Hello everyone. I don't think what I'm asking is possible, but I thought I'd double check with all the experts here. Is there anyway to include a string from a monitored log file included on an email notification, but NOT have that string appear in the alert description? I've read Kevin's article, and a few others, as well as experimented with adding parameters, but I can't seem to get the string in the email notification. e.g. $Data/EventData/DataItem/Params/Param[1]$ in the alert description returns the string, but when added to email notification it doesn't work. Thanks again.Layne

Bueller? Layne

Bueller? Bueller? anyone... Bueller.Scott Moss MVP (Operations Manager) | President - System Center Virtual Users Group | Vice President - Atlanta Southeast Management Users Group (ATL SMUG) Please remember to click Mark as Answer on the post that helps you, and to click Unmark as Answer if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.

You can send notification based not only on alerts but on other data items. This is not supported by the UI, but can be done via management pack Xml. Is that what you're looking for? Say, you can have a data source on a rule watching over log file and a filter looking for a particular string in the log. The write action on the rule may be a notification write action. That way you'll be getting notification once certain string appeared in the monitored log...Vitaly Filimonov [MSFT]

Hi Vitaly. That sounds interesting. Are there any published documents on how to create a notification write action? How do you do it in the xml? Thanks,Layne

Hi, I noticed this post and would like to share it with you for your reference: Script: Notification Logfile http://contoso.se/blog/?p=265 Please Note: Since the website is not hosted by Microsoft, the link may change without notice. Microsoft does not guarantee the accuracy of this information. Hope this helps. Thanks. Nicholas Li - MSFT Please remember to click Mark as Answer on the post that helps you, and to click Unmark as Answer if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.

Can you please ping me directly so that we can discuss this? vitalyf at microsoft.com...Vitaly Filimonov [MSFT]

Message sent. Thanks!Layne