Used by monitors that need to correlate an event with a missing event.
RunAs | Default |
Accessibility | Internal |
Support Monitor Recalculate | False |
ID | Module Type | TypeId | RunAs |
---|---|---|---|
DataSource | DataSource | Microsoft.Windows.BaseEventProvider | Default |
FirstCorrelatedMissingEventErrorDataSource | DataSource | Microsoft.Windows.BaseEventProvider | Default |
FirstCorrelatedMissingEventWarningDataSource | DataSource | Microsoft.Windows.BaseEventProvider | Default |
SecondCorrelatedMissingEventErrorDataSource | DataSource | Microsoft.Windows.BaseEventProvider | Default |
SecondCorrelatedMissingEventWarningDataSource | DataSource | Microsoft.Windows.BaseEventProvider | Default |
FilterCondition | ConditionDetection | System.ExpressionFilter | Default |
FirstCorrelatedMissingEventFilterErrorCondition | ConditionDetection | System.ExpressionFilter | Default |
FirstCorrelatedMissingEventFilterWarningCondition | ConditionDetection | System.ExpressionFilter | Default |
MissingCorrelatedDataErrorCondition | ConditionDetection | System.CorrelatorAutoMissingCondition | Default |
MissingCorrelatedDataWarningCondition | ConditionDetection | System.CorrelatorAutoMissingCondition | Default |
SecondCorrelatedMissingEventFilterErrorCondition | ConditionDetection | System.ExpressionFilter | Default |
SecondCorrelatedMissingEventFilterWarningCondition | ConditionDetection | System.ExpressionFilter | Default |
<UnitMonitorType ID="Microsoft.SystemCenter.HealthServiceModules.CorrelatedEventAndMissingEvent" Accessibility="Internal">
<MonitorTypeStates>
<MonitorTypeState ID="SuccessEventRaised" NoDetection="false"/>
<MonitorTypeState ID="CorrelatedMissingEventWarningRaised" NoDetection="false"/>
<MonitorTypeState ID="CorrelatedMissingEventErrorRaised" NoDetection="false"/>
</MonitorTypeStates>
<Configuration>
<IncludeSchemaTypes>
<SchemaType>System!System.ExpressionEvaluatorSchema</SchemaType>
</IncludeSchemaTypes>
<xsd:element name="ComputerName" type="xsd:string"/>
<xsd:element name="LogName" type="xsd:string"/>
<xsd:element name="Expression" type="ExpressionType"/>
<xsd:element name="FirstCorrelatedMissingEventWarningComputerName" type="xsd:string"/>
<xsd:element name="FirstCorrelatedMissingEventWarningLogName" type="xsd:string"/>
<xsd:element name="FirstCorrelatedMissingEventWarningExpression" type="ExpressionType"/>
<xsd:element name="SecondCorrelatedMissingEventWarningComputerName" type="xsd:string"/>
<xsd:element name="SecondCorrelatedMissingEventWarningLogName" type="xsd:string"/>
<xsd:element name="SecondCorrelatedMissingEventWarningExpression" type="ExpressionType"/>
<xsd:element name="CorrelatorWarning" type="CorrelatorType"/>
<xsd:element name="FirstCorrelatedMissingEventErrorComputerName" type="xsd:string"/>
<xsd:element name="FirstCorrelatedMissingEventErrorLogName" type="xsd:string"/>
<xsd:element name="FirstCorrelatedMissingEventErrorExpression" type="ExpressionType"/>
<xsd:element name="SecondCorrelatedMissingEventErrorComputerName" type="xsd:string"/>
<xsd:element name="SecondCorrelatedMissingEventErrorLogName" type="xsd:string"/>
<xsd:element name="SecondCorrelatedMissingEventErrorExpression" type="ExpressionType"/>
<xsd:element name="CorrelatorError" type="CorrelatorType"/>
</Configuration>
<MonitorImplementation>
<MemberModules>
<DataSource ID="DataSource" TypeID="Windows!Microsoft.Windows.BaseEventProvider">
<ComputerName>$Config/ComputerName$</ComputerName>
<LogName>$Config/LogName$</LogName>
</DataSource>
