Specifies the content and format of the Windows event attributes that an End Point Operations Management agent includes when logging a Windows event as an event in vRealize Operations Manager.

By default, the agent.properties file does not include this property.

When Windows log tracking is enabled, an entry in the form [Timestamp] Log Message (EventLogName):EventLogName:EventAttributes is logged for events that match the criteria you specified on the resource's Configuration Properties page.

Attribute

Description

Timestamp

When the event occurred

Log Message

A text string

EventLogName

The Windows event log type System, Security, or Application

 

EventAttributes

A colon delimited string made of the Windows event Source and Message attributes

For example, the log entry: 04/19/2010 06:06 AM Log Message (SYSTEM): SYSTEM: Print: Printer HP LaserJet 6P was paused. is for a Windows event written to the Windows System event log at 6:06 AM on 04/19/2010. The Windows event Source and Message attributes, are "Print" and "Printer HP LaserJet 6P was paused.", respectively.

Use the following parameters to configure the Windows event attributes that the agent writes for a Windows event. Each parameter maps to Windows event attribute of the same name.

Parameter

Description

%user%

The name of the user on whose behalf the event occurred.

%computer%

The name of the computer on which the event occurred.

%source%

The software that logged the Windows event.

%event%

A number identifying the particular event type.

%message%

The event message.

%category%

An application-specific value used for grouping events.

For example, with the property setting platform.log_track.eventfmt=%user%@%computer% %source%:%event%:%message%, the End Point Operations Management agent writes the following data when logging the Windows event 04/19/2010 06:06 AM Log Message (SYSTEM): SYSTEM: HP_Admistrator@Office Print:7:Printer HP LaserJet 6P was paused.. This entry is for a Windows event written to the Windows system event log at 6:06 AM on 04/19/2010. The software associated with the event was running as "HP_Administrator" on the host "Office". The Windows event's Source, Event, and Message attributes, are "Print", "7", and "Printer HP LaserJet 6P was paused.", respectively.