0

I’ve got a monitor that looks for rogue KMS servers using PowerShell to run ‘nslookup -type=all _vlmcs._tcp’

The monitor is working as expected, but I’d like to show the results of the nslookup cmd within the Alert description. Is that possible?

I’ve tried putting entries like $Data/Context/Property[@Name=’Error’]$ within the alert description, where ‘error’ is the PropertyBag that references the nslookup in the PS script, but it just returns a numerical value for each entry that I add.

Get-KMS.PS1 script:

Alert description entries I’ve tried:

$Data/Context/DataItem/Property[@Name=’Error’]$
$Data/Context/DataItem/Property[@Name=’State’]$
$Data/Context/DataItem/Property[@Name=’Count’]$
$Data/Property[@Name=’Error’]$
$Data/Property[@Name=’State’]$

 

As an update to the above, I’m still struggling with passing the details from PowerShell through to the Alert Description. The below PowerShell is to find disconnected users on SCOM monitored servers.

The monitor works as expected, but I don’t get details in the Alert Description. My Alert Description is

$Data/Context/Property[@Name=’output’]$

Is there anything obviously wrong with the above? I’m wondering whether there’s some deeper problem with my SCOM instance; I can’t see any errors, and the script works without all the SCOM/Property Bag stuff.

Peter Aston edited question
    • I use this and it works in my setup: In the script: $PropertyBag.AddValue("MessageText",$errorhash) In alert description: $Data/Context/DataItem/Property[@Name='Messagetext']$