Rewrite Citrix application event log entries

Citrix.PresentationServer.UnlicensedCitrixApplicationLogEvents.EventCollectionRule (Rule)

Collects Citrix WMI service events from an Application event log raised by an unlicensed Citrix server

Knowledge Base article:

Citrix ® Management Pack

Summary

This rule generates a copy of an original event for display in the Events view. The Events view displays all the events raised by Citrix Presentation Server components on managed servers.

 
© 2002-2008 Citrix Systems, Inc. All rights reserved.

Element properties:

TargetCitrix.PresentationServer.UnlicensedServer
CategoryEventCollection
EnabledTrue
Alert GenerateFalse
RemotableTrue
Event LogApplication

Member Modules:

ID Module Type TypeId RunAs 
EventCollectionDS DataSource Microsoft.Windows.EventProvider Citrix.PresentationServer.CitrixAdministratorAccount
WriteToDB WriteAction Microsoft.SystemCenter.CollectEvent Citrix.PresentationServer.CitrixAdministratorAccount
WriteToDW WriteAction Microsoft.SystemCenter.DataWarehouse.PublishEventData Citrix.PresentationServer.CitrixAdministratorAccount

Source Code:

<Rule ID="Citrix.PresentationServer.UnlicensedCitrixApplicationLogEvents.EventCollectionRule" Enabled="true" Target="Citrix.PresentationServer.UnlicensedServer" ConfirmDelivery="false" Remotable="true" Priority="Normal" DiscardLevel="100">
<Category>EventCollection</Category>
<DataSources>
<DataSource ID="EventCollectionDS" RunAs="CtxLibrary!Citrix.PresentationServer.CitrixAdministratorAccount" TypeID="Windows!Microsoft.Windows.EventProvider">
<ComputerName>$Target/Host/Property[Type='Windows!Microsoft.Windows.Computer']/PrincipalName$</ComputerName>
<LogName>Application</LogName>
<Expression>
<SimpleExpression>
<ValueExpression>
<XPathQuery>PublisherName</XPathQuery>
</ValueExpression>
<Operator>Equal</Operator>
<ValueExpression>
<Value>Citrix WMI Service</Value>
</ValueExpression>
</SimpleExpression>
</Expression>
</DataSource>
</DataSources>
<WriteActions>
<WriteAction ID="WriteToDB" RunAs="CtxLibrary!Citrix.PresentationServer.CitrixAdministratorAccount" TypeID="SC!Microsoft.SystemCenter.CollectEvent"/>
<WriteAction ID="WriteToDW" RunAs="CtxLibrary!Citrix.PresentationServer.CitrixAdministratorAccount" TypeID="SCDW!Microsoft.SystemCenter.DataWarehouse.PublishEventData"/>
</WriteActions>
</Rule>