This rule enables collecting error events from the Client Monitoring file share
This rule is used internally for collecting error events from the Client Monitoring file share. This rule should not be overridden as it will have an adverse negative impact on monitoring.
This section is not applicable for this type of rule.
There is no user action for this type of rule.
Target | Microsoft.SystemCenter.CM.AEM.CrashListener |
Category | EventCollection |
Enabled | True |
Alert Generate | False |
Remotable | True |
ID | Module Type | TypeId | RunAs |
---|---|---|---|
TimedCLFDS | DataSource | Microsoft.SystemCenter.CM.AEM.Internal.TimedCrashListenerFillerDS | Default |
EvtMapperWA | WriteAction | Microsoft.SystemCenter.CM.AEM.Internal.EventMapperWA | Default |
<Rule ID="Microsoft.SystemCenter.CM.AEM.Internal.EventCollection" Target="AEMLib!Microsoft.SystemCenter.CM.AEM.CrashListener" Enabled="true" ConfirmDelivery="true">
<Category>EventCollection</Category>
<DataSources>
<DataSource ID="TimedCLFDS" TypeID="Microsoft.SystemCenter.CM.AEM.Internal.TimedCrashListenerFillerDS">
<Scheduler>
<SimpleReccuringSchedule>
<Interval Unit="Minutes">1</Interval>
</SimpleReccuringSchedule>
<ExcludeDates/>
</Scheduler>
<CrashListenerConfiguration>
<Location>$Target/Property[Type="AEMLib!Microsoft.SystemCenter.CM.AEM.CrashListener"]/SharePath$</Location>
<CabRetention>
<DefaultWatsonCabsCount>$Target/Property[Type="AEMLib!Microsoft.SystemCenter.CM.AEM.CrashListener"]/MaxNumberCabsToCollect$</DefaultWatsonCabsCount>
</CabRetention>
<Filters>$Target/Property[Type="AEMLib!Microsoft.SystemCenter.CM.AEM.CrashListener"]/ErrorTransmissionFilters$</Filters>
<FileShareConfig>
<On>$Target/Property[Type="AEMLib!Microsoft.SystemCenter.CM.AEM.CrashListener"]/EnablePreVistaClients$</On>
<ExceptionFolders>$Target/Property[Type="AEMLib!Microsoft.SystemCenter.CM.AEM.CrashListener"]/ExceptionFolders$</ExceptionFolders>
</FileShareConfig>
<HttpListenerConfig>
<On>$Target/Property[Type="AEMLib!Microsoft.SystemCenter.CM.AEM.CrashListener"]/EnableVistaPostClients$</On>
<Protocol>$Target/Property[Type="AEMLib!Microsoft.SystemCenter.CM.AEM.CrashListener"]/Protocol$</Protocol>
<Port>$Target/Property[Type="AEMLib!Microsoft.SystemCenter.CM.AEM.CrashListener"]/Port$</Port>
<UseWindowsAuth>$Target/Property[Type="AEMLib!Microsoft.SystemCenter.CM.AEM.CrashListener"]/UseWindowsAuth$</UseWindowsAuth>
<MaxXmlSize>10240</MaxXmlSize>
<MaxCabSize>8589934592</MaxCabSize>
</HttpListenerConfig>
</CrashListenerConfiguration>
</DataSource>
</DataSources>
<WriteActions>
<WriteAction ID="EvtMapperWA" TypeID="Microsoft.SystemCenter.CM.AEM.Internal.EventMapperWA">
<Event>
<UniqueInfo IsXpath="true">//CrashInfo/BucketData/*/BucketData/BucketId</UniqueInfo>
<Detailed>
<EventXmlBlob IsXpath="true">//CrashInfo/BucketData/*/BucketData/Reports/ReportData</EventXmlBlob>
<ManagedEntityId Global="true" If="//CrashInfo/BucketData">
<Value IsXpath="true">//CrashInfo/BucketData/*/BucketData/BucketManagedEntityId</Value>
</ManagedEntityId>
<TimeGenerated IsXpath="true">ReportData/HitTime</TimeGenerated>
<EventOriginId Action="New"/>
<EventSourceId Action="Value">C07BEC75-EE65-4774-A422-CAA1E6F0A171</EventSourceId>
<EventSourceName IsXpath="false">Client Monitoring</EventSourceName>
<EventChannelName IsXpath="false">$Target/Property[Type="System!System.Entity"]/DisplayName$</EventChannelName>
<EventMachineName IsXpath="true">ReportData/CabInfo/CabInfo/MachineName</EventMachineName>
<EventNumber IsXpath="false">9999</EventNumber>
<EventCategory IsXpath="false">0</EventCategory>
<EventLevel IsXpath="false">Error</EventLevel>
<EventUserName IsXpath="true">ReportData/CabInfo/CabInfo/UserName</EventUserName>
<EventParams>
<Param IsXpath="true">ReportData/CabFileName</Param>
</EventParams>
<RuleId>$MPElement$</RuleId>
<EventMessages>
<EventMessage>
<Message IsXpath="false">Cab Path: <a href="%1" target="_blank">%1</a></Message>
<Locale IsXpath="false">0</Locale>
</EventMessage>
</EventMessages>
</Detailed>
</Event>
</WriteAction>
</WriteActions>
</Rule>