A Platforms Admin Guide to Setting up Event Rules/Monitors in SCOM

Morning,

So, I would I go about adding the parameter entry for a log monitor?

Would I just add:

parameter or param

for the operator and the value of the monitor, I want to capture the entire line of info for each parameter?

What would I specify in this case? A wild card or question mark?

I have pasted an example. I want to include Parameter 1,2,7,10,13

<EventData>
<Data>User domain\msa-account$ has exceeded the 85% quota threshold for the quota on drive:\group\logs on server servername. The quota limit is 307200.00 MB, and 261205.20 MB currently is in use (85% of limit).</Data>
<Data>G:\Groups\logs</Data>
<Data>322122547200</Data>
<Data>273893506048</Data>
<Data>85</Data>
<Data>273893506048</Data>
<Data>7/31/2024 5:14:17 AM</Data>
<Data>48229041152</Data>
<Data>14</Data>
<Data>path to file name and file.txt that put it over the limit</Data>
<Data>4</Data>
<Data>Process ID (4)</Data>
<Data>DOT\msa-account$</Data>
<Data />
<Data>85</Data>
</EventData>
</Event

Thanks,

Tony