There are two workarounds for this issue:
- Run expression filters only against top-level event elements, such as EventNumber, EventCategory or PublisherName.
- If you must run an expression filter against the EventData element of an SDK event, change the connector to make sure that every inserted event includes a Dataitem element immediately after the EventData element. Then change expression filters to query the elements after Dataitem using an XPATH expression such as the following:
In the above XPATH example, VALUE is the name of an XML element that is immediately after the Dataitem element.
Additional keywords: SCOM, SCOM 2007 R2, OpsMgr 2007 R2