Core Alert: GENERIC WARNING - All warning events from BizTalk Server

Microsoft.BizTalk.Server.2006.GenericWarning (Rule)

Knowledge Base article:

Summary

This is a generic rule to capture all warning events from BizTalk. Enable this rule for troubleshooting scenarios where it is necessary to capture all warning events. Note that there will be duplicate alerts from more specific rules included in the BizTalk management pack.

Causes

Resolutions

This is a generic rule without a specific resolution.

Configuration

Not Available

Additional

Not Available

External

Not Available

Element properties:

Target	Microsoft.BizTalk.2006.BizTalkServer.ServerRole
Category	EventCollection
Enabled	False
Alert Generate	True
Alert Severity	Warning
Alert Priority	Low
Remotable	True
Alert Message	BZDis!Microsoft.BizTalk.Server.2006.GenericWarning.AlertMessage
Event Log	Application

Member Modules:

ID	Module Type	TypeId	RunAs
Microsoft.BizTalk.Server.2006.GenericWarning.DataSource	DataSource	Microsoft.Windows.EventProvider	Default
GenerateAlert	WriteAction	System.Health.GenerateAlert	Default
WriteToDB	WriteAction	Microsoft.SystemCenter.CollectEvent	Default
WriteToDW	WriteAction	Microsoft.SystemCenter.DataWarehouse.PublishEventData	Default

Source Code:

<Rule ID="Microsoft.BizTalk.Server.2006.GenericWarning" Enabled="false" Target="BZLib!Microsoft.BizTalk.2006.BizTalkServer.ServerRole" ConfirmDelivery="true" Remotable="true" Priority="Normal" DiscardLevel="100">

  <Category>EventCollection</Category>

  <DataSources>

    <DataSource ID="Microsoft.BizTalk.Server.2006.GenericWarning.DataSource" TypeID="Windows!Microsoft.Windows.EventProvider">

      <ComputerName>$Target/Property[Type="BZLib!Microsoft.BizTalk.2006.BizTalkServer.ServerRole"]/ComputerName$</ComputerName>

      <LogName>Application</LogName>

      <Expression>

        <And>

          <Expression>

            <Or>

              <Expression>

                <SimpleExpression>

                  <ValueExpression>

                    <XPathQuery Type="String">PublisherName</XPathQuery>

                  </ValueExpression>

                  <Operator>Equal</Operator>

                  <ValueExpression>

                    <Value Type="String">BizTalk Server 2006</Value>

                  </ValueExpression>

                </SimpleExpression>

              </Expression>

              <Expression>

                <SimpleExpression>

                  <ValueExpression>

                    <XPathQuery Type="String">PublisherName</XPathQuery>

                  </ValueExpression>

                  <Operator>Equal</Operator>

                  <ValueExpression>

                    <Value Type="String">BizTalk Server 2009</Value>

                  </ValueExpression>

                </SimpleExpression>

              </Expression>

            </Or>

          </Expression>

          <Expression>

            <SimpleExpression>

              <ValueExpression>

                <XPathQuery Type="Integer">EventLevel</XPathQuery>

              </ValueExpression>

              <Operator>Equal</Operator>

              <ValueExpression>

                <Value>2</Value>

              </ValueExpression>

            </SimpleExpression>

          </Expression>

        </And>

      </Expression>

    </DataSource>

  </DataSources>

  <WriteActions>

    <WriteAction ID="WriteToDB" TypeID="SC!Microsoft.SystemCenter.CollectEvent"/>

    <WriteAction ID="WriteToDW" TypeID="SCDW!Microsoft.SystemCenter.DataWarehouse.PublishEventData"/>

    <WriteAction ID="GenerateAlert" TypeID="Health!System.Health.GenerateAlert">

      <Priority>0</Priority>

      <Severity>1</Severity>

      <AlertMessageId>$MPElement[Name="BZDis!Microsoft.BizTalk.Server.2006.GenericWarning.AlertMessage"]$</AlertMessageId>

      <AlertParameters>

        <AlertParameter1>$Data/EventDescription$</AlertParameter1>

      </AlertParameters>

      <Suppression>

        <SuppressionValue>$Target/Property[Type="BZLib!Microsoft.BizTalk.2006.BizTalkServer.ServerRole"]/ComputerName$</SuppressionValue>

        <SuppressionValue>$Data/EventDisplayNumber$</SuppressionValue>

        <SuppressionValue>$Data/PublisherName$</SuppressionValue>

        <SuppressionValue>$Data/Params/Param[1]$</SuppressionValue>

      </Suppression>

      <Custom1>Core Alerts</Custom1>

    </WriteAction>

  </WriteActions>

</Rule>