This is the 15th instalment of the Automating OpsMgr series. Previously on this series:

It’s been almost a month since the last post on this series, partially because I was working on the OpsMgr Self Maintenance MP v2.5. Previously on Part 14, I have demonstrated how to create an event collection rule using the OpsMgrExtended module. Today, I’ll show you how to create a 2-State event monitor using the New-OM2StateEventMonitor function from the OpsMgrExtended module.

Like all other functions in this module, it has been fully documented, with few examples, which can be accessed using Get-Help cmdlet:

Get-Help New-OM2StateEventMonitor –Full

Runbook: New-2StateEventMonitor

Workflow New-2StateEventMonitor

  #Get OpsMgrSDK connection object
  $OpsMgrSDKConn = Get-AutomationConnection -Name "OpsMgrSDK_HOME"

  #Hard code which MP to use
  $MPName = "TYANG.Test.Windows.Monitoring"

  #Make sure MP exists
  Write-Verbose "Getting management pack '$MPName'"
  $MP = Get-OMManagementPack -SDKConnection $OpsMgrSDKConn -Name $MPName -ErrorAction SilentlyContinue
  If ($MP -eq $null)
    #MP doesn't exist, create it
    Write-Verbose "management pack '$MPName' does not exist. creating now."
    $CreateMP = New-OMManagementPack -SDKConnection $OpsMgrSDKConn -Name $MPName -DisplayName "TYANG Test Windows Monitoring" -Version ""

  #Create Event Monitor, MP Version will be increased by
  $MonitorCreated = InlineScript
    #Validate Monitor Name
    If ($USING:MonitorName -notmatch "([a-zA-Z0-9]+\.)+[a-zA-Z0-9]+")
      #Invalid Monitor name entered
      $ErrMsg = "Invalid monitor name specified. Please make sure it only contains alphanumeric charaters and only use '.' to separate words. i.e. 'Your.Company.Event.1234.Monitor'."
      Write-Error $ErrMsg
    } else {
      #Name is valid, creating the monitor
      New-OM2StateEventMonitor -SDKConnection $USING:OpsMgrSDKConn -MPName $USING:MPName -MonitorName $USING:MonitorName -MonitorDisplayName $USING:MonitorDisplayName -ClassName $USING:ClassName -ParentMonitor $USING:ParentMonitor -EventLog $USING:EventLog -Publisher $USING:Publisher -UnhealthyEventID $USING:UnhealthyEventID -HealthyEventID $USING:HealthyEventID -UnhealthyState $USING:UnhealthyState -Disabled $USING:MonitorDisabled -IncreaseMPVersion $true
  If ($MonitorCreated)
    Write-Output "Monitor `"$MonitorName`" created."
  } else {
    Write-Error "Unable to create monitor `"$Monitorname`"."

I have hardcoded the following parameters in the runbook:

  • SMA OpsMgr connection object name (which you will need to change to suit your environment)
  • (Unsealed) MP (where the rule  is going to be saved to) – “TYANG.Test.Windows.Monitoring”

Additionally, this runbook will firstly try to retrieve the management pack from the management group, if the MP deosn’t exist, it will create it first.

This runbook takes the following input parameters:

  • ClassName – The name of the target monitoring class (i.e.Microsoft.Windows.Server.OperatingSystem)
  • UnhealthyEventID – The Event ID for the unhealthy event.
  • HealthyEventID – The Event ID for the healthy event.
  • UnhealthyState – The unhealthy state of the monitor (either warning or error).
  • EventLog –The name of the event log (i.e. Application, System, etc)
  • Publisher – The event publisher
  • MonitorDisabled – Boolean, whether the event monitor should be disabled by default
  • MonitorDisplayName – Display name of the unit monitor
  • MonitorName – The name of the unit monitor
  • ParentMonitor – The parent dependency monitor for the event unit monitor

Runbook Execution Result:

Monitor Properties from the OpsMgr operations console:


Unhealthy Event:

Healthy Event:

Alert Setting:


In this post, I’ve demonstrated how to create a 2-state event monitor using the OpsMgrExtended module. now that I have covered both even collection rules and even monitors, I will dedicate the next 2 posts on monitoring Windows services.

Leave a comment