Creation of Alerts for Business Layer Plugin failed to start

TimWhite_LC2

Hi.

I am looking to create an incident based on an event in the Message Center / Events console.

Specifically, I am looking to create an alert for the message:

Plugin "Topology Business Layer" failed to start on [server]. Please restart the Module Engine service on [server].

I cannot see any obvious way to generate this from within the "Add New Alert" wizard as there does not appear to be an obvious selection from the "I want to Alert on" drop down.

I can see the event is recorded in the Orion.Events table, so swql like:

SELECT TOP 1000 EventID, EventTime, NetworkNode, NetObjectID, NetObjectValue, EngineID, EventType, Message, Acknowledged, NetObjectType, TimeStamp
FROM Orion.Events

where message like '%Plugin%'
ORDER by eventtime DESC

would generate a report.

How do I turn this into an alert within the Add Alert wizard

Within the Advance SWQL or SQL options you the initial select from statement has a restricted set of tables that you can start from, Orion.Events does not appear to be one of them.

My SQL/SWQL experience is limited.  
Is there a way to do this, or am I overlooking a simpler way to capture this event?

christopher.t.jones123

@TimWhite_LC2, so you can do this by doing a join from one of the tables that they let you select from to the events table. See the below example. There's a couple of dependent things for the nodes table to be an accurate table to do the join against. If you display the output from SWQL for one of these event i might be able to get it a little more accurate. 

--Query presented when selecting Nodes from the list of tables in the alert
SELECT Nodes.Uri, Nodes.DisplayName FROM Orion.Nodes AS Nodes

-Addition to scope to the events tables
LEFT JOIN Orion.Events E on E.NetworkNode = Nodes.NodeID

WHERE E.Message like '%Plugin%'