Monitor Enterprise Random Password Manager's Crash Event

LiebermanSoftware.ERPMMP.CrashEvent (Rule)

Knowledge Base article:

Summary

Monitor Enterprise Random Password Manager's Crash Event

Causes

ERPM crashed.

Resolutions

If windows error reporting failed to send out the information regarding the crash, please send it to Lieberman Software for.analysis manually.

Element properties:

TargetLiebermanSoftware.ERPMMP.APP
CategoryEventCollection
EnabledFalse
Alert GenerateTrue
Alert SeverityError
Alert PriorityLow
RemotableTrue
Alert Message
ERPM Alert: Crash
ERPM crashed on {0}. Check alert context for details.
Event LogApplication

Member Modules:

ID Module Type TypeId RunAs 
DS DataSource Microsoft.Windows.EventProvider Default
Alert WriteAction System.Health.GenerateAlert Default
WriteToDB WriteAction Microsoft.SystemCenter.CollectEvent Default
WriteToDW WriteAction Microsoft.SystemCenter.DataWarehouse.PublishEventData Default

Source Code:

<Rule ID="LiebermanSoftware.ERPMMP.CrashEvent" Enabled="false" Target="LiebermanSoftware.ERPMMP.APP" ConfirmDelivery="true" Remotable="true" Priority="Normal" DiscardLevel="100">
<Category>EventCollection</Category>
<DataSources>
<DataSource ID="DS" TypeID="Windows!Microsoft.Windows.EventProvider">
<ComputerName>$Target/Host/Property[Type="Windows!Microsoft.Windows.Computer"]/NetworkName$</ComputerName>
<LogName>Application</LogName>
<Expression>
<And>
<Expression>
<SimpleExpression>
<ValueExpression>
<XPathQuery Type="UnsignedInteger">EventDisplayNumber</XPathQuery>
</ValueExpression>
<Operator>Equal</Operator>
<ValueExpression>
<Value Type="UnsignedInteger">1000</Value>
</ValueExpression>
</SimpleExpression>
</Expression>
<Expression>
<SimpleExpression>
<ValueExpression>
<XPathQuery Type="String">PublisherName</XPathQuery>
</ValueExpression>
<Operator>Equal</Operator>
<ValueExpression>
<Value Type="String">Application Error</Value>
</ValueExpression>
</SimpleExpression>
</Expression>
<Expression>
<SimpleExpression>
<ValueExpression>
<XPathQuery Type="Integer">EventLevel</XPathQuery>
</ValueExpression>
<Operator>Equal</Operator>
<ValueExpression>
<Value Type="Integer">1</Value>
</ValueExpression>
</SimpleExpression>
</Expression>
<Expression>
<SimpleExpression>
<ValueExpression>
<XPathQuery Type="String">Params/Param[1]</XPathQuery>
</ValueExpression>
<Operator>Equal</Operator>
<ValueExpression>
<Value Type="String">Roulette.exe</Value>
</ValueExpression>
</SimpleExpression>
</Expression>
</And>
</Expression>
</DataSource>
</DataSources>
<WriteActions>
<WriteAction ID="WriteToDB" TypeID="SC!Microsoft.SystemCenter.CollectEvent"/>
<WriteAction ID="WriteToDW" TypeID="SCDW!Microsoft.SystemCenter.DataWarehouse.PublishEventData"/>
<WriteAction ID="Alert" TypeID="SystemHealth!System.Health.GenerateAlert">
<Priority>0</Priority>
<Severity>2</Severity>
<AlertMessageId>$MPElement[Name="LiebermanSoftware.ERPMMP.RPMCrash.AlertMessage"]$</AlertMessageId>
<AlertParameters>
<AlertParameter1>$Target/Property[Type="LiebermanSoftware.ERPMMP.APP"]/InstallComputer$</AlertParameter1>
</AlertParameters>
</WriteAction>
</WriteActions>
</Rule>