DEPRECATED - M365 Supplemental - Script Failure Repeated Event Detection Monitor

M365SL.Microsoft.Windows.RepeatedEventLogTimer2StateMonitorType.MT (UnitMonitorType)

Element properties:

Member Modules:

Overrideable Parameters:

Source Code:

<UnitMonitorType ID="M365SL.Microsoft.Windows.RepeatedEventLogTimer2StateMonitorType.MT" Accessibility="Public">

  <MonitorTypeStates>

    <MonitorTypeState ID="RepeatedEventRaised"/>

    <MonitorTypeState ID="TimerEventRaised"/>

  </MonitorTypeStates>

  <Configuration>

    <IncludeSchemaTypes>

      <SchemaType>System!System.ExpressionEvaluatorSchema</SchemaType>

    </IncludeSchemaTypes>

    <xsd:element xmlns:xsd="http://www.w3.org/2001/XMLSchema" name="RepeatedComputerName" minOccurs="1" type="xsd:string"/>

    <xsd:element xmlns:xsd="http://www.w3.org/2001/XMLSchema" name="RepeatedLogName" minOccurs="1" type="xsd:string"/>

    <xsd:element xmlns:xsd="http://www.w3.org/2001/XMLSchema" name="RepeatedLogSource" minOccurs="1" type="xsd:string"/>

    <xsd:element xmlns:xsd="http://www.w3.org/2001/XMLSchema" name="RepeatedRexExEventDisplayNumber" minOccurs="1" type="xsd:string"/>

    <xsd:element xmlns:xsd="http://www.w3.org/2001/XMLSchema" name="RepeatedRexExEventNameSpaceFromScript" minOccurs="0" type="xsd:string"/>

    <xsd:element xmlns:xsd="http://www.w3.org/2001/XMLSchema" name="WithinIntervalSeconds" minOccurs="1" type="xsd:integer"/>

    <xsd:element xmlns:xsd="http://www.w3.org/2001/XMLSchema" name="MatchCount" minOccurs="1" type="xsd:integer"/>

    <xsd:element xmlns:xsd="http://www.w3.org/2001/XMLSchema" name="TimerResetSeconds" minOccurs="1" type="xsd:integer"/>

  </Configuration>

  <OverrideableParameters>

    <OverrideableParameter ID="RepeatedRexExEventDisplayNumber" Selector="$Config/RepeatedRexExEventDisplayNumber$" ParameterType="string"/>

    <OverrideableParameter ID="WithinIntervalSeconds" Selector="$Config/WithinIntervalSeconds$" ParameterType="string"/>

    <OverrideableParameter ID="MatchCount" Selector="$Config/MatchCount$" ParameterType="int"/>

    <OverrideableParameter ID="TimerResetSeconds" Selector="$Config/TimerResetSeconds$" ParameterType="int"/>

  </OverrideableParameters>

  <MonitorImplementation>

    <MemberModules>

      <DataSource TypeID="Windows!Microsoft.Windows.BaseEventProvider" ID="RepeatedDataSource">

        <ComputerName>$Config/RepeatedComputerName$</ComputerName>

        <LogName>$Config/RepeatedLogName$</LogName>

      </DataSource>

      <ProbeAction TypeID="System!System.PassThroughProbe" ID="OnDemandReset"/>

      <ConditionDetection TypeID="System!System.ExpressionFilter" ID="RepeatedFilterCondition">

        <Expression>

          <And>

            <Expression>

              <RegExExpression>

                <ValueExpression>

                  <XPathQuery Type="UnsignedInteger">EventDisplayNumber</XPathQuery>

                </ValueExpression>

                <Operator>MatchesRegularExpression</Operator>

                <Pattern>$Config/RepeatedRexExEventDisplayNumber$</Pattern>

              </RegExExpression>

            </Expression>

            <Expression>

              <SimpleExpression>

                <ValueExpression>

                  <XPathQuery Type="String">PublisherName</XPathQuery>

                </ValueExpression>

                <Operator>Equal</Operator>

                <ValueExpression>

                  <Value Type="String">$Config/RepeatedLogSource$</Value>

                </ValueExpression>

              </SimpleExpression>

            </Expression>

            <!--NameSpace from script should be param 5 (fifth)-->

            <Expression>

              <RegExExpression>

                <ValueExpression>

                  <XPathQuery Type="UnsignedInteger">Params/Param[5]</XPathQuery>

                </ValueExpression>

                <Operator>MatchesRegularExpression</Operator>

                <Pattern>$Config/RepeatedRexExEventNameSpaceFromScript$</Pattern>

              </RegExExpression>

            </Expression>

          </And>

        </Expression>

      </ConditionDetection>

      <ConditionDetection TypeID="System!System.ConsolidatorCondition" ID="RepeatedDataCondition">

        <Consolidator>

          <ConsolidationProperties>

            <PropertyXPathQuery>EventDisplayNumber</PropertyXPathQuery>

            <PropertyXPathQuery>EventLevel</PropertyXPathQuery>

            <PropertyXPathQuery>PublisherName</PropertyXPathQuery>

            <PropertyXPathQuery>Channel</PropertyXPathQuery>

            <PropertyXPathQuery>Params/Param[3]</PropertyXPathQuery>

            <!--ScriptName-->

            <PropertyXPathQuery>Params/Param[4]</PropertyXPathQuery>

            <!--TenantName-->

            <PropertyXPathQuery>Params/Param[5]</PropertyXPathQuery>

            <!--NameSpace-->

          </ConsolidationProperties>

          <TimeControl>

            <WithinTimeSchedule>

              <Interval>$Config/WithinIntervalSeconds$</Interval>

            </WithinTimeSchedule>

          </TimeControl>

          <CountingCondition>

            <Count>$Config/MatchCount$</Count>

            <CountMode>OnNewItemTestOutputRestart_OnTimerSlideByOne</CountMode>

          </CountingCondition>

        </Consolidator>

      </ConditionDetection>

      <ConditionDetection TypeID="System!System.TimerCondition" ID="TimerCondition">

        <TimerWaitInSeconds>$Config/TimerResetSeconds$</TimerWaitInSeconds>

      </ConditionDetection>

    </MemberModules>

    <RegularDetections>

      <RegularDetection MonitorTypeStateID="RepeatedEventRaised">

        <Node ID="RepeatedDataCondition">

          <Node ID="RepeatedFilterCondition">

            <Node ID="RepeatedDataSource"/>

          </Node>

        </Node>

      </RegularDetection>

      <RegularDetection MonitorTypeStateID="TimerEventRaised">

        <Node ID="TimerCondition">

          <Node ID="RepeatedDataCondition">

            <Node ID="RepeatedFilterCondition">

              <Node ID="RepeatedDataSource"/>

            </Node>

          </Node>

        </Node>

      </RegularDetection>

    </RegularDetections>

    <OnDemandDetections>

      <OnDemandDetection MonitorTypeStateID="TimerEventRaised">

        <Node ID="OnDemandReset"/>

      </OnDemandDetection>

    </OnDemandDetections>

  </MonitorImplementation>

</UnitMonitorType>