This rule generates an alert when one or more of the Agentless Exception Monitoring (AEM) modules encounters a parameter in an error group containing characters considered invalid by AEM.
AEM has encountered a parameter for an error group containing characters considered invalid by AEM and will move these set of reports to Invalid Data folder on file share.
AEM has encountered a parameter for an error group containing characters considered invalid by AEM: ~!@#$^&*()=+[]{}|;`",<>/?. Information about the error group and parameter is available in the associated Event and Alerts.
If the parameter/error group is valid, add the parameter name in Exception Folders list via SDK class: Microsoft.EnterpriseManagement.Monitoring.ClientMonitoring.AemGlobalSettings. Once this is done, copy over the data from InvalidData\Cabs, InvalidData\Counts to Cabs and Counts folders respectively on the file share for processing.
Target | Microsoft.SystemCenter.ManagementServer | ||
Category | Alert | ||
Enabled | True | ||
Alert Generate | True | ||
Alert Severity | Warning | ||
Alert Priority | Normal | ||
Remotable | True | ||
Alert Message |
|
ID | Module Type | TypeId | RunAs |
---|---|---|---|
DS | DataSource | Microsoft.SystemCenter.CM.AEM.AlertModule | Default |
GenerateAlert | WriteAction | System.Health.GenerateAlert | Default |
<Rule ID="Microsoft.SystemCenter.CM.AEM.ParameterProcessingError.Alert" Enabled="true" Target="SCLibrary!Microsoft.SystemCenter.ManagementServer" ConfirmDelivery="true" Remotable="true" Priority="Normal" DiscardLevel="100">
<Category>Alert</Category>
<DataSources>
<DataSource ID="DS" TypeID="Microsoft.SystemCenter.CM.AEM.AlertModule">
<EventNumber>10923</EventNumber>
<ManagementGroupName>$Target/ManagementGroup/Name$</ManagementGroupName>
</DataSource>
</DataSources>
<WriteActions>
<WriteAction ID="GenerateAlert" TypeID="Health!System.Health.GenerateAlert">
<Priority>1</Priority>
<Severity>1</Severity>
<AlertName/>
<AlertDescription/>
<AlertMessageId>$MPElement[Name='Microsoft.SystemCenter.CM.AEM.ParameterProcessingError.Alert.AlertMessage']$</AlertMessageId>
<AlertParameters>
<AlertParameter1>$Data/EventDescription$</AlertParameter1>
</AlertParameters>
<Suppression>
<SuppressionValue/>
</Suppression>
</WriteAction>
</WriteActions>
</Rule>