CA Event: Claim type created

CA_Event__Claim_type_created_1_Rule (Rule)

Knowledge Base article:

Element properties:

Member Modules:

Source Code:

<Rule ID="CA_Event__Claim_type_created_1_Rule" Enabled="true" Target="ChangeAuditor.Quest_ChangeAuditor_Installation" ConfirmDelivery="false" Remotable="true" Priority="Normal" DiscardLevel="100">

  <Category>EventCollection</Category>

  <DataSources>

    <DataSource ID="WMIDataSource" TypeID="WindowsLibrary!Microsoft.Windows.WmiEventProvider.FilteredEventProvider">

      <NameSpace>root\Dell\ChangeAuditor</NameSpace>

      <Query>SELECT * FROM CAAD_AlertEvent</Query>

      <PollInterval>15</PollInterval>

      <Expression>

        <SimpleExpression>

          <ValueExpression>

            <XPathQuery>Property[@Name='EventClassID']</XPathQuery>

          </ValueExpression>

          <Operator>Equal</Operator>

          <ValueExpression>

            <Value>223e099e-f227-4682-95a6-d666f426afe1</Value>

          </ValueExpression>

        </SimpleExpression>

      </Expression>

    </DataSource>

  </DataSources>

  <WriteActions>

    <WriteAction ID="WriteToDB" TypeID="SystemCenterLibrary!Microsoft.SystemCenter.CollectEvent"/>

    <WriteAction ID="WriteToDW" TypeID="DataWarehouseLibrary!Microsoft.SystemCenter.DataWarehouse.PublishEventData"/>

    <WriteAction ID="GenerateAlert" TypeID="HealthLibrary!System.Health.GenerateAlert">

      <Priority>1</Priority>

      <Severity>$Data/EventData/DataItem/Property[@Name='SCOMSeverity']$</Severity>

      <AlertName/>

      <AlertDescription/>

      <AlertOwner/>

      <AlertMessageId>$MPElement[Name="CA_Event__Claim_type_created_1_Rule.AlertMessage"]$</AlertMessageId>

      <AlertParameters>

        <AlertParameter1>$Data/EventData/DataItem/Property[@Name='TimeDetected']$</AlertParameter1>

        <AlertParameter2>$Data/EventData/DataItem/Property[@Name='UserName']$</AlertParameter2>

        <AlertParameter3>$Data/EventData/DataItem/Property[@Name='Agent']$</AlertParameter3>

        <AlertParameter4>$Data/EventData/DataItem/Property[@Name='SubSystem']$</AlertParameter4>

        <AlertParameter5>$Data/EventData/DataItem/Property[@Name='Action']$</AlertParameter5>

        <AlertParameter6>$Data/EventData/DataItem/Property[@Name='Description']$</AlertParameter6>

        <AlertParameter7>$Data/EventData/DataItem/Property[@Name='Message']$</AlertParameter7>

        <AlertParameter8>$Data/EventData/DataItem/Property[@Name='FromValue']$</AlertParameter8>

        <AlertParameter9>$Data/EventData/DataItem/Property[@Name='ToValue']$</AlertParameter9>

        <AlertParameter10>$Data/EventData/DataItem/Property[@Name='ObjectName']$</AlertParameter10>

      </AlertParameters>

      <Suppression/>

      <Custom1/>

      <Custom2/>

      <Custom3/>

      <Custom4/>

      <Custom5/>

      <Custom6/>

      <Custom7/>

      <Custom8/>

      <Custom9/>

      <Custom10/>

    </WriteAction>

  </WriteActions>

</Rule>