get-alerthistory operation

The get-alerthistory operation retrieves alert history that is filtered by the specified search criterion.

The following table describes the <items> XML and request elements for the get-alerthistory operation:

Adapter request elements for the get-alerthistory operation

Element	Definition	Required
`<operation-name>`	Specifies the operation name: `get-alerthistory`	Yes
`<command-request>`	Specifies the parent element for the command elements	Yes
`<timeout-secs>`	Specifies the duration after which the operation times out Default value: 60 seconds	No
`<command-parameters>`	Specifies the parent element for the command parameters	Yes
`<alert>`	Specifies the parent element that contains the search criterion used to retrieve a set of alerts	Yes
`<alert-search-criteria>`	Specifies the parent element for defining the search criterion	Yes
`<criteria-expression>`	Specifies the parent element for a single search criterion You can specify more than one filter criterion by using multiple `<criteria-expression>` elements.	Yes
`<key>`	Specifies the alert attribute used in the search Valid values: Any valid alert attribute. For example, name, description, and ID. Note You can use the `find-alert-by-id` operation to retrieve all the available alert attributes.	Yes
`<value>`	Specifies the value of the attribute specified in the `<key>` element	Yes
`<operator>`	Specifies an operator If you specify this element under the `<alert-search-criteria>` element, it specifies the operator between multiple `<criteria-expression>` elements. Valid values: and, or If you specify this element under the `<criteria-expression>` element, it specifies the operator for `<key>` and `<value>` elements. Valid values: equals, not equals, like, greater than, less than, in (to be used when the ID is used as a key)	Yes

The following figure illustrates a sample adapter request for the get-alerthistory operation:

Sample adapter request for the get-alerthistory operation


<scom-request>
  <operation-name>get-alerthistory</operation-name>
  <command-request>
    <timeout-secs>120</timeout-secs>
    <command-parameters>
      <alert>
        <alert-search-criteria>
          <criteria-expression>
            <key>Id</key>
            <value>501cc0a0-c7c5-41a3-85a6-988efd4c64fd</value>
            <operator>equals</operator>
          </criteria-expression>
        </alert-search-criteria>
      </alert>
    </command-parameters>
  </command-request>
</scom-request>

The following figure illustrates the adapter response for the sample request:

Sample adapter response for the get-alerthistory operation


<scom-response>
  <metadata>
    <status>success</status>
    <count>1</count>
  </metadata>
  <commands-output>
    <command-output>
      <metadata>
        <command>./Microsoft.EnterpriseManagement.OperationsManager.ClientShell. Startup.ps1;(get-alert -criteria {Id = '501cc0a0-c7c5-41a3-85a6-988efd4c64fd'}) | get-alerthistory</command>
        <execution-milliseconds>13610</execution-milliseconds>
        <exit-code>0</exit-code>
        <status>success</status>
        <count>1</count>
      </metadata>
      <output>
        <item>
          <MonitoringAlertId>501cc0a0-c7c5-41a3-85a6-988efd4c64fd</MonitoringAlertId>
          <ResolutionState>0</ResolutionState>
          <Owner/>
          <CustomField1/>
          <CustomField2/>
          <CustomField3/>
          <CustomField4/>
          <CustomField5/>
          <CustomField6/>
          <CustomField7/>
          <CustomField8/>
          <CustomField9/>
          <CustomField10/>
          <Comments>Alert Activated by the System.</Comments>
          <TimeModified>2/19/2009 10:21:03 AM</TimeModified>
          <TimeModifiedOffset>0</TimeModifiedOffset>
          <TimeResolutionStateLastModified>2/19/2009 10:21:01 AM</TimeResolutionStateLastModified>
          <TimeResolutionStateLastModifiedOffset>0</TimeResolutionStateLastModifiedOffset>
          <ModifiedBy>System</ModifiedBy>
          <TimeAdded>2/19/2009 10:21:03 AM</TimeAdded>
          <TicketId/>
          <Context>
            <DataItem
              type = "Microsoft.Windows.EventData"
              time = "2009-02-19T15:20:55.0000000+05:00"
              sourceHealthServiceId = "EE6D2AE3-BBDB-8658-94D3-26161D711828">
              <EventOriginId>{8E2F3581-48A6-47A6-94F0-644515B3DF35}</EventOriginId>
              <PublisherId>{07662796-8DD4-4E1B-6676-B5CB4A8E4CAA}</PublisherId>
              <PublisherName>HealthService</PublisherName>
              <EventSourceName>HealthService</EventSourceName>
              <Channel>Operations Manager</Channel>
              <LoggingComputer>WIN1STDVM</LoggingComputer>
              <EventNumber>3221232488</EventNumber>
              <EventCategory>1</EventCategory>
              <EventLevel>1</EventLevel>
              <UserName>N/A</UserName>
              <RawDescription>
                <![CDATA[The Health Service cannot verify the future validity of the RunAs account
                %1\%2 for management group %5 due to an error retrieving information
                from Active Directory (for Domain Accounts) or the local security
                authority (for Local Accounts). The error is %3(%4).]]>
              </RawDescription>
              <LCID>1033</LCID>
              <CollectDescription Type = "Boolean">true</CollectDescription>
              <Params>
                <Param>SYNAPSE</Param>
                <Param>james.calvin</Param>
                <Param><![CDATA[Logon failure: unknown user nameor bad password.]]></Param>
                <Param>0x8007052E</Param>
                <Param>P1</Param>
              </Params>
              <EventData/>
              <EventDisplayNumber>7016</EventDisplayNumber>
              <EventDescription>
                <![CDATA[The HealthService cannot verify the future validityof the RunAs
                account SYNAPSE\james.calvin for management group M1 due toan
                error retrieving information from Active Directory (for Domain
                Accounts) or thelocal security authority (for Local Accounts). The
                error is Logon failure: unknown user name or bad password.(0x8007052E).]]>
              </EventDescription>
            </DataItem>
          </Context>
          <ConnectorId/>
          <Id>59ede69f-ae7c-4d30-ad16-ac3be7fb260f</Id>
          <ManagementGroup>M1</ManagementGroup>
          <ManagementGroupId>ae1fcf8a-8088-31d8-93ec-90fe77a32d44</ManagementGroupId>
        </item>
      </output>
    </command-output>
  </commands-output>
</scom-response>