ForefrontServiceDiscovery

ForefrontServiceDiscovery_2_Rule (Rule)

Knowledge Base article:

Management Pack

Summary
This is a Timed Event Rule. It checks whether there are any Forefront products installed on agent-managed computers by calling the Forefront Service discovery script every 10 minutes.

Resolutions
No action needs to be taken.

Element properties:

Target	FSMPack2007_FSE.Forefront_Security_for_Exchange_Server___All_Servers_Installation
Category	EventCollection
Enabled	True
Alert Generate	False
Remotable	True
Comment	Mom2005ID='{6588B50D-37E1-4C6A-94B6-ED364AF63909}';MOM2005ComputerGroupID={868E5B4E-34B8-4B10-9055-C4074AF41790}

Member Modules:

ID	Module Type	TypeId	RunAs
_E74DC4FD_18BC_487B_AC25_AC9C85CC03BE_	DataSource	System.Scheduler	Default
ScriptResponse1	WriteAction	Forefront_Service_Discovery	Default

Source Code:

<Rule ID="ForefrontServiceDiscovery_2_Rule" Comment="Mom2005ID='{6588B50D-37E1-4C6A-94B6-ED364AF63909}';MOM2005ComputerGroupID={868E5B4E-34B8-4B10-9055-C4074AF41790}" Enabled="true" Target="FSMPack2007_FSE.Forefront_Security_for_Exchange_Server___All_Servers_Installation" ConfirmDelivery="false" Remotable="true" Priority="Normal" DiscardLevel="100">

  <Category>EventCollection</Category>

  <DataSources>

    <DataSource ID="_E74DC4FD_18BC_487B_AC25_AC9C85CC03BE_" TypeID="SystemLibrary!System.Scheduler">

      <Scheduler>

        <SimpleReccuringSchedule>

          <Interval Unit="Seconds">600</Interval>

        </SimpleReccuringSchedule>

        <ExcludeDates/>

      </Scheduler>

    </DataSource>

  </DataSources>

  <WriteActions>

    <WriteAction ID="ScriptResponse1" TypeID="Forefront_Service_Discovery">

      <AlertGeneration>

        <GenerateAlert>false</GenerateAlert>

        <Owner/>

        <Description>

								$Data/EventDescription$

							</Description>

        <AlertLevel>50</AlertLevel>

        <ResolutionState/>

        <Source>

								$Data/PublisherName$

							</Source>

        <Name>ForefrontServiceDiscovery</Name>

      </AlertGeneration>

      <InvokerType>0</InvokerType>

    </WriteAction>

  </WriteActions>

</Rule>