Task Scheduler Monitoring in SCOM using Rule

One of the best advantages in SCOM is how easily we can monitor event logs. Simply go to Event Viewer, find the Event ID and start monitoring.

Below are the steps through which Task Scheuler jobs can be easily monitored via SCOM rule.

Things to know before configuring monitoring:

1. Task Scheduler job name should not have spaces.

2. Task name used for monitoring configuration purpose must has to be same as shown in Event XML view.

Steps to retrieve the XML view for events logged via Task Scheduler. I have tried to demo using my case. Please refer to screenshot and steps:

1. Got to Task Scheduler and select the task name "MyJob" (Containing Folder name and Task name should not have spaces).

2. Select "History", select the event log.

3. Click on "Details" tab and click on XML view 

Figure for Steps 1,2 & 3

4. Copy the content into a notepad, or any text editor as per your choice.

5. Find the row containing text <Data Name="TaskName">.

6. Copy the text between the <Data> tag as shown in the figure. (In my case, its "\HourlyJobs\MyJob".) This will be required for configuring Rule in SCOM.

Figure for Steps 4,5 & 6

Now, in further steps, we need to configure a rule under "Windows Server Operating System" target. You can choose any other target of your choice.

Open Authoring workspace on SCOM and create a new Rule for NT Event Log (Alert):

1. Select or create one management pack and Choose NT Event Log (Alert) Rule.

Figure for Step 1

2. Keep the Rule disabled, if you want to target to single server. Give the Rule a suitable name.

Figure for Step 2

3. Give the log name as "Microsoft-Windows-TaskScheduler/Operational"

Figure for Step 3

4. Select the "..." button.

Figure for Step 4

5. Select the third option "Use parameter name not specified above and enter the text "EventData/DataItem/*[name()='EventData']/*[name()='Data' and @Name='TaskName']"

Figure for Step 5

6. Click Ok and complete the expression by specifying equals the copied name that we copied from <Data> tag. (In my case he expression equals "\HourlyJobs\MyJob").

Figure for Step 6

7. Configure the alert as per your need in the next window.

Figure for Step 7

 

8. Finally Override "Enabled" property to "True" for this rule to the desired server where the task scheduler is configured.

Hope you enjoyed the monitoring of task scheduler with this simple configuration. ☺