If you need to use any non-string data type in the criteria for custom Rules and Monitors, you’ll need to edit the XML in order for it to work properly. By default, OpsMgr will treat everything as a String value and the Rule/Monitor will not work properly.
For example, I created a rule to watch for Event ID 1000 in the Application Log and throw an Alert if Parameter 1 is greater than 20. Here is the Rule criteria:
Using Event Log Explorer (awesome tool for testing, get it here ), I generate Event 1000 with Parameter 1 set to 9:
I then received the following alert:
The reason I received this alert is that if OpsMgr is evaluating Parameter 1 as a String Value, then 9 would be greater than 20 (since 9 is greater than 2).
To correct, this I’ll need to edit the XML of the rule to change the data type to Integer.
So, I export the Management Pack that contains this Rule and look at the XML.
Here is the full XML of the Rule. The expression that we are concerned with is highlighted in green , and the part we need to change is in red .