This Rule generates alerts when A published RPC service cannot be reached
The RPC filter generates this alert when an RPC client tries to access the RPC server from or via ISA Server and the RPC server port mapper is not available. The alert parameters specify the sockaddr structure of the unreachable RPC server. RPC calls to the specified RPC server will not be served by the RPC filter in ISA server.
The RPC server may be unavailable for the following reasons:
The RPC server is not available.
There is no connectivity to the RPC server, due to network problems or wrong routing information.
The RPC service does not use a port mapper to establish connection.
The RPC server is not compliant with the RPC protocol.
RPC traffic is blocked by a firewall.
Verify connectivity to the RPC server machine from the ISA server.
Check that the RPC server and the RPC service are up and running. (Best practice is to use local RPC client on the server).
Check the routing table on the RPC client, on the ISA Server computer, and on the RPC server. Verify that traffic between the client and server can pass through ISA Server.
For more information about RPC Filter see RPC filter topic in ISA server documentation.
| Target | Microsoft.ISAServer.2006.ServerRole |
| Category | EventCollection |
| Enabled | True |
| Alert Generate | False |
| Remotable | True |
| ID | Module Type | TypeId | RunAs |
|---|---|---|---|
| DS | DataSource | Microsoft.ISAServer.2006.Rule.AlertGenerate.DS | Default |
| WA | WriteAction | Microsoft.ISAServer.2006.Rule.AlertGenerate.WA | Default |
Home<Rule ID="Microsoft.ISAServer.2006.A_published_RPC_service_cannot_be_reached.Rule" Enabled="onEssentialMonitoring" Target="Microsoft.ISAServer.2006.ServerRole" ConfirmDelivery="true" Remotable="true" Priority="Normal" DiscardLevel="100">
<Category>EventCollection</Category>
<DataSources>
<DataSource ID="DS" TypeID="Microsoft.ISAServer.2006.Rule.AlertGenerate.DS">
<ComputerName>$Target/Host/Property[Type="Windows!Microsoft.Windows.Computer"]/NetworkName$</ComputerName>
<LogName>Application</LogName>
<EventsPattern>^(20021)$</EventsPattern>
<EventType>2</EventType>
<SourcePattern>ISA Server RPC Filter</SourcePattern>
</DataSource>
</DataSources>
<WriteActions>
<WriteAction ID="WA" TypeID="Microsoft.ISAServer.2006.Rule.AlertGenerate.WA">
<AlertMessageId>$MPElement[Name="Microsoft.ISAServer.2006.A_published_RPC_service_cannot_be_reached.AlertMessage"]$</AlertMessageId>
<DomainName>$Target/Host/Property[Type="Windows!Microsoft.Windows.Computer"]/DomainDnsName$</DomainName>
<Priority>1</Priority>
<Severity>2</Severity>
</WriteAction>
</WriteActions>
</Rule>