Automating OpsMgr Part 15: Creating 2-State Event Monitors


This is the 15th instalment of the Automating OpsMgr series. Previously on this series:

It’s been almost a month since the last post on this series, partially because I was working on the OpsMgr Self Maintenance MP v2.5. Previously on Part 14, I have demonstrated how to create an event collection rule using the OpsMgrExtended module. Today, I’ll show you how to create a 2-State event monitor using the New-OM2StateEventMonitor function from the OpsMgrExtended module.

Like all other functions in this module, it has been fully documented, with few examples, which can be accessed using Get-Help cmdlet:

Get-Help New-OM2StateEventMonitor –Full


Runbook: New-2StateEventMonitor

Workflow New-2StateEventMonitor

#Get OpsMgrSDK connection object
$OpsMgrSDKConn = Get-AutomationConnection -Name "OpsMgrSDK_HOME"

#Hard code which MP to use
$MPName = "TYANG.Test.Windows.Monitoring"

#Make sure MP exists
Write-Verbose "Getting management pack '$MPName'"
$MP = Get-OMManagementPack -SDKConnection $OpsMgrSDKConn -Name $MPName -ErrorAction SilentlyContinue
If ($MP -eq $null)
#MP doesn't exist, create it
Write-Verbose "management pack '$MPName' does not exist. creating now."
$CreateMP = New-OMManagementPack -SDKConnection $OpsMgrSDKConn -Name $MPName -DisplayName "TYANG Test Windows Monitoring" -Version ""

#Create Event Monitor, MP Version will be increased by
$MonitorCreated = InlineScript

#Validate Monitor Name
If ($USING:MonitorName -notmatch "([a-zA-Z0-9]+\.)+[a-zA-Z0-9]+")
#Invalid Monitor name entered
$ErrMsg = "Invalid monitor name specified. Please make sure it only contains alphanumeric charaters and only use '.' to separate words. i.e. 'Your.Company.Event.1234.Monitor'."
Write-Error $ErrMsg
} else {
#Name is valid, creating the monitor
New-OM2StateEventMonitor -SDKConnection $USING:OpsMgrSDKConn -MPName $USING:MPName -MonitorName $USING:MonitorName -MonitorDisplayName $USING:MonitorDisplayName -ClassName $USING:ClassName -ParentMonitor $USING:ParentMonitor -EventLog $USING:EventLog -Publisher $USING:Publisher -UnhealthyEventID $USING:UnhealthyEventID -HealthyEventID $USING:HealthyEventID -UnhealthyState $USING:UnhealthyState -Disabled $USING:MonitorDisabled -IncreaseMPVersion $true
If ($MonitorCreated)
Write-Output "Monitor `"$MonitorName`" created."
} else {
Write-Error "Unable to create monitor `"$Monitorname`"."

I have hardcoded the following parameters in the runbook:

  • SMA OpsMgr connection object name (which you will need to change to suit your environment)
  • (Unsealed) MP (where the rule  is going to be saved to) – “TYANG.Test.Windows.Monitoring”

Additionally, this runbook will firstly try to retrieve the management pack from the management group, if the MP deosn’t exist, it will create it first.

This runbook takes the following input parameters:

  • ClassName – The name of the target monitoring class (i.e.Microsoft.Windows.Server.OperatingSystem)
  • UnhealthyEventID – The Event ID for the unhealthy event.
  • HealthyEventID – The Event ID for the healthy event.
  • UnhealthyState– The unhealthy state of the monitor (either warning or error).
  • EventLog –The name of the event log (i.e. Application, System, etc)
  • Publisher– The event publisher
  • MonitorDisabled– Boolean, whether the event monitor should be disabled by default
  • MonitorDisplayName– Display name of the unit monitor
  • MonitorName – The name of the unit monitor
  • ParentMonitor – The parent dependency monitor for the event unit monitor

Runbook Execution Result:


Monitor Properties from the OpsMgr operations console:



Unhealthy Event:



Healthy Event:



Alert Setting:



In this post, I’ve demonstrated how to create a 2-state event monitor using the OpsMgrExtended module. now that I have covered both even collection rules and even monitors, I will dedicate the next 2 posts on monitoring Windows services.

Leave a Reply

This site uses Akismet to reduce spam. Learn how your comment data is processed.

%d bloggers like this: