Work with the Events View

The available data for an Events view is displayed in the Results pane when you click Eventsin the Navigation pane of the MOM Operator console. You can also click the event name in Public Viewsor My Viewsin the Navigation pane. Each row in the Results pane is a data instance generated for the view.

By default, all of the data for all of the computer groups in the scope that you are using is displayed. For example, if you are logged on with an account that is a member of the MOM Administrator group, you see all of the data for the MOM Administrator Scope. If you want to refine the selection of data in the Results pane, select a specific computer group in the MOM Administrator Scope from the Computer Grouplist, such as Microsoft Operations Manager 2005 Agents. In addition to viewing Events view data, you can:

Personalize the View

The Events view displays the data by using a predetermined selection of elements (seen as column headings) that are organized in a predetermined order. You can sort the data in ascending or descending order by clicking the column title that you want to use as a sort criterion. For the best performance, sort by Time.

If you want to change the data elements that are displayed as columns, or their sequence, right-click anywhere in the Results pane and then click Personalize Viewto open the Personalize Viewdialog box.

The dialog box lists the Available columnsand the Displayed columns.

To add an item to the columns that are displayed
Select the item that you want in the Available columnslist, and then click Addto move it to the Displayed columnslist.
To remove an item from the columns that are displayed
Select the item in the Displayed columnslist, and then click Removeto move it to the Available columnslist.
To change the order that columns are displayed
Select the item in the Displayed columnslist, and then click Move Upor Move Downto move the item.
Note  Note   

When you sort the Event IDor Typecolumns, the data might not appear to be sorted. The data in the columns actually sorts using a Microsoft® SQL Server™ comparison for the GUIDs, rather than alphanumerically.

The following tables summarize the displayed and available column titles, or data fields, for an Events view.

Displayed column Description
Type Specifies the Windows event type, such as Error, Warning, or Information.
Time Specifies the date and time that the alert was raised. The time is shown in the time zone of local computer.
Domain Specifies the domain to which the computer belongs.
Computer Specifies the computer on which an agent generated the alert.
Description Specifies the description of the event.
Source Specifies the user-defined name identifying the source of the alert. If no name is defined, this field defaults to the event source name.
Category Specifies the Windows text string that describes the event.
Event Number Specifies the Windows event number.
User Specifies the name of the Windows account logged on to the computer that generated the event.
Event Id Specifies a unique identifier for the event.
Available column Description
Provider Type Specifies the type of event provider that generated the event, such as a Windows event log.
Provider Name Specifies the name of the event provider, such as Applicationor Security.
Source Domain Specifies the domain on which the computer that generated the event resides.
Source Computer Specifies the computer on which the event generated.
Consolidated Indicates whether this event represents a number of identical events consolidated by a consolidation rule and, if so, the number of consolidated events this event represents.
Raises Alert Indicates whether the event generated an alert and, if so, how many alerts the event generated.

See or Change View Properties

To see or change the Event view properties, right-click anywhere in the Results pane, and click Propertiesto open the Event View Propertiesdialog box. This dialog box has two tabs that you work with: Criteriaand General.

Criteria
This tab has two input areas, one for selecting events and one for specifying the corresponding descriptive parameters that are used to qualify the event. In the Which events do you want to view?list, select an event by clicking the check box beside the event. When you select an event, a corresponding hyperlink is displayed in the View description (click the underlined value to edit)input area. Click the hyperlink to open a dialog box, and then provide the required information. The following table lists the available events and describes the associated information that you are prompted to provide.
Event Required view description information
from specified source Click the link to open the Sourcedialog box. Type a complete text string or use wildcards to identify the alert source.
of specified type Click the link to open the Typedialog box. Select the appropriate check box to identify the type of event. For example, Information, Error, or Warning.
with a specified event number Clink the link to open the Event Iddialog box. Type the numbers, separated by semicolons.
generated in a specific time period Click the link to open the Date and Time Generateddialog box. Specify a time range or a time interval.
from specified user Click the link to open the User Namedialog box. Type a complete text string or use wildcards to identify the user.
with specified text in event description Click the link to open the Descriptiondialog box. Type a complete text string or use wildcards to identify the alert description.
raised by specified computer Click the link to open the Computer Namedialog box. Type a complete text string or use wildcards to provide the Domainand Computerinformation.
in specified category Click the link to open the Categorydialog box. Type a complete text string or use wildcards to identify the category.
from event providers of specified type Click the link to open the Provider Typedialog box. Select the check box beside each provider that you want to identify. For example, Timed Eventand WMI Events.
from event providers with specified name Click the link to open the Provider Namedialog box. Type a complete text string or use wildcards to search for the provider name.
that generated alerts No action, all events that generated alerts are viewed.
that are consolidated events No action, all events that are consolidated events are displayed.
collected by a specified agent Click the link to open the Namedialog box. Type a complete text string or use wildcards to provide the Domainand Computerinformation.
with specified Event Id Click the link to open the Event Iddialog box. Type the GUID that you want to search for.
raised by computers in a specified group Click the link to open the Computer Groupdialog box. Type a complete text string or use wildcards to search for the computer group name.
General
This tab has two input areas: View nameand Description. The description is optional. You can change the name or description by clicking the appropriate text box to delete or add text.

Work with View Details

When you click Events, the Events view appears. On the navigation pane, click the Events node to obtain information that is displayed in the Results and Detail panes in the center of your screen. Select an event in the Results pane. Information about the selected event appears in the Detail pane.

The following Events view attributes are displayed in the Detail pane.

Properties
When you click Properties, the following properties, where available, are displayed in the Detail pane: Domain, Computer, Time, Type, Provider Name, Event Number, Provider Type, Source, Category, Raises Alert, Consolidated, From, To, and Event Id.
Note  Note   

In the Detail pane, basic properties are displayed by default, but the contents of the Results pane depends on the properties that are defined for any specific event.

Alerts
When you click Alerts, any existing alerts are displayed in the Detail pane. The following are displayed as column headings: Severity, Time Last Modified, Resolution State, Source, Name, and Owner. You can sort these alerts in ascending or descending order by clicking the appropriate column heading.

You can also switch to the Alerts view for a specific alert. To see the Alerts view for an alert, in the Detail pane, on the Alertstab, double-click the alert.

Parameters
When you click Parameters, any available parameters are displayed in the Detail pane. The following are displayed as column headings: Position, Name, and Value. You can sort these alerts in ascending or descending order by clicking the appropriate column heading.