This Rule collects data when a user attempts to access another user's session, Excel Calculation Services denies requests made by the user who does not own the session and logs an event in the Windows Event log.
To get the most current Knowledge Article from the Microsoft TechNet site, visit:
http://go.microsoft.com/fwlink/?LinkId=142739
View all current alerts from this object using this link:
View Alerts
Target | Microsoft.SharePoint.Server.2010.SPServiceInstance.Excel |
Category | EventCollection |
Enabled | True |
Event_ID | 2011 |
Event Source | Microsoft-SharePoint Products-Excel Services Application |
Alert Generate | False |
Remotable | True |
Event Log | Application |
ID | Module Type | TypeId | RunAs |
---|---|---|---|
DS | DataSource | Microsoft.Windows.EventProvider | Default |
WriteToDB | WriteAction | Microsoft.SystemCenter.CollectEvent | Default |
WriteToDW | WriteAction | Microsoft.SystemCenter.DataWarehouse.PublishEventData | Default |
<Rule ID="Microsoft.SharePoint.Server.2010.Excel_Unauthorized_attempt_to_access_a_session" Enabled="true" Target="Microsoft.SharePoint.Server.2010.SPServiceInstance.Excel" ConfirmDelivery="false" Priority="Normal" DiscardLevel="100">
<Category>EventCollection</Category>
<DataSources>
<DataSource ID="DS" TypeID="Windows!Microsoft.Windows.EventProvider">
<ComputerName>$Target/Host/Property[Type="Windows!Microsoft.Windows.Computer"]/NetworkName$</ComputerName>
<LogName>Application</LogName>
<Expression>
<And>
<Expression>
<SimpleExpression>
<ValueExpression>
<XPathQuery Type="UnsignedInteger">EventDisplayNumber</XPathQuery>
</ValueExpression>
<Operator>Equal</Operator>
<ValueExpression>
<Value Type="UnsignedInteger">2011</Value>
</ValueExpression>
</SimpleExpression>
</Expression>
<Expression>
<SimpleExpression>
<ValueExpression>
<XPathQuery Type="String">PublisherName</XPathQuery>
</ValueExpression>
<Operator>Equal</Operator>
<ValueExpression>
<Value Type="String">Microsoft-SharePoint Products-Excel Services Application</Value>
</ValueExpression>
</SimpleExpression>
</Expression>
</And>
</Expression>
</DataSource>
</DataSources>
<WriteActions>
<WriteAction ID="WriteToDB" TypeID="SC!Microsoft.SystemCenter.CollectEvent"/>
<WriteAction ID="WriteToDW" TypeID="SCDW!Microsoft.SystemCenter.DataWarehouse.PublishEventData"/>
</WriteActions>
</Rule>