How to display events (like the one in SCOM console)

Question & Answer
, , ,
#1

Hi,

We are using AD management pack. In SCOM console we have a event view that displays al AD related events (the ones you find in eventviewer of your servers).

I’m trying to display those in squared up but not getting that working.

Any tips?

 

Br
Karl

EventLog View like in SCOM Console
#2

Hi Karl,

You can do that with a SQL Grid, here’s an example query i’m using:

select top 100 EventPublisherName, evc.EventChannelTitle, eventnumber, RenderedDescription, ComputerName
from Event.vEvent as ev
join Event.vEventDetail as evd on ev.eventoriginid = evd.eventoriginid
join Event.vEventParameter as evp on ev.eventoriginid = evp.eventoriginid
join dbo.vEventPublisher as evs on ev.eventpublisherrowid = evs.eventpublisherrowid
join dbo.EventChannel as evc on ev.eventchannelrowid = evc.eventchannelrowid
join dbo.eventloggingcomputer as evl on ev.LoggingComputerRowId = evl.EventLoggingComputerRowId
where eventdisplaynumber = ‘4732’ and EventChannelTitle = ‘Security’

Depending on what data you want to display you wouldn’t need all the joins, I usually just play around with the queries in SQL Studio till i’m happy with the results.

1 Like
#3

As an added extra, you can Row Link the results to give you a drilldown to the object in SquaredUp.