Home
  •  

Federation server events collection

Microsoft.ActiveDirectoryFederationServices.2016.FederationServerEventCollectionRule (Rule)

Knowledge Base article:

Summary

This rule collects events from AD FS/Admin event log.

Causes

This section is not applicable to event collection rules.

Resolutions

There is no resolution to perform for event collection rules since they do not generate state or alerts.

Element properties:

TargetMicrosoft.ActiveDirectoryFederationServices.2016.FederationServer
CategoryEventCollection
EnabledTrue
Alert GenerateFalse
RemotableTrue
Event Log$Target/Property[Type="Microsoft.ActiveDirectoryFederationServices.2016.FederationServer"]/ADFSEventLog$

Member Modules:

ID Module Type TypeId RunAs 
DS DataSource Microsoft.Windows.EventProvider Default
WriteToDB WriteAction Microsoft.SystemCenter.CollectEvent Default
WriteToDW WriteAction Microsoft.SystemCenter.DataWarehouse.PublishEventData Default

Source Code:

<Rule ID="Microsoft.ActiveDirectoryFederationServices.2016.FederationServerEventCollectionRule" Enabled="true" Target="Microsoft.ActiveDirectoryFederationServices.2016.FederationServer" ConfirmDelivery="true" Remotable="true" Priority="Normal" DiscardLevel="100">

  <Category>EventCollection</Category>

  <DataSources>

    <DataSource ID="DS" TypeID="Windows!Microsoft.Windows.EventProvider">

      <ComputerName>$Target/Host/Host/Property[Type="Windows!Microsoft.Windows.Computer"]/NetworkName$</ComputerName>

      <LogName>$Target/Property[Type="Microsoft.ActiveDirectoryFederationServices.2016.FederationServer"]/ADFSEventLog$</LogName>

      <Expression>

        <RegExExpression>

          <ValueExpression>

            <XPathQuery Type="String">PublisherName</XPathQuery>

          </ValueExpression>

          <Operator>MatchesMOM2005RegularExpression</Operator>

          <Pattern>(^AD FS$)</Pattern>

        </RegExExpression>

      </Expression>

    </DataSource>

  </DataSources>

  <WriteActions>

    <WriteAction ID="WriteToDB" TypeID="SC!Microsoft.SystemCenter.CollectEvent"/>

    <WriteAction ID="WriteToDW" TypeID="SCDW!Microsoft.SystemCenter.DataWarehouse.PublishEventData"/>

  </WriteActions>

</Rule>