Correlated Event and Missing Event Monitor Type

Microsoft.SystemCenter.HealthServiceModules.CorrelatedEventAndMissingEvent (UnitMonitorType)

Used by monitors that need to correlate an event with a missing event.

Element properties:

Member Modules:

Source Code:

<UnitMonitorType ID="Microsoft.SystemCenter.HealthServiceModules.CorrelatedEventAndMissingEvent" Accessibility="Internal">

  <MonitorTypeStates>

    <MonitorTypeState ID="SuccessEventRaised" NoDetection="false"/>

    <MonitorTypeState ID="CorrelatedMissingEventWarningRaised" NoDetection="false"/>

    <MonitorTypeState ID="CorrelatedMissingEventErrorRaised" NoDetection="false"/>

  </MonitorTypeStates>

  <Configuration>

    <IncludeSchemaTypes>

      <SchemaType>System!System.ExpressionEvaluatorSchema</SchemaType>

    </IncludeSchemaTypes>

    <xsd:element name="ComputerName" type="xsd:string"/>

    <xsd:element name="LogName" type="xsd:string"/>

    <xsd:element name="Expression" type="ExpressionType"/>

    <xsd:element name="FirstCorrelatedMissingEventWarningComputerName" type="xsd:string"/>

    <xsd:element name="FirstCorrelatedMissingEventWarningLogName" type="xsd:string"/>

    <xsd:element name="FirstCorrelatedMissingEventWarningExpression" type="ExpressionType"/>

    <xsd:element name="SecondCorrelatedMissingEventWarningComputerName" type="xsd:string"/>

    <xsd:element name="SecondCorrelatedMissingEventWarningLogName" type="xsd:string"/>

    <xsd:element name="SecondCorrelatedMissingEventWarningExpression" type="ExpressionType"/>

    <xsd:element name="CorrelatorWarning" type="CorrelatorType"/>

    <xsd:element name="FirstCorrelatedMissingEventErrorComputerName" type="xsd:string"/>

    <xsd:element name="FirstCorrelatedMissingEventErrorLogName" type="xsd:string"/>

    <xsd:element name="FirstCorrelatedMissingEventErrorExpression" type="ExpressionType"/>

    <xsd:element name="SecondCorrelatedMissingEventErrorComputerName" type="xsd:string"/>

    <xsd:element name="SecondCorrelatedMissingEventErrorLogName" type="xsd:string"/>

    <xsd:element name="SecondCorrelatedMissingEventErrorExpression" type="ExpressionType"/>

    <xsd:element name="CorrelatorError" type="CorrelatorType"/>

  </Configuration>

  <MonitorImplementation>

    <MemberModules>

      <DataSource ID="DataSource" TypeID="Windows!Microsoft.Windows.BaseEventProvider">

        <ComputerName>$Config/ComputerName$</ComputerName>

        <LogName>$Config/LogName$</LogName>

      </DataSource>

      <DataSource ID="FirstCorrelatedMissingEventWarningDataSource" TypeID="Windows!Microsoft.Windows.BaseEventProvider">

        <ComputerName>$Config/FirstCorrelatedMissingEventWarningComputerName$</ComputerName>

        <LogName>$Config/FirstCorrelatedMissingEventWarningLogName$</LogName>

      </DataSource>

      <DataSource ID="SecondCorrelatedMissingEventWarningDataSource" TypeID="Windows!Microsoft.Windows.BaseEventProvider">

        <ComputerName>$Config/SecondCorrelatedMissingEventWarningComputerName$</ComputerName>

        <LogName>$Config/SecondCorrelatedMissingEventWarningLogName$</LogName>

      </DataSource>

      <DataSource ID="FirstCorrelatedMissingEventErrorDataSource" TypeID="Windows!Microsoft.Windows.BaseEventProvider">

        <ComputerName>$Config/FirstCorrelatedMissingEventErrorComputerName$</ComputerName>

        <LogName>$Config/FirstCorrelatedMissingEventErrorLogName$</LogName>

      </DataSource>

      <DataSource ID="SecondCorrelatedMissingEventErrorDataSource" TypeID="Windows!Microsoft.Windows.BaseEventProvider">

        <ComputerName>$Config/SecondCorrelatedMissingEventErrorComputerName$</ComputerName>

        <LogName>$Config/SecondCorrelatedMissingEventErrorLogName$</LogName>

      </DataSource>

      <ConditionDetection ID="FilterCondition" TypeID="System!System.ExpressionFilter">

        <Expression>$Config/Expression$</Expression>

      </ConditionDetection>

      <ConditionDetection ID="FirstCorrelatedMissingEventFilterWarningCondition" TypeID="System!System.ExpressionFilter">

        <Expression>$Config/FirstCorrelatedMissingEventWarningExpression$</Expression>

      </ConditionDetection>

      <ConditionDetection ID="SecondCorrelatedMissingEventFilterWarningCondition" TypeID="System!System.ExpressionFilter">

        <Expression>$Config/SecondCorrelatedMissingEventWarningExpression$</Expression>

      </ConditionDetection>

      <ConditionDetection ID="FirstCorrelatedMissingEventFilterErrorCondition" TypeID="System!System.ExpressionFilter">

        <Expression>$Config/FirstCorrelatedMissingEventErrorExpression$</Expression>

      </ConditionDetection>

      <ConditionDetection ID="SecondCorrelatedMissingEventFilterErrorCondition" TypeID="System!System.ExpressionFilter">

        <Expression>$Config/SecondCorrelatedMissingEventErrorExpression$</Expression>

      </ConditionDetection>

      <ConditionDetection ID="MissingCorrelatedDataWarningCondition" TypeID="System!System.CorrelatorAutoMissingCondition">

        <Correlator>$Config/CorrelatorWarning$</Correlator>

      </ConditionDetection>

      <ConditionDetection ID="MissingCorrelatedDataErrorCondition" TypeID="System!System.CorrelatorAutoMissingCondition">

        <Correlator>$Config/CorrelatorError$</Correlator>

      </ConditionDetection>

    </MemberModules>

    <RegularDetections>

      <RegularDetection MonitorTypeStateID="CorrelatedMissingEventErrorRaised">

        <Node ID="MissingCorrelatedDataErrorCondition">

          <Node ID="FirstCorrelatedMissingEventFilterErrorCondition">

            <Node ID="FirstCorrelatedMissingEventErrorDataSource"/>

          </Node>

          <Node ID="SecondCorrelatedMissingEventFilterErrorCondition">

            <Node ID="SecondCorrelatedMissingEventErrorDataSource"/>

          </Node>

        </Node>

      </RegularDetection>

      <RegularDetection MonitorTypeStateID="CorrelatedMissingEventWarningRaised">

        <Node ID="MissingCorrelatedDataWarningCondition">

          <Node ID="FirstCorrelatedMissingEventFilterWarningCondition">

            <Node ID="FirstCorrelatedMissingEventWarningDataSource"/>

          </Node>

          <Node ID="SecondCorrelatedMissingEventFilterWarningCondition">

            <Node ID="SecondCorrelatedMissingEventWarningDataSource"/>

          </Node>

        </Node>

      </RegularDetection>

      <RegularDetection MonitorTypeStateID="SuccessEventRaised">

        <Node ID="FilterCondition">

          <Node ID="DataSource"/>

        </Node>

      </RegularDetection>

    </RegularDetections>

  </MonitorImplementation>

</UnitMonitorType>