Logging service stopped

Logging_service_stopped_2_Rule (Rule)

Element properties:

Member Modules:

Source Code:

<Rule ID="Logging_service_stopped_2_Rule" Target="Microsoft.Windows.Server.RightsManagementServices.Microsoft_Windows_Rights_Management_Servers_Installation" Enabled="true" ConfirmDelivery="false" Comment="Mom2005ID='{9B1EB064-760A-489F-82B2-745519AE4029}';MOM2005ComputerGroupID={50309B32-EE68-4717-97F5-7373C52AA72C}">

  <Category>EventCollection</Category>

  <DataSources>

    <DataSource ID="_65222E18_752A_49B4_BDBF_9FC059C2672D_" Comment="{65222E18-752A-49B4-BDBF-9FC059C2672D}" TypeID="MomBackwardCompatibility!System.Mom.BackwardCompatibility.WmiEventProvider">

      <NameSpace>root\CIMV2</NameSpace>

      <Query>SELECT * from __InstanceModificationEvent WITHIN 50 WHERE TargetInstance ISA "Win32_Service" AND TargetInstance.Name LIKE "DRMS_Logging_%" AND TargetInstance.State = "Stopped"</Query>

      <PollInterval>15</PollInterval>

      <Expression/>

    </DataSource>

  </DataSources>

  <WriteActions>

    <WriteAction ID="GenerateAlert" TypeID="MomBackwardCompatibility!System.Mom.BackwardCompatibility.AlertResponse">

      <AlertGeneration>

        <GenerateAlert>true</GenerateAlert>

        <Owner/>

        <Description>

            $Data/EventDescription$

          </Description>

        <AlertLevel>70</AlertLevel>

        <ResolutionState/>

        <Source>

            $Data/PublisherName$

          </Source>

        <Name>Logging service stopped</Name>

      </AlertGeneration>

      <InvokerType>0</InvokerType>

    </WriteAction>

    <WriteAction ID="CollectEventData" TypeID="SystemCenterLibrary!Microsoft.SystemCenter.CollectEvent"/>

    <WriteAction ID="CollectEventDataWarehouse" TypeID="DataWarehouseLibrary!Microsoft.SystemCenter.DataWarehouse.PublishEventData"/>

  </WriteActions>

</Rule>