Microsoft Operations Management Suite Cookbook

上QQ阅读APP看书，第一时间看更新

There's more...

When the criteria defined in an alert rule is matched by the results of the search query, then an alert record is created. These records are stored as events in the Alert table in the OMS repository and are of type alert. Alert records created by alert rules in Log Analytics have a SourceSystem property value of OMS. This can be used to distinguish them from alert records from other sources, such as SCOM and the Alert Management solution.

You can use this query to find alert records in your workspace:

Alert
| summarize count () by SourceSystem

This query aggregates the content of the Alert table and returns the count of alert records by the SourceSystem property:

Figure 3.6

You can view the properties of an alert record generated by a Log Analytics alert rule by specifying the OMS SourceSystem value in your search query:

Alert
| where SourceSystem == "OMS"

In the resulting field, click the [+] show more button to expand the result view for one of the alert records. This will display all of the alert record properties and corresponding property values:

Figure 3.7

本周热推：

Linux从入门到精通（第2版）发布！设计与部署稳定的分布式系统（第2版）Ceph分布式存储实战超越想象：Windows 8应用设计与开发一学就会：Windows Vista应用完全自学手册