Paired Event (Delayed) monitor type

Microsoft.LS.2013.MonitorType.PairedEvent.Delayed (UnitMonitorType)

Element properties:

Member Modules:

Source Code:

<UnitMonitorType ID="Microsoft.LS.2013.MonitorType.PairedEvent.Delayed" Accessibility="Public">

  <MonitorTypeStates>

    <MonitorTypeState ID="SuccessEventRaised" NoDetection="false"/>

    <MonitorTypeState ID="WarningEventRaised" NoDetection="false"/>

    <MonitorTypeState ID="ErrorEventRaised" NoDetection="false"/>

  </MonitorTypeStates>

  <Configuration>

    <IncludeSchemaTypes>

      <SchemaType>System!System.ExpressionEvaluatorSchema</SchemaType>

    </IncludeSchemaTypes>

    <xsd:element xmlns:xsd="http://www.w3.org/2001/XMLSchema" name="ComputerName" type="xsd:string"/>

    <xsd:element xmlns:xsd="http://www.w3.org/2001/XMLSchema" name="LogName" type="xsd:string"/>

    <xsd:element xmlns:xsd="http://www.w3.org/2001/XMLSchema" name="SuccessExpression" type="ExpressionType"/>

    <xsd:element xmlns:xsd="http://www.w3.org/2001/XMLSchema" name="ErrorExpression" type="ExpressionType"/>

    <xsd:element xmlns:xsd="http://www.w3.org/2001/XMLSchema" name="DelayWindowInSeconds" type="xsd:unsignedInt"/>

  </Configuration>

  <MonitorImplementation>

    <MemberModules>

      <DataSource ID="EventDataSource" TypeID="Windows!Microsoft.Windows.BaseEventProvider">

        <ComputerName>$Config/ComputerName$</ComputerName>

        <LogName>$Config/LogName$</LogName>

      </DataSource>

      <ConditionDetection ID="SuccessFilterCondition" TypeID="System!System.ExpressionFilter">

        <Expression>$Config/SuccessExpression$</Expression>

      </ConditionDetection>

      <ConditionDetection ID="ErrorFilterCondition" TypeID="System!System.ExpressionFilter">

        <Expression>$Config/ErrorExpression$</Expression>

      </ConditionDetection>

      <ConditionDetection ID="MissingDataCondition" TypeID="System!System.CorrelatorAutoMissingCondition">

        <Correlator>

          <CorrelationExpression>

            <Expression/>

          </CorrelationExpression>

          <Count>1</Count>

          <Interval>$Config/DelayWindowInSeconds$</Interval>

          <CorrelationOrder>InSequence</CorrelationOrder>

          <CorrelationItemPolicy>ResetWindow</CorrelationItemPolicy>

        </Correlator>

      </ConditionDetection>

    </MemberModules>

    <RegularDetections>

      <RegularDetection MonitorTypeStateID="SuccessEventRaised">

        <Node ID="SuccessFilterCondition">

          <Node ID="EventDataSource"/>

        </Node>

      </RegularDetection>

      <RegularDetection MonitorTypeStateID="WarningEventRaised">

        <Node ID="ErrorFilterCondition">

          <Node ID="EventDataSource"/>

        </Node>

      </RegularDetection>

      <RegularDetection MonitorTypeStateID="ErrorEventRaised">

        <Node ID="MissingDataCondition">

          <Node ID="ErrorFilterCondition">

            <Node ID="EventDataSource"/>

          </Node>

          <Node ID="SuccessFilterCondition">

            <Node ID="EventDataSource"/>

          </Node>

        </Node>

      </RegularDetection>

    </RegularDetections>

  </MonitorImplementation>

</UnitMonitorType>