to filter incoming data based on specified expressions. It evaluates the data against defined criteria and allows developers to create tailored monitoring solutions. The module is particularly useful for:

      1. Creating specific conditions for triggering alerts.
      2. Filtering out data that doesn't meet specific criteria.
      3. Creating more precise and tailored monitoring solutions.

      Creating an ExpressionFilter Configuration

      To create an ExpressionFilter configuration, developers need to specify an expression, property name, comparison operator, and a value to compare the property against. Here's an example of a configuration in XML format:

      <ExpressionFilter ID="FilterByPropertyName" TypeID="System!System.ExpressionFilter">
          <Expression>
              <SimpleExpression>
                  <ValueExpression>
                      <XPathQuery Type="String">Property[@Name='PropertyName']</XPathQuery>
                  </ValueExpression>
                  <Operator>Equals</Operator>
                  <ValueExpression>
                      <Value Type="String">DesiredValue</Value>
                  </ValueExpression>
              </SimpleExpression>
          </Expression>
      </ExpressionFilter>

       

      In this example, the ExpressionFilter checks if the property named "PropertyName" has a value equal to "DesiredValue".

      Comparison Operators

      The System.ExpressionFilter module supports a variety of comparison operators, including:

      1. Equals
      2. NotEquals
      3. GreaterThan
      4. LessThan
      5. GreaterThanOrEqual
      6. LessThanOrEqual
      7. Contains
      8. StartsWith
      9. EndsWith
      10. RegExMatch
      11. And
      12. Or

      Here's an example of an ExpressionFilter configuration that uses the GreaterThan operator:

      <ExpressionFilter ID="FilterByGreaterValue" TypeID="System!System.ExpressionFilter">
          <Expression>
              <SimpleExpression>
                  <ValueExpression>
                      <XPathQuery Type="String">Property[@Name='PropertyName']</XPathQuery>
                  </ValueExpression>
                  <Operator>GreaterThan</Operator>
                  <ValueExpression>
                      <Value Type="Integer">100</Value>
                  </ValueExpression>
              </SimpleExpression>
          </Expression>
      </ExpressionFilter>

       

      In this example, the ExpressionFilter checks if the property named "PropertyName" has a value greater than 100.

      Expression Types

      The System.ExpressionFilter module also supports different types of expressions that can be used to create more complex filtering criteria. The three types of expressions are:

      1. SimpleExpression: Compares a single property value against a specified value.
      2. AndExpression: Combines multiple expressions using the logical "AND" operator.
      3. OrExpression: Combines multiple expressions using the logical "OR" operator.

      Here's an example of an ExpressionFilter configuration that uses the AndExpression:

       
      <ExpressionFilter ID="FilterByMultipleProperties" TypeID="System!System.ExpressionFilter">
          <Expression>
              <AndExpression>
                  <Expression>
                      <SimpleExpression>
                          <ValueExpression>
                              <XPathQuery Type="String">Property[@Name='PropertyName1']</XPathQuery>
                          </ValueExpression>
                          <Operator>Equals</Operator>
                          <ValueExpression>
                              <Value Type="String">DesiredValue1</Value>
                          </ValueExpression>
                      </SimpleExpression>
                  </Expression>
                  <Expression>
                      <SimpleExpression>
                          <ValueExpression>
                              <XPathQuery Type="String">Property[@Name='PropertyName2']</XPathQuery>
                          </ValueExpression>
                          <Operator>Equals</Operator>
                          <ValueExpression>
                              <Value Type="String">DesiredValue2</Value>
                          </ValueExpression>
                      </SimpleExpression>
                  </Expression>
              </AndExpression>
          </Expression>
      </ExpressionFilter>

       

      In this example, the ExpressionFilter checks if the property named "PropertyName1" has a value equal to "DesiredValue1" AND the property named "PropertyName2" has a value equal to "DesiredValue2".

      Additional Properties

      The System.ExpressionFilter module includes some additional properties that developers can use to fine-tune their monitoring solutions. These properties include:

      1. MatchCount: The minimum number of matches required to process the data.
      2. SampleCount: The number of samples to use in the evaluation.
      3. WithinSeconds: The time frame within which the samples must occur.

      Here's an example of an ExpressionFilter configuration that uses the MatchCount property:

       
      <ExpressionFilter ID="FilterByMatchCount" TypeID="System!System.ExpressionFilter">
          <MatchCount>2</MatchCount>
          <Expression>
              <SimpleExpression>
                  <ValueExpression>
                      <XPathQuery Type="String">Property[@Name='PropertyName']</XPathQuery>
                  </ValueExpression>
                  <Operator>Equals</Operator>
                  <ValueExpression>
                      <Value Type="String">DesiredValue</Value>
                  </ValueExpression>
              </SimpleExpression>
          </Expression>
      </ExpressionFilter>

       

      In this example, the ExpressionFilter checks if the property named "PropertyName" has a value equal to "DesiredValue" at least two times before processing the data.

      Conclusion

      The System.ExpressionFilter module in SCOM provides developers with a powerful tool for creating customized monitoring solutions. With its wide range of comparison operators and expression types, as well as additional properties like MatchCount, SampleCount, and WithinSeconds, developers can create highly flexible and precise filtering criteria. By mastering the use of the System.ExpressionFilter module and its available options, developers can optimize their SCOM monitoring environments and enhance their overall IT management experience.