Collects WMI/CIM alert indications from IBM Director Platform Agent
This rule is used to collect IBM Director critical events.
Target | IBM.SystemX.BaseSystem |
Category | EventCollection |
Enabled | True |
Alert Generate | False |
Remotable | True |
ID | Module Type | TypeId | RunAs |
---|---|---|---|
WMIDS | DataSource | IBM.Windows.WmiEventProvider.EventProvider | Default |
WriteToDB | WriteAction | Microsoft.SystemCenter.CollectEvent | Default |
WriteToDW | WriteAction | Microsoft.SystemCenter.DataWarehouse.PublishEventData | Default |
<Rule ID="IBM.Director.Agent.ErrorEvent.Collection.Rule" Enabled="true" Target="IBM.SystemX.BaseSystem" ConfirmDelivery="false" Remotable="true" Priority="Normal" DiscardLevel="100">
<Category>EventCollection</Category>
<DataSources>
<DataSource ID="WMIDS" TypeID="IBM.Windows.WmiEventProvider.EventProvider">
<NameSpace>root\ibmsd</NameSpace>
<Query>SELECT __Class, AlertingManagedElement, Description, EventID, PerceivedSeverity FROM CIM_AlertIndication</Query>
<Expression>
<SimpleExpression>
<ValueExpression>
<XPathQuery Type="UnsignedInteger">Property[@Name="PerceivedSeverity"]</XPathQuery>
</ValueExpression>
<Operator>GreaterEqual</Operator>
<ValueExpression>
<Value Type="UnsignedInteger">5</Value>
</ValueExpression>
</SimpleExpression>
</Expression>
<PollInterval>900</PollInterval>
<EventLevel>1</EventLevel>
</DataSource>
</DataSources>
<WriteActions>
<WriteAction ID="WriteToDB" TypeID="SC!Microsoft.SystemCenter.CollectEvent"/>
<WriteAction ID="WriteToDW" TypeID="SCDW!Microsoft.SystemCenter.DataWarehouse.PublishEventData"/>
</WriteActions>
</Rule>