Home
  •  

A very large write has occurred

A_very_large_write_has_occurred_1_Rule (Rule)

Knowledge Base article:

Management Pack
Summary
A very large write was logged. The last Word in the Data Window is the number of bytes written. Please save this event log and contact technical support.
 
Resolutions
No action needed.
 
© Double-Take Software, Inc., all rights reserved.

Element properties:

TargetDoubletake_SCOM2007.Double_Take_Servers_Installation
CategoryEventCollection
EnabledFalse
Event_ID16386
Event SourceDouble-Take
Alert GenerateTrue
Alert SeverityInformation
Alert PriorityLow
RemotableTrue
Alert Message
A very large write has occurred

$Data/EventDescription$
Event LogApplication
CommentMom2005ID='{18596B29-A63C-4516-9E0C-2A4F9E8C9DBA}';MOM2005ComputerGroupID={88BABFBC-4FEB-4677-B19B-8895F4712F4C}

Member Modules:

ID Module Type TypeId RunAs 
_F6DA1507_12AF_11D3_AB21_00A0C98620CE_ DataSource Microsoft.Windows.EventProvider Default
CollectEventData WriteAction Microsoft.SystemCenter.CollectEvent Default
CollectEventDataWarehouse WriteAction Microsoft.SystemCenter.DataWarehouse.PublishEventData Default
GenerateAlert WriteAction System.Mom.BackwardCompatibility.AlertResponse Default

Source Code:

<Rule ID="A_very_large_write_has_occurred_1_Rule" Comment="Mom2005ID='{18596B29-A63C-4516-9E0C-2A4F9E8C9DBA}';MOM2005ComputerGroupID={88BABFBC-4FEB-4677-B19B-8895F4712F4C}" Enabled="false" Target="Doubletake_SCOM2007.Double_Take_Servers_Installation" ConfirmDelivery="true" Remotable="true" Priority="Normal" DiscardLevel="100">

  <Category>EventCollection</Category>

  <DataSources>

    <DataSource ID="_F6DA1507_12AF_11D3_AB21_00A0C98620CE_" TypeID="WindowsLibrary!Microsoft.Windows.EventProvider">

      <ComputerName>$Target/Host/Property[Type="WindowsLibrary!Microsoft.Windows.Computer"]/NetworkName$</ComputerName>

      <LogName>Application</LogName>

      <Expression>

        <And>

          <Expression>

            <SimpleExpression>

              <ValueExpression>

                <XPathQuery Type="Integer">EventDisplayNumber</XPathQuery>

              </ValueExpression>

              <Operator>Equal</Operator>

              <ValueExpression>

                <Value>16386</Value>

              </ValueExpression>

            </SimpleExpression>

          </Expression>

          <Expression>

            <SimpleExpression>

              <ValueExpression>

                <XPathQuery Type="String">PublisherName</XPathQuery>

              </ValueExpression>

              <Operator>Equal</Operator>

              <ValueExpression>

                <Value>Double-Take</Value>

              </ValueExpression>

            </SimpleExpression>

          </Expression>

        </And>

      </Expression>

    </DataSource>

  </DataSources>

  <WriteActions>

    <WriteAction ID="GenerateAlert" TypeID="MomBackwardCompatibility!System.Mom.BackwardCompatibility.AlertResponse">

      <AlertGeneration>

        <GenerateAlert>true</GenerateAlert>

        <Owner/>

        <Description>

            $Data/EventDescription$

          </Description>

        <AlertLevel>20</AlertLevel>

        <ResolutionState/>

        <Source>

            $Data/PublisherName$

          </Source>

        <Name>A very large write has occurred</Name>

      </AlertGeneration>

      <InvokerType>0</InvokerType>

    </WriteAction>

    <WriteAction ID="CollectEventData" TypeID="SystemCenterLibrary!Microsoft.SystemCenter.CollectEvent"/>

    <WriteAction ID="CollectEventDataWarehouse" TypeID="DataWarehouseLibrary!Microsoft.SystemCenter.DataWarehouse.PublishEventData"/>

  </WriteActions>

</Rule>