After you apply System Center Operations Manager 2007 R2 Cumulative Update 3 (CU3), a workflow that queries the EventData element of an SDK event may fail to properly evaluate the XPATH query. Specifically, this occurs if the SDK event does not include a Dataitem element as the next element after EventData.
This is a known issue in System Center Operations Manager 2007 R2 CU3.
There are two workarounds for this issue:
1. Run expression filters only against top-level event elements, such as EventNumber, EventCategory or PublisherName.
2. If you must run an expression filter against the EventData element of an SDK event, change the connector to make sure that every inserted event includes a Dataitem element immediately after the EventData element. Then change expression filters to query the elements after Dataitem using an XPATH expression such as the following:
In the above XPATH example, VALUE is the name of an XML element that is immediately after the Dataitem element.
The information above was published today in the following Microsoft Knowledge Base article written by Michael Sadoff:
J.C. Hornbeck | System Center Knowledge Engineer
The App-V Team blog: http://blogs.technet.com/appv/
The WSUS Support Team blog: http://blogs.technet.com/sus/
The SCMDM Support Team blog: http://blogs.technet.com/mdm/
The ConfigMgr Support Team blog: http://blogs.technet.com/configurationmgr/
The SCOM 2007 Support Team blog: http://blogs.technet.com/operationsmgr/
The SCVMM Team blog: http://blogs.technet.com/scvmm/
The MED-V Team blog: http://blogs.technet.com/medv/
The DPM Team blog: http://blogs.technet.com/dpm/
The OOB Support Team blog: http://blogs.technet.com/oob/
The Opalis Team blog: http://blogs.technet.com/opalis
The Service Manager Team blog: http: http://blogs.technet.com/b/servicemanager
The AVIcode Team blog: http: http://blogs.technet.com/b/avicode
The System Center Essentials Team blog: http: http://blogs.technet.com/b/systemcenteressentials