Client Monitoring Error Event collection rule

Microsoft.SystemCenter.CM.AEM.Internal.EventCollection (Rule)

This rule enables collecting error events from the Client Monitoring file share

Knowledge Base article:

Element properties:

Member Modules:

Source Code:

<Rule ID="Microsoft.SystemCenter.CM.AEM.Internal.EventCollection" Target="AEMLib!Microsoft.SystemCenter.CM.AEM.CrashListener" Enabled="true" ConfirmDelivery="true">

  <Category>EventCollection</Category>

  <DataSources>

    <DataSource ID="TimedCLFDS" TypeID="Microsoft.SystemCenter.CM.AEM.Internal.TimedCrashListenerFillerDS">

      <Scheduler>

        <SimpleReccuringSchedule>

          <Interval Unit="Minutes">1</Interval>

        </SimpleReccuringSchedule>

        <ExcludeDates/>

      </Scheduler>

      <CrashListenerConfiguration>

        <Location>$Target/Property[Type="AEMLib!Microsoft.SystemCenter.CM.AEM.CrashListener"]/SharePath$</Location>

        <CabRetention>

          <DefaultWatsonCabsCount>$Target/Property[Type="AEMLib!Microsoft.SystemCenter.CM.AEM.CrashListener"]/MaxNumberCabsToCollect$</DefaultWatsonCabsCount>

        </CabRetention>

        <Filters>$Target/Property[Type="AEMLib!Microsoft.SystemCenter.CM.AEM.CrashListener"]/ErrorTransmissionFilters$</Filters>

        <FileShareConfig>

          <On>$Target/Property[Type="AEMLib!Microsoft.SystemCenter.CM.AEM.CrashListener"]/EnablePreVistaClients$</On>

          <ExceptionFolders>$Target/Property[Type="AEMLib!Microsoft.SystemCenter.CM.AEM.CrashListener"]/ExceptionFolders$</ExceptionFolders>

        </FileShareConfig>

        <HttpListenerConfig>

          <On>$Target/Property[Type="AEMLib!Microsoft.SystemCenter.CM.AEM.CrashListener"]/EnableVistaPostClients$</On>

          <Protocol>$Target/Property[Type="AEMLib!Microsoft.SystemCenter.CM.AEM.CrashListener"]/Protocol$</Protocol>

          <Port>$Target/Property[Type="AEMLib!Microsoft.SystemCenter.CM.AEM.CrashListener"]/Port$</Port>

          <UseWindowsAuth>$Target/Property[Type="AEMLib!Microsoft.SystemCenter.CM.AEM.CrashListener"]/UseWindowsAuth$</UseWindowsAuth>

          <MaxXmlSize>10240</MaxXmlSize>

          <MaxCabSize>8589934592</MaxCabSize>

        </HttpListenerConfig>

      </CrashListenerConfiguration>

    </DataSource>

  </DataSources>

  <WriteActions>

    <WriteAction ID="EvtMapperWA" TypeID="Microsoft.SystemCenter.CM.AEM.Internal.EventMapperWA">

      <Event>

        <UniqueInfo IsXpath="true">//CrashInfo/BucketData/*/BucketData/BucketId</UniqueInfo>

        <Detailed>

          <EventXmlBlob IsXpath="true">//CrashInfo/BucketData/*/BucketData/Reports/ReportData</EventXmlBlob>

          <ManagedEntityId Global="true" If="//CrashInfo/BucketData">

            <Value IsXpath="true">//CrashInfo/BucketData/*/BucketData/BucketManagedEntityId</Value>

          </ManagedEntityId>

          <TimeGenerated IsXpath="true">ReportData/HitTime</TimeGenerated>

          <EventOriginId Action="New"/>

          <EventSourceId Action="Value">C07BEC75-EE65-4774-A422-CAA1E6F0A171</EventSourceId>

          <EventSourceName IsXpath="false">Client Monitoring</EventSourceName>

          <EventChannelName IsXpath="false">$Target/Property[Type="System!System.Entity"]/DisplayName$</EventChannelName>

          <EventMachineName IsXpath="true">ReportData/CabInfo/CabInfo/MachineName</EventMachineName>

          <EventNumber IsXpath="false">9999</EventNumber>

          <EventCategory IsXpath="false">0</EventCategory>

          <EventLevel IsXpath="false">Error</EventLevel>

          <EventUserName IsXpath="true">ReportData/CabInfo/CabInfo/UserName</EventUserName>

          <EventParams>

            <Param IsXpath="true">ReportData/CabFileName</Param>

          </EventParams>

          <RuleId>$MPElement$</RuleId>

          <EventMessages>

            <EventMessage>

              <Message IsXpath="false">Cab Path: &lt;a href="%1" target="_blank"&gt;%1&lt;/a&gt;</Message>

              <Locale IsXpath="false">0</Locale>

            </EventMessage>

          </EventMessages>

        </Detailed>

      </Event>

    </WriteAction>

  </WriteActions>

</Rule>