此規則能從「用戶端監視」檔案共用中收集錯誤事件
此規則為內部使用,用以從「用戶端監視」檔案共用中收集錯誤事件 不應覆寫此規則,否則會對監視有負面影響。
本部分不適用此規則類型。
此規則類型不需要任何使用者動作。
Target | Microsoft.SystemCenter.CM.AEM.CrashListener |
Category | EventCollection |
Enabled | True |
Alert Generate | False |
Remotable | True |
ID | Module Type | TypeId | RunAs |
---|---|---|---|
TimedCLFDS | DataSource | Microsoft.SystemCenter.CM.AEM.Internal.TimedCrashListenerFillerDS | Default |
EvtMapperWA | WriteAction | Microsoft.SystemCenter.CM.AEM.Internal.EventMapperWA | Default |
<Rule ID="Microsoft.SystemCenter.CM.AEM.Internal.EventCollection" Target="AEMLib!Microsoft.SystemCenter.CM.AEM.CrashListener" Enabled="true" ConfirmDelivery="true">
<Category>EventCollection</Category>
<DataSources>
<DataSource ID="TimedCLFDS" TypeID="Microsoft.SystemCenter.CM.AEM.Internal.TimedCrashListenerFillerDS">
<Scheduler>
<SimpleReccuringSchedule>
<Interval Unit="Minutes">1</Interval>
</SimpleReccuringSchedule>
<ExcludeDates/>
</Scheduler>
<CrashListenerConfiguration>
<Location>$Target/Property[Type="AEMLib!Microsoft.SystemCenter.CM.AEM.CrashListener"]/SharePath$</Location>
<CabRetention>
<DefaultWatsonCabsCount>$Target/Property[Type="AEMLib!Microsoft.SystemCenter.CM.AEM.CrashListener"]/MaxNumberCabsToCollect$</DefaultWatsonCabsCount>
</CabRetention>
<Filters>$Target/Property[Type="AEMLib!Microsoft.SystemCenter.CM.AEM.CrashListener"]/ErrorTransmissionFilters$</Filters>
<FileShareConfig>
<On>$Target/Property[Type="AEMLib!Microsoft.SystemCenter.CM.AEM.CrashListener"]/EnablePreVistaClients$</On>
<ExceptionFolders>$Target/Property[Type="AEMLib!Microsoft.SystemCenter.CM.AEM.CrashListener"]/ExceptionFolders$</ExceptionFolders>
</FileShareConfig>
<HttpListenerConfig>
<On>$Target/Property[Type="AEMLib!Microsoft.SystemCenter.CM.AEM.CrashListener"]/EnableVistaPostClients$</On>
<Protocol>$Target/Property[Type="AEMLib!Microsoft.SystemCenter.CM.AEM.CrashListener"]/Protocol$</Protocol>
<Port>$Target/Property[Type="AEMLib!Microsoft.SystemCenter.CM.AEM.CrashListener"]/Port$</Port>
<UseWindowsAuth>$Target/Property[Type="AEMLib!Microsoft.SystemCenter.CM.AEM.CrashListener"]/UseWindowsAuth$</UseWindowsAuth>
<MaxXmlSize>10240</MaxXmlSize>
<MaxCabSize>8589934592</MaxCabSize>
</HttpListenerConfig>
</CrashListenerConfiguration>
</DataSource>
</DataSources>
<WriteActions>
<WriteAction ID="EvtMapperWA" TypeID="Microsoft.SystemCenter.CM.AEM.Internal.EventMapperWA">
<Event>
<UniqueInfo IsXpath="true">//CrashInfo/BucketData/*/BucketData/BucketId</UniqueInfo>
<Detailed>
<EventXmlBlob IsXpath="true">//CrashInfo/BucketData/*/BucketData/Reports/ReportData</EventXmlBlob>
<ManagedEntityId Global="true" If="//CrashInfo/BucketData">
<Value IsXpath="true">//CrashInfo/BucketData/*/BucketData/BucketManagedEntityId</Value>
</ManagedEntityId>
<TimeGenerated IsXpath="true">ReportData/HitTime</TimeGenerated>
<EventOriginId Action="New"/>
<EventSourceId Action="Value">C07BEC75-EE65-4774-A422-CAA1E6F0A171</EventSourceId>
<EventSourceName IsXpath="false">Client Monitoring</EventSourceName>
<EventChannelName IsXpath="false">$Target/Property[Type="System!System.Entity"]/DisplayName$</EventChannelName>
<EventMachineName IsXpath="true">ReportData/CabInfo/CabInfo/MachineName</EventMachineName>
<EventNumber IsXpath="false">9999</EventNumber>
<EventCategory IsXpath="false">0</EventCategory>
<EventLevel IsXpath="false">Error</EventLevel>
<EventUserName IsXpath="true">ReportData/CabInfo/CabInfo/UserName</EventUserName>
<EventParams>
<Param IsXpath="true">ReportData/CabFileName</Param>
</EventParams>
<RuleId>$MPElement$</RuleId>
<EventMessages>
<EventMessage>
<Message IsXpath="false">Cab Path: %1</Message>
<Locale IsXpath="false">0</Locale>
</EventMessage>
</EventMessages>
</Detailed>
</Event>
</WriteAction>
</WriteActions>
</Rule>