Fehlerereignisse für RunAs-Konten sammeln

Microsoft.SystemCenter.HealthServiceRunAs.Failure.EventCollection (Rule)

Hiermit wird eine Serie von Ereignissen erfasst, mit denen auf einen Fehler beim Ausführen einer Regel, eines Monitors oder eines Tasks als ausführendes Konto hingewiesen wird.

Knowledge Base article:

Zusammenfassung

Mit dieser Regel werden Ereignisdaten erfasst, die entweder bei der Berichterstattung oder in einer Ansicht verwendet werden.

Element properties:

Target	Microsoft.SystemCenter.HealthService
Category	EventCollection
Enabled	False
Alert Generate	False
Remotable	True
Event Log	Operations Manager

Member Modules:

ID	Module Type	TypeId	RunAs
DS	DataSource	Microsoft.Windows.EventProvider	Default
WriteToDB	WriteAction	Microsoft.SystemCenter.CollectEvent	Default
WriteToDW	WriteAction	Microsoft.SystemCenter.DataWarehouse.PublishEventData	Default

Source Code:

<Rule ID="Microsoft.SystemCenter.HealthServiceRunAs.Failure.EventCollection" Enabled="false" Target="SCLibrary!Microsoft.SystemCenter.HealthService" ConfirmDelivery="true" Remotable="true" Priority="Normal" DiscardLevel="100">

  <Category>EventCollection</Category>

  <DataSources>

    <DataSource ID="DS" TypeID="Windows!Microsoft.Windows.EventProvider">

      <ComputerName>$Target/Host/Property[Type="Windows!Microsoft.Windows.Computer"]/NetworkName$</ComputerName>

      <LogName>Operations Manager</LogName>

      <Expression>

        <And>

          <Expression>

            <SimpleExpression>

              <ValueExpression>

                <XPathQuery Type="String">PublisherName</XPathQuery>

              </ValueExpression>

              <Operator>Equal</Operator>

              <ValueExpression>

                <Value Type="String">HealthService</Value>

              </ValueExpression>

            </SimpleExpression>

          </Expression>

          <Expression>

            <Or>

              <Expression>

                <And>

                  <Expression>

                    <SimpleExpression>

                      <ValueExpression>

                        <Value Type="String">$Target/ManagementGroup/Name$</Value>

                      </ValueExpression>

                      <Operator>Equal</Operator>

                      <ValueExpression>

                        <XPathQuery Type="String">Params/Param[1]</XPathQuery>

                      </ValueExpression>

                    </SimpleExpression>

                  </Expression>

                  <Expression>

                    <Or>

                      <Expression>

                        <SimpleExpression>

                          <ValueExpression>

                            <XPathQuery Type="UnsignedInteger">EventDisplayNumber</XPathQuery>

                          </ValueExpression>

                          <Operator>Equal</Operator>

                          <ValueExpression>

                            <Value Type="UnsignedInteger">7011</Value>

                          </ValueExpression>

                        </SimpleExpression>

                      </Expression>

                      <Expression>

                        <SimpleExpression>

                          <ValueExpression>

                            <XPathQuery Type="UnsignedInteger">EventDisplayNumber</XPathQuery>

                          </ValueExpression>

                          <Operator>Equal</Operator>

                          <ValueExpression>

                            <Value Type="UnsignedInteger">7010</Value>

                          </ValueExpression>

                        </SimpleExpression>

                      </Expression>

                    </Or>

                  </Expression>

                </And>

              </Expression>

              <Expression>

                <And>

                  <Expression>

                    <SimpleExpression>

                      <ValueExpression>

                        <XPathQuery Type="UnsignedInteger">EventDisplayNumber</XPathQuery>

                      </ValueExpression>

                      <Operator>Equal</Operator>

                      <ValueExpression>

                        <Value Type="UnsignedInteger">7002</Value>

                      </ValueExpression>

                    </SimpleExpression>

                  </Expression>

                  <Expression>

                    <SimpleExpression>

                      <ValueExpression>

                        <Value Type="String">$Target/ManagementGroup/Name$</Value>

                      </ValueExpression>

                      <Operator>Equal</Operator>

                      <ValueExpression>

                        <XPathQuery Type="String">Params/Param[3]</XPathQuery>

                      </ValueExpression>

                    </SimpleExpression>

                  </Expression>

                </And>

              </Expression>

              <Expression>

                <And>

                  <Expression>

                    <SimpleExpression>

                      <ValueExpression>

                        <XPathQuery Type="UnsignedInteger">EventDisplayNumber</XPathQuery>

                      </ValueExpression>

                      <Operator>Equal</Operator>

                      <ValueExpression>

                        <Value Type="UnsignedInteger">7000</Value>

                      </ValueExpression>

                    </SimpleExpression>

                  </Expression>

                  <Expression>

                    <SimpleExpression>

                      <ValueExpression>

                        <Value Type="String">$Target/ManagementGroup/Name$</Value>

                      </ValueExpression>

                      <Operator>Equal</Operator>

                      <ValueExpression>

                        <XPathQuery Type="String">Params/Param[5]</XPathQuery>

                      </ValueExpression>

                    </SimpleExpression>

                  </Expression>

                </And>

              </Expression>

            </Or>

          </Expression>

        </And>

      </Expression>

    </DataSource>

  </DataSources>

  <WriteActions>

    <WriteAction ID="WriteToDB" TypeID="SCLibrary!Microsoft.SystemCenter.CollectEvent"/>

    <WriteAction ID="WriteToDW" TypeID="SCDW!Microsoft.SystemCenter.DataWarehouse.PublishEventData"/>

  </WriteActions>

</Rule>