<DataSource ID="FirstCorrelatedMissingEventWarningDataSource" TypeID="Windows!Microsoft.Windows.BaseEventProvider">
<ComputerName>$Config/FirstCorrelatedMissingEventWarningComputerName$</ComputerName>
<LogName>$Config/FirstCorrelatedMissingEventWarningLogName$</LogName>
</DataSource>
<DataSource ID="SecondCorrelatedMissingEventWarningDataSource" TypeID="Windows!Microsoft.Windows.BaseEventProvider">
<ComputerName>$Config/SecondCorrelatedMissingEventWarningComputerName$</ComputerName>
<LogName>$Config/SecondCorrelatedMissingEventWarningLogName$</LogName>
</DataSource>
<DataSource ID="FirstCorrelatedMissingEventErrorDataSource" TypeID="Windows!Microsoft.Windows.BaseEventProvider">
<ComputerName>$Config/FirstCorrelatedMissingEventErrorComputerName$</ComputerName>
<LogName>$Config/FirstCorrelatedMissingEventErrorLogName$</LogName>
</DataSource>
<DataSource ID="SecondCorrelatedMissingEventErrorDataSource" TypeID="Windows!Microsoft.Windows.BaseEventProvider">
<ComputerName>$Config/SecondCorrelatedMissingEventErrorComputerName$</ComputerName>
<LogName>$Config/SecondCorrelatedMissingEventErrorLogName$</LogName>
</DataSource>
<ConditionDetection ID="FilterCondition" TypeID="System!System.ExpressionFilter">
<Expression>$Config/Expression$</Expression>
</ConditionDetection>
<ConditionDetection ID="FirstCorrelatedMissingEventFilterWarningCondition" TypeID="System!System.ExpressionFilter">
<Expression>$Config/FirstCorrelatedMissingEventWarningExpression$</Expression>
</ConditionDetection>
<ConditionDetection ID="SecondCorrelatedMissingEventFilterWarningCondition" TypeID="System!System.ExpressionFilter">
<Expression>$Config/SecondCorrelatedMissingEventWarningExpression$</Expression>
</ConditionDetection>
<ConditionDetection ID="FirstCorrelatedMissingEventFilterErrorCondition" TypeID="System!System.ExpressionFilter">
<Expression>$Config/FirstCorrelatedMissingEventErrorExpression$</Expression>
</ConditionDetection>
<ConditionDetection ID="SecondCorrelatedMissingEventFilterErrorCondition" TypeID="System!System.ExpressionFilter">
<Expression>$Config/SecondCorrelatedMissingEventErrorExpression$</Expression>
</ConditionDetection>
<ConditionDetection ID="MissingCorrelatedDataWarningCondition" TypeID="System!System.CorrelatorAutoMissingCondition">
<Correlator>$Config/CorrelatorWarning$</Correlator>
</ConditionDetection>
<ConditionDetection ID="MissingCorrelatedDataErrorCondition" TypeID="System!System.CorrelatorAutoMissingCondition">
<Correlator>$Config/CorrelatorError$</Correlator>
</ConditionDetection>
</MemberModules>
<RegularDetections>
<RegularDetection MonitorTypeStateID="CorrelatedMissingEventErrorRaised">
<Node ID="MissingCorrelatedDataErrorCondition">
<Node ID="FirstCorrelatedMissingEventFilterErrorCondition">
<Node ID="FirstCorrelatedMissingEventErrorDataSource"/>
</Node>
<Node ID="SecondCorrelatedMissingEventFilterErrorCondition">
<Node ID="SecondCorrelatedMissingEventErrorDataSource"/>
</Node>
</Node>
</RegularDetection>
<RegularDetection MonitorTypeStateID="CorrelatedMissingEventWarningRaised">
<Node ID="MissingCorrelatedDataWarningCondition">
<Node ID="FirstCorrelatedMissingEventFilterWarningCondition">
<Node ID="FirstCorrelatedMissingEventWarningDataSource"/>
</Node>
<Node ID="SecondCorrelatedMissingEventFilterWarningCondition">
<Node ID="SecondCorrelatedMissingEventWarningDataSource"/>
</Node>
</Node>
</RegularDetection>
<RegularDetection MonitorTypeStateID="SuccessEventRaised">
<Node ID="FilterCondition">
<Node ID="DataSource"/>
</Node>
</RegularDetection>
</RegularDetections>
</MonitorImplementation>
</UnitMonitorType>