Scheduled Scan Filter Engine Loading Monitor

Microsoft.ForefrontProtection.FPE.ScheduledScanJob.UnitMonitor.LoadScheduledScanEngines (UnitMonitor)

Checks if the filter engine is loaded correctly by the scheduled scan job.

Knowledge Base article:

Summary

This monitor checks if the filter engine was successfully initialized with the Scheduled scan job. If not, it will generate an alert.

Causes

Damaged or inaccessible Forefront Server Protection filter engine

Resolutions

Reinstall Forefront Protection 2010 for Exchange Server.

Element properties:

Target

Microsoft.ForefrontProtection.FPE.ScheduledScanJobs

Parent Monitor

System.Health.AvailabilityState

Category

Custom

Enabled

True

Alert Generate

True

Alert Severity

Error

Alert Priority

Normal

Alert Auto Resolve

True

Monitor Type

Microsoft.Windows.2SingleEventLog2StateMonitorType

Remotable

True

Accessibility

Public

Alert Message

Scheduled Scan Filter Engine Loading

The filter engine is not loaded correctly for the Scheduled scan job.

RunAs

Default

Source Code:

<UnitMonitor ID="Microsoft.ForefrontProtection.FPE.ScheduledScanJob.UnitMonitor.LoadScheduledScanEngines" Accessibility="Public" Enabled="true" Target="Microsoft.ForefrontProtection.FPE.ScheduledScanJobs" ParentMonitorID="Health!System.Health.AvailabilityState" Remotable="true" Priority="Normal" TypeID="Windows!Microsoft.Windows.2SingleEventLog2StateMonitorType" ConfirmDelivery="true">

  <Category>Custom</Category>

  <AlertSettings AlertMessage="Microsoft.ForefrontProtection.FPE.ScheduledScanJob.UnitMonitor.LoadScheduledScanEngines_AlertMessageResourceID">

    <AlertOnState>Error</AlertOnState>

    <AutoResolve>true</AutoResolve>

    <AlertPriority>Normal</AlertPriority>

    <AlertSeverity>Error</AlertSeverity>

  </AlertSettings>

  <OperationalStates>

    <OperationalState ID="UIGeneratedOpStateId27894bda7c16404b80012c7af7c93ad7" MonitorTypeStateID="FirstEventRaised" HealthState="Error"/>

    <OperationalState ID="UIGeneratedOpStateIddf53d6b8d14c45939ed6d7e7a65eef15" MonitorTypeStateID="SecondEventRaised" HealthState="Success"/>

  </OperationalStates>

  <Configuration>

    <FirstComputerName>$Target/Host/Host/Host/Property[Type="Windows!Microsoft.Windows.Computer"]/NetworkName$</FirstComputerName>

    <FirstLogName>Application</FirstLogName>

    <FirstExpression>

      <And>

        <Expression>

          <SimpleExpression>

            <ValueExpression>

              <XPathQuery Type="UnsignedInteger">EventDisplayNumber</XPathQuery>

            </ValueExpression>

            <Operator>Equal</Operator>

            <ValueExpression>

              <Value Type="UnsignedInteger">5030</Value>

            </ValueExpression>

          </SimpleExpression>

        </Expression>

        <Expression>

          <SimpleExpression>

            <ValueExpression>

              <XPathQuery Type="String">PublisherName</XPathQuery>

            </ValueExpression>

            <Operator>Equal</Operator>

            <ValueExpression>

              <Value Type="String">FSCScheduledScanner</Value>

            </ValueExpression>

          </SimpleExpression>

        </Expression>

      </And>

    </FirstExpression>

    <SecondComputerName>$Target/Host/Host/Host/Property[Type="Windows!Microsoft.Windows.Computer"]/NetworkName$</SecondComputerName>

    <SecondLogName>Application</SecondLogName>

    <SecondExpression>

      <And>

        <Expression>

          <SimpleExpression>

            <ValueExpression>

              <XPathQuery Type="UnsignedInteger">EventDisplayNumber</XPathQuery>

            </ValueExpression>

            <Operator>Equal</Operator>

            <ValueExpression>

              <Value Type="UnsignedInteger">2077</Value>

            </ValueExpression>

          </SimpleExpression>

        </Expression>

        <Expression>

          <SimpleExpression>

            <ValueExpression>

              <XPathQuery Type="String">PublisherName</XPathQuery>

            </ValueExpression>

            <Operator>Equal</Operator>

            <ValueExpression>

              <Value Type="String">FSCScheduledScanner</Value>

            </ValueExpression>

          </SimpleExpression>

        </Expression>

      </And>

    </SecondExpression>

  </Configuration>

</UnitMonitor>