Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a Rule watching the Application Log for Event 17137 (database starting up). A minor annoyance is that, whenever an instance is failed over, we see alerts fire from both the node and the instance for the same instance starting up. I'd like to de-duplicate these with an expression filter on the data source. I currently use

Logging Computer Equals $Target/Property[Type="Windows!Microsoft.Windows.Computer"]/DNSName$

However, I'm worried about cases where the Logging Computer string's character case differs from that of the DNSName property. E.g., "" won't equal "".

Is there a "toLower" or similar function that I can use to ensure that this expression is case-insensitive?

For reference: System Center Operations Manger 2007 v6.0.6278.0

share|improve this question

How about this:

Override the rule's Enabled state for the "Windows Computers" group, so you only target the database instances?

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.