Specifies the content and format of the Windows event attributes that an End Point Operations Management agent includes when logging a Windows event as an event in vRealize Operations Manager.
By default, the agent.properties file does not include this property.
Default
When Windows log tracking is enabled, an entry in the form [Timestamp] Log Message (EventLogName):EventLogName:EventAttributes is logged for events that match the criteria you specified on the resource's Configuration Properties page.
| Attribute | Description | |
|---|---|---|
Timestamp |
When the event occurred | |
Log Message |
A text string | |
EventLogName |
The Windows event log type System, Security, or Application |
|
EventAttributes |
A colon delimited string made of the Windows event Source and Message attributes |
For example, the log entry: 04/19/2010 06:06 AM Log Message (SYSTEM): SYSTEM: Print: Printer HP LaserJet 6P was paused. is for a Windows event written to the Windows System event log at 6:06 AM on 04/19/2010. The Windows event Source and Message attributes, are "Print" and "Printer HP LaserJet 6P was paused.", respectively.
Configuration
Use the following parameters to configure the Windows event attributes that the agent writes for a Windows event. Each parameter maps to Windows event attribute of the same name.
| Parameter | Description |
|---|---|
%user% |
The name of the user on whose behalf the event occurred. |
%computer% |
The name of the computer on which the event occurred. |
%source% |
The software that logged the Windows event. |
%event% |
A number identifying the particular event type. |
%message% |
The event message. |
%category% |
An application-specific value used for grouping events. |
For example, with the property setting platform.log_track.eventfmt=%user%@%computer% %source%:%event%:%message%, the End Point Operations Management agent writes the following data when logging the Windows event 04/19/2010 06:06 AM Log Message (SYSTEM): SYSTEM: HP_Admistrator@Office Print:7:Printer HP LaserJet 6P was paused.. This entry is for a Windows event written to the Windows system event log at 6:06 AM on 04/19/2010. The software associated with the event was running as "HP_Administrator" on the host "Office". The Windows event's Source, Event, and Message attributes, are "Print", "7", and "Printer HP LaserJet 6P was paused.", respectively.
