0

Hey Community,

I have a problem. I want to create an SCOM subscription that filters my alarms. The problem is I want to check for multiple values of a single attribute.

Problem:
Alarm Severity critical and Custom Field 8 must not contain A or B.

 

I tried the console -> no success.

 

update PowerShell criteria -> no success.
Code:
<And xmlns:xsd=”http://www.w3.org/2001/XMLSchema” xmlns:xsi=”http://www.w3.org/2001/XMLSchema-instance”>
<Expression>
<SimpleExpression>
<ValueExpression>
<Property>Severity</Property>
</ValueExpression>
<Operator>Equal</Operator>
<ValueExpression>
<Value>2</Value>
</ValueExpression>
</SimpleExpression>
</Expression>
<Expression>
<Or>
<Expression>
<SimpleExpression>
<ValueExpression>
<Property>CustomField8</Property>
</ValueExpression>
<Operator>NotEqual</Operator>
<ValueExpression>
<Value>A</Value>
</ValueExpression>
</SimpleExpression>
</Expression>
<Expression>
<SimpleExpression>
<ValueExpression>
<Property>CustomField8</Property>
</ValueExpression>
<Operator>NotEqual</Operator>
<ValueExpression>
<Value>B</Value>
</ValueExpression>
</SimpleExpression>
</Expression>
</Or>
</Expression>
</And>

The XML OR group is accepted by SCOM when updating, but the subscription does not work.

 

Regex is not supported: -> no success
The element ‘Expression’ has invalid child element ‘RegExExpression’. List of possible elements expected: ‘SimpleExpression, UnaryExpression, And, Or’.

 

Last idea was the use of SQL-style Wildcards… -> no success

SCOM works in this case with the ‘like’ operator and in this case i need the ‘notlike’. I have updated the operator to notlike at the subscription and the update was a success but the subscription stopped working…

 

anyone else good ideas?

Sebastian Pabst selected answer