AVIcode Intercept Service Found Monitor Type

Microsoft.SystemCenter.Apm.AVIcodeInterceptServiceFoundMonitorType (UnitMonitorType)

Element properties:

Show References:
- Unit Monitors (1)
RunAs	Default
Accessibility	Internal
Support Monitor Recalculate	False
Member Modules:

ID	Module Type	TypeId	RunAs
Scheduler	DataSource	System.Scheduler	Default
RegistryProbe	ProbeAction	Microsoft.Windows.RegistryProbe	Default
InterceptFound	ConditionDetection	System.ExpressionFilter	Default
InterceptNotFound	ConditionDetection	System.ExpressionFilter	Default
Overrideable Parameters:

ID	ParameterType	Selector	Display Name	Description
Frequency	int	$Config/Frequency$	Frequency (sec)
Source Code:

<UnitMonitorType ID="Microsoft.SystemCenter.Apm.AVIcodeInterceptServiceFoundMonitorType" Accessibility="Internal">

  <MonitorTypeStates>

    <MonitorTypeState ID="InterceptServiceFound"/>

    <MonitorTypeState ID="InterceptServiceNotFound"/>

  </MonitorTypeStates>

  <Configuration>

    <xsd:element xmlns:xsd="http://www.w3.org/2001/XMLSchema" name="ComputerName" type="xsd:string"/>

    <xsd:element xmlns:xsd="http://www.w3.org/2001/XMLSchema" name="Frequency" type="xsd:int"/>

    <xsd:element xmlns:xsd="http://www.w3.org/2001/XMLSchema" name="WindowsVersion" type="xsd:float"/>

  </Configuration>

  <OverrideableParameters>

    <OverrideableParameter ID="Frequency" ParameterType="int" Selector="$Config/Frequency$"/>

  </OverrideableParameters>

  <MonitorImplementation>

    <MemberModules>

      <DataSource TypeID="System!System.Scheduler" ID="Scheduler">

        <Scheduler>

          <SimpleReccuringSchedule>

            <Interval Unit="Seconds">$Config/Frequency$</Interval>

          </SimpleReccuringSchedule>

          <ExcludeDates/>

        </Scheduler>

      </DataSource>

      <ProbeAction TypeID="Windows!Microsoft.Windows.RegistryProbe" ID="RegistryProbe">

        <ComputerName>$Config/ComputerName$</ComputerName>

        <RegistryAttributeDefinitions>

          <RegistryAttributeDefinition>

            <AttributeName>WindowsCurrentVersion</AttributeName>

            <Path>SOFTWARE\Microsoft\Windows NT\CurrentVersion\CurrentVersion</Path>

            <PathType>1</PathType>

            <AttributeType>3</AttributeType>

          </RegistryAttributeDefinition>

          <RegistryAttributeDefinition>

            <AttributeName>WindowsInstallationType</AttributeName>

            <Path>SOFTWARE\Microsoft\Windows NT\CurrentVersion\InstallationType</Path>

            <PathType>1</PathType>

            <AttributeType>1</AttributeType>

          </RegistryAttributeDefinition>

          <RegistryAttributeDefinition>

            <AttributeName>IS_MOMASPAGENT_INSTALLED</AttributeName>

            <Path>SYSTEM\CurrentControlSet\services\eventlog\Application\MOMASP.MOMASPMonitor</Path>

