Alert monitor for Lenovo management controller RSA remote login

IBM.SystemX.MgmtController.Remote.Login (UnitMonitor)

Alerts when Lenovo management controller RSA remote login

Element properties:

Source Code:

<UnitMonitor ID="IBM.SystemX.MgmtController.Remote.Login" Accessibility="Public" Enabled="true" Target="IBM.SystemX.MgmtController" ParentMonitorID="Health!System.Health.SecurityState" Remotable="true" Priority="Normal" TypeID="Common!IBM.MonitorType.AutoReset3State" ConfirmDelivery="false">

  <Category>Custom</Category>

  <AlertSettings AlertMessage="IBM.SystemX.MgmtController.Remote.Login.AlertMessageResourceID">

    <AlertOnState>Warning</AlertOnState>

    <AutoResolve>true</AutoResolve>

    <AlertPriority>Normal</AlertPriority>

    <AlertSeverity>MatchMonitorHealth</AlertSeverity>

    <AlertParameters>

      <AlertParameter1>$Data/Context/Property[@Name="Description"]$</AlertParameter1>

      <AlertParameter2>$Data/Context/Property[@Name="__CLASS"]$</AlertParameter2>

    </AlertParameters>

  </AlertSettings>

  <OperationalStates>

    <OperationalState ID="Success" MonitorTypeStateID="HealthyEventRaised" HealthState="Success"/>

    <OperationalState ID="Warning" MonitorTypeStateID="WarningEventRaised" HealthState="Warning"/>

    <OperationalState ID="Critical" MonitorTypeStateID="ErrorEventRaised" HealthState="Error"/>

  </OperationalStates>

  <Configuration>

    <NameSpace>root\ibmsd</NameSpace>

    <Query>SELECT __Class, AlertingManagedElement, Description, EventID, PerceivedSeverity FROM CIM_AlertIndication</Query>

    <CIMAlertFilterExpression>

      <And>

        <Expression>

          <SimpleExpression>

            <ValueExpression>

              <XPathQuery>Property[@Name="__CLASS"]</XPathQuery>

            </ValueExpression>

            <Operator>Equal</Operator>

            <ValueExpression>

              <Value Type="String">IBMPSG_RemoteLoginEvent</Value>

            </ValueExpression>

          </SimpleExpression>

        </Expression>

        <Expression>

          <Or>

            <Expression>

              <SimpleExpression>

                <ValueExpression>

                  <Value Type="String">$Target/Property[Type="IBM.SystemX.HWComponent"]/InstanceID$</Value>

                </ValueExpression>

                <Operator>Equal</Operator>

                <ValueExpression>

                  <Value Type="String">RSA</Value>

                </ValueExpression>

              </SimpleExpression>

            </Expression>

            <Expression>

              <SimpleExpression>

                <ValueExpression>

                  <Value Type="Integer">$Target/Host/Host/Property[Type="IBM.SystemX.Platform"]/ibmInternalWinEventFiltering$</Value>

                </ValueExpression>

                <Operator>Equal</Operator>

                <ValueExpression>

                  <Value Type="Integer">0</Value>

                </ValueExpression>

              </SimpleExpression>

            </Expression>

          </Or>

        </Expression>

      </And>

    </CIMAlertFilterExpression>

    <PollInterval>10</PollInterval>

    <WinEventFiltering>$Target/Host/Host/Property[Type="IBM.SystemX.Platform"]/ibmInternalWinEventFiltering$</WinEventFiltering>

    <Licensed>$Target/Host/Host/Property[Type="IBM.SystemX.Platform"]/Licensed$</Licensed>

  </Configuration>

</UnitMonitor>