Monitor for repetitive crashes with Microsoft Office 2003 Excel.

Microsoft.Office.2003.Excel.RepetitiveCrash.Event.Monitor (UnitMonitor)

Knowledge Base article:

Summary

This Monitor generates an alert when an application repeatedly crashes within a short period of time.

Configuration

The threshold value for the number of repeats and the time period that they can occur within for the threshold to be reached can be modified using the overrides feature.

Resolutions

When an application generates an application error, you can use one of the following options to address the issue:

Look for related support information on the Microsoft Support Website.
Install any service pack or product updates for the relevant application.
Install any service packs or updates for any relevant subsystems that the application depends on.
Remove of the relevant application.

If the same application generates application errors frequently and related support information is unavailable contact Microsoft Product Support.

Element properties:

Target

Microsoft.Office.2003.Excel

Parent Monitor

System.Health.PerformanceState

Category

PerformanceHealth

Enabled

True

Alert Generate

True

Alert Severity

Warning

Alert Priority

Normal

Alert Auto Resolve

True

Monitor Type

Microsoft.Windows.RepeatedEventLogTimer2StateMonitorType

Remotable

True

Accessibility

Public

Alert Message

Microsoft Office 2003 Excel has crashed repetitively.

Microsoft {0} {1} has crashed a number of times in a short period of time and is effecting the end users ability to properly use the application. Information on possible resolutions can be found in Knowledge associated with this alert.

RunAs

Default

Source Code:

<UnitMonitor ID="Microsoft.Office.2003.Excel.RepetitiveCrash.Event.Monitor" Accessibility="Public" Target="Microsoft.Office.2003.Excel" TypeID="Windows!Microsoft.Windows.RepeatedEventLogTimer2StateMonitorType" ParentMonitorID="SystemHealth!System.Health.PerformanceState" ConfirmDelivery="false" Remotable="true" Enabled="onEssentialMonitoring" Priority="Normal">

  <Category>PerformanceHealth</Category>

  <AlertSettings AlertMessage="Microsoft.Office.2003.Excel.RepetitiveCrash.Event.Monitor.AlertMessage">

    <AlertOnState>Warning</AlertOnState>

    <AutoResolve>true</AutoResolve>

    <AlertPriority>Normal</AlertPriority>

    <AlertSeverity>Warning</AlertSeverity>

    <AlertParameters>

      <AlertParameter1>Office</AlertParameter1>

      <AlertParameter2>Excel</AlertParameter2>

    </AlertParameters>

  </AlertSettings>

  <OperationalStates>

    <OperationalState ID="RepetitivelyCrashing" HealthState="Warning" MonitorTypeStateID="RepeatedEventRaised"/>

    <OperationalState ID="Healthy" HealthState="Success" MonitorTypeStateID="TimerEventRaised"/>

  </OperationalStates>

  <Configuration>

    <RepeatedComputerName>$Target/Host/Property[Type="Windows!Microsoft.Windows.Computer"]/PrincipalName$</RepeatedComputerName>

    <RepeatedLogName>Application</RepeatedLogName>

    <RepeatedExpression>

      <And>

        <Expression>

          <RegExExpression>

            <ValueExpression>

              <XPathQuery>Params/Param[1]</XPathQuery>

            </ValueExpression>

            <Operator>ContainsSubstring</Operator>

            <Pattern>$Target/Property[Type="IWCommon!Microsoft.Office.Excel"]/FileName$</Pattern>

          </RegExExpression>

        </Expression>

        <Expression>

          <Or>

            <Expression>

              <And>

                <Expression>

                  <SimpleExpression>

                    <ValueExpression>

                      <XPathQuery>PublisherName</XPathQuery>

                    </ValueExpression>

                    <Operator>Equal</Operator>

                    <ValueExpression>

                      <Value>DrWatson</Value>

                    </ValueExpression>

                  </SimpleExpression>

                </Expression>

                <Expression>

                  <SimpleExpression>

                    <ValueExpression>

                      <XPathQuery>EventDisplayNumber</XPathQuery>

                    </ValueExpression>

                    <Operator>Equal</Operator>

                    <ValueExpression>

                      <Value>4097</Value>

                    </ValueExpression>

                  </SimpleExpression>

                </Expression>

              </And>

            </Expression>

            <Expression>

              <And>

                <Expression>

                  <Or>

                    <Expression>

                      <RegExExpression>

                        <ValueExpression>

                          <XPathQuery>PublisherName</XPathQuery>

                        </ValueExpression>

                        <Operator>ContainsSubstring</Operator>

                        <Pattern>Application Error</Pattern>

                      </RegExExpression>

                    </Expression>

                    <Expression>

                      <RegExExpression>

                        <ValueExpression>

                          <XPathQuery>PublisherName</XPathQuery>

                        </ValueExpression>

                        <Operator>ContainsSubstring</Operator>

                        <Pattern>Microsoft Office</Pattern>

                      </RegExExpression>

                    </Expression>

                  </Or>

                </Expression>

                <Expression>

                  <SimpleExpression>

                    <ValueExpression>

                      <XPathQuery>EventDisplayNumber</XPathQuery>

                    </ValueExpression>

                    <Operator>Equal</Operator>

                    <ValueExpression>

                      <Value>1000</Value>

                    </ValueExpression>

                  </SimpleExpression>

                </Expression>

              </And>

            </Expression>

          </Or>

        </Expression>

      </And>

    </RepeatedExpression>

    <Consolidator>

      <ConsolidationProperties/>

      <TimeControl>

        <WithinTimeSchedule>

          <Interval>3600</Interval>

        </WithinTimeSchedule>

      </TimeControl>

      <CountingCondition>

        <Count>4</Count>

        <CountMode>OnNewItemTestOutputRestart_OnTimerSlideByOne</CountMode>

      </CountingCondition>

    </Consolidator>

    <TimerWaitInSeconds>86400</TimerWaitInSeconds>

  </Configuration>

</UnitMonitor>