            <PathType>0</PathType>

            <AttributeType>0</AttributeType>

          </RegistryAttributeDefinition>

          <RegistryAttributeDefinition>

            <AttributeName>InterceptServiceName</AttributeName>

            <Path>SYSTEM\CurrentControlSet\services\Intercept Service\DisplayName</Path>

            <PathType>1</PathType>

            <AttributeType>1</AttributeType>

          </RegistryAttributeDefinition>

        </RegistryAttributeDefinitions>

      </ProbeAction>

      <ConditionDetection TypeID="System!System.ExpressionFilter" ID="InterceptFound">

        <Expression>

          <And>

            <Expression>

              <And>

                <Expression>

                  <SimpleExpression>

                    <ValueExpression>

                      <XPathQuery Type="Double">Values/WindowsCurrentVersion</XPathQuery>

                    </ValueExpression>

                    <Operator>GreaterEqual</Operator>

                    <ValueExpression>

                      <Value Type="Double">$Config/WindowsVersion$</Value>

                    </ValueExpression>

                  </SimpleExpression>

                </Expression>

                <Expression>

                  <SimpleExpression>

                    <ValueExpression>

                      <XPathQuery Type="String">Values/WindowsInstallationType</XPathQuery>

                    </ValueExpression>

                    <Operator>Equal</Operator>

                    <ValueExpression>

                      <Value Type="String">Server</Value>

                    </ValueExpression>

                  </SimpleExpression>

                </Expression>

              </And>

            </Expression>

            <Expression>

              <Or>

                <Expression>

                  <SimpleExpression>

                    <ValueExpression>

                      <XPathQuery Type="Boolean">Values/IS_MOMASPAGENT_INSTALLED</XPathQuery>

                    </ValueExpression>

                    <Operator>Equal</Operator>

                    <ValueExpression>

                      <Value Type="Boolean">true</Value>

                    </ValueExpression>

                  </SimpleExpression>

                </Expression>

                <Expression>

                  <SimpleExpression>

                    <ValueExpression>

                      <XPathQuery Type="String">Values/InterceptServiceName</XPathQuery>

                    </ValueExpression>

                    <Operator>Equal</Operator>

                    <ValueExpression>

                      <Value Type="String">Intercept Service</Value>

                    </ValueExpression>

                  </SimpleExpression>

                </Expression>

              </Or>

            </Expression>

          </And>

        </Expression>

      </ConditionDetection>

      <ConditionDetection TypeID="System!System.ExpressionFilter" ID="InterceptNotFound">

        <Expression>

          <Or>

            <Expression>

              <SimpleExpression>

                <ValueExpression>

                  <XPathQuery Type="Double">Values/WindowsCurrentVersion</XPathQuery>

                </ValueExpression>

                <Operator>Less</Operator>

                <ValueExpression>

                  <Value Type="Double">$Config/WindowsVersion$</Value>

                </ValueExpression>

              </SimpleExpression>

            </Expression>

            <Expression>

              <SimpleExpression>

                <ValueExpression>

                  <XPathQuery Type="String">Values/WindowsInstallationType</XPathQuery>

                </ValueExpression>

                <Operator>NotEqual</Operator>

                <ValueExpression>

                  <Value Type="String">Server</Value>

                </ValueExpression>

              </SimpleExpression>

            </Expression>

            <Expression>

              <And>

                <Expression>

                  <SimpleExpression>

                    <ValueExpression>

                      <XPathQuery Type="Double">Values/WindowsCurrentVersion</XPathQuery>

                    </ValueExpression>

                    <Operator>GreaterEqual</Operator>

                    <ValueExpression>

                      <Value Type="Double">$Config/WindowsVersion$</Value>

                    </ValueExpression>

                  </SimpleExpression>

                </Expression>

                <Expression>

                  <SimpleExpression>

                    <ValueExpression>

                      <XPathQuery Type="Boolean">Values/IS_MOMASPAGENT_INSTALLED</XPathQuery>

                    </ValueExpression>

                    <Operator>Equal</Operator>

                    <ValueExpression>

                      <Value Type="Boolean">false</Value>

                    </ValueExpression>

                  </SimpleExpression>

                </Expression>

                <Expression>

                  <SimpleExpression>

                    <ValueExpression>

                      <XPathQuery Type="String">Values/InterceptServiceName</XPathQuery>

                    </ValueExpression>

                    <Operator>NotEqual</Operator>

                    <ValueExpression>

                      <Value Type="String">Intercept Service</Value>

                    </ValueExpression>

                  </SimpleExpression>

                </Expression>

              </And>

            </Expression>

          </Or>

        </Expression>

      </ConditionDetection>

    </MemberModules>

    <RegularDetections>

      <RegularDetection MonitorTypeStateID="InterceptServiceFound">

        <Node ID="InterceptFound">

          <Node ID="RegistryProbe">

            <Node ID="Scheduler"/>

          </Node>

        </Node>

      </RegularDetection>

      <RegularDetection MonitorTypeStateID="InterceptServiceNotFound">

        <Node ID="InterceptNotFound">

          <Node ID="RegistryProbe">

            <Node ID="Scheduler"/>

          </Node>

        </Node>

      </RegularDetection>

    </RegularDetections>

  </MonitorImplementation>

</UnitMonitorType>