Following on from the previous blog(
now updated with Alert schema
) showing how to query the data warehouse for Alert data, this post will cover utilizing Event Data.
Out of the box, we provide 3 main Event reports.
Allows you to show a tabular list of events for a given computer/group of computers and provide filters for Event Source, Event Category, Event Type or Event ID.
Click for link to Event Analysis report
Like the Event Analysis reports shows a tabular list of Event but can be configured to only show certain Event fields which can be filtered.
Most Common Events
This report is extremely useful when you are trying to fine tune your environment to ensure your operators are spending their time working on priority issues. Filtered by Management Pack you can show the most common events by percentage of total.
Click for link to Most Common Events report
These reports provide a good start in analysing Event data but there may be cases where you need greater control over the information you need to analyse. Perhaps you are just looking for total event counts for a given Event ID across a set of computers.
We can then use the data warehouse to query for this data. Lets start with the schema.
Differing from other datasets, the event data does not only get stored against a particular Managed Entity but against the LoggingComputer as shown in the vEventLoggingComputer view. This makes the Event dataset visually easier to understand and therefore query.
The query example below looks for all “Service Terminated(7024)” events across all computers.
vEventPublisher.EventPublisherName as 'EventSource',
vEventLoggingComputer.ComputerName as 'Computer',
vEventLevel.EventLevelTitle as 'Type',
vEvent.EventDisplayNumber as 'EventID',
vEventDetail.RenderedDescription as 'EventDescription'
Event.vEvent INNER JOIN
vEventUserName ON vEvent.UserNameRowId =
vEventUserName.EventUserNameRowId INNER JOIN
vEventCategory ON vEvent.EventCategoryRowId =
vEventCategory.EventCategoryRowId INNER JOIN
vEventPublisher ON vEvent.EventPublisherRowId =
vEventPublisher.EventPublisherRowId INNER JOIN
vEventLoggingComputer ON vEvent.LoggingComputerRowId =