Unwanted events are also logged in the view created for a specific target from the rules created using its base target

Question

I have created Event or Alert view using a target "My.Target" which is derived from a base target "Windows Server".
All the events or alerts are captured correctly from the servers discovered by "My.Target" but the same view also shows the events and alerts from other servers which has a rule created with a base target "Windows Server".
Is there any option to filter the base target at view level other than using a custom field as it doesn't work for the alerts generated using "Monitors".
Any help would be greatly appreciated.
Thanks in advance.

Answer 1

There is a class "My.Servers" derived from "Microsoft.Windows.Server.Computer" as below -
  <TypeDefinitions>
    <EntityTypes>
      <ClassTypes>
        <ClassType ID="My.Servers" Accessibility="Public" Abstract="false" Base="MicrosoftWindowsLibrary!Microsoft.Windows.Server.Computer" Hosted="false" Singleton="false" Extension="false">
          <Property ID="Name" Type="string" AutoIncrement="false" Key="false" CaseSensitive="false" MaxLength="256" MinLength="0" Required="false" Scale="0" />          
        </ClassType>
      </ClassTypes>
    </EntityTypes>
  </TypeDefinitions>
There is a discovery "MyServersDiscovery" to discover servers with presence of some registry key as below -
<Monitoring>
    <Discoveries>
      <Discovery ID="MyServersDiscovery" Enabled="true" Target="MicrosoftWindowsLibrary!Microsoft.Windows.Server.Computer" ConfirmDelivery="false" Remotable="true" Priority="Normal">
        <Category>Discovery</Category>
        <DiscoveryTypes>
          <DiscoveryClass TypeID="My.Servers">
            <Property TypeID="My.Servers" PropertyID="Name" />
          </DiscoveryClass>
        </DiscoveryTypes>
        <DataSource ID="Name.AttributeDiscovery" TypeID="MicrosoftWindowsLibrary!Microsoft.Windows.FilteredRegistryDiscoveryProvider">
          <ComputerName>$Target/Property[Type="MicrosoftWindowsLibrary!Microsoft.Windows.Computer"]/NetworkName$</ComputerName>
          <RegistryAttributeDefinitions>
            <RegistryAttributeDefinition>
              <AttributeName>Name</AttributeName>
              <Path>SOFTWARE\MyRegKey</Path>
              <PathType>0</PathType>
              <AttributeType>0</AttributeType>
            </RegistryAttributeDefinition>
          </RegistryAttributeDefinitions>
          <Frequency>300</Frequency>
          <ClassId>$MPElement[Name="My.Servers"]$</ClassId>
          <InstanceSettings>
            <Settings>
              <Setting>
                <Name>$MPElement[Name="MicrosoftWindowsLibrary!Microsoft.Windows.Computer"]/PrincipalName$</Name>
                <Value>$Target/Property[Type="MicrosoftWindowsLibrary!Microsoft.Windows.Computer"]/PrincipalName$</Value>
              </Setting>
              <Setting>
                <Name>$MPElement[Name="SystemLibrary!System.Entity"]/DisplayName$</Name>
                <Value>$Target/Property[Type="SystemLibrary!System.Entity"]/DisplayName$</Value>
              </Setting>
              <Setting>
                <Name>$MPElement[Name="My.Servers"]/Name$</Name>
                <Value>$Data/Values/Name$</Value>
              </Setting>
            </Settings>
          </InstanceSettings>
          </Expression>         
        </DataSource>
      </Discovery>
</Monitoring>
Created 2 views "My.Alert.View" and "My.Event.View" with Target "My.Servers" as below -
 <Presentation>
    <Views>
      <View ID="My.Alert.View" Accessibility="Public" Enabled="true" Target="My.Servers" TypeID="SystemCenter!Microsoft.SystemCenter.AlertViewType" Visible="true">
        <Category>Operations</Category>
      </View>
      <View ID="My.Event.View" Accessibility="Public" Enabled="true" Target="My.Servers" TypeID="SystemCenter!Microsoft.SystemCenter.EventViewType" Visible="true">
        <Category>Operations</Category>
      </View>
</Views>
</Presentation>
The above views display events and alerts generated by rules targeted on the serves discovered with "MyServersDiscovery" correctly.
The major issue here is - if there is a rule in same or any other management pack for which the target is "Windows Server", the alert or event generated by that rule is also shown in these views which is not expected.
It seems it is because the target for "My.Alert.View" and "My.Event.View" is "My.Servers" which is dervied from "Microsoft.Windows.Server.Computer" so by default all the rules targeted on its base class "Microsoft.Windows.Server.Computer" are also visible
here.
Is there any way to avoid this?