This Rule generates alerts when A published RPC service cannot be reached
The RPC filter generates this alert when an RPC client tries to access the RPC server from or via TMG Server and the RPC server port mapper is not available. The alert parameters specify the sockaddr structure of the unreachable RPC server. RPC calls to the specified RPC server will not be served by the RPC filter in TMG server.
The RPC server may be unavailable for the following reasons:
The RPC server is not available.
There is no connectivity to the RPC server, due to network problems or wrong routing information.
The RPC service does not use a port mapper to establish connection.
The RPC server is not compliant with the RPC protocol.
RPC traffic is blocked by a firewall.
Verify connectivity to the RPC server machine from the TMG server.
Check that the RPC server and the RPC service are up and running. (Best practice is to use local RPC client on the server).
Check the routing table on the RPC client, on the TMG Server computer, and on the RPC server. Verify that traffic between the client and server can pass through TMG Server.
For more information about RPC Filter see RPC filter topic in TMG server documentation.
| Target | Microsoft.Forefront.TMG.Server |
| Category | EventCollection |
| Enabled | True |
| Alert Generate | False |
| Remotable | True |
| ID | Module Type | TypeId | RunAs |
|---|---|---|---|
| DS | DataSource | Microsoft.Forefront.TMG.Rule.AlertGenerate.DS | Default |
| WA | WriteAction | Microsoft.Forefront.TMG.Rule.AlertGenerate.WA | Default |
Home
ENU <Rule ID="Microsoft.Forefront.TMG.A_published_RPC_service_cannot_be_reached.Rule" Enabled="true" Target="Microsoft.Forefront.TMG.Server" ConfirmDelivery="true" Remotable="true" Priority="Normal" DiscardLevel="100">
<Category>EventCollection</Category>
<DataSources>
<DataSource ID="DS" TypeID="Microsoft.Forefront.TMG.Rule.AlertGenerate.DS">
<ComputerName>$Target/Host/Property[Type="Windows!Microsoft.Windows.Computer"]/NetworkName$</ComputerName>
<LogName>Application</LogName>
<EventsPattern>^(20021)$</EventsPattern>
<EventType>2</EventType>
<SourcePattern>Forefront TMG RPC Filter</SourcePattern>
</DataSource>
</DataSources>
<WriteActions>
<WriteAction ID="WA" TypeID="Microsoft.Forefront.TMG.Rule.AlertGenerate.WA">
<AlertMessageId>$MPElement[Name="Microsoft.Forefront.TMG.A_published_RPC_service_cannot_be_reached.AlertMessage"]$</AlertMessageId>
<DomainName>$Target/Host/Property[Type="Windows!Microsoft.Windows.Computer"]/DomainDnsName$</DomainName>
<Priority>1</Priority>
<Severity>2</Severity>
</WriteAction>
</WriteActions>
</Rule>