Collect Run As Account Failure Events

Microsoft.SystemCenter.HealthServiceRunAs.Failure.EventCollection (Rule)

Collects the series of events that indicate a failure in executing a rule, monitor, or task as a specfic Run As Account.

Knowledge Base article:

Summary

This rule collects event data that will be used in either reporting or a view.

Causes

This section is not applicable to event collection rules.

Resolutions

There is no resolution to perform for event collection rules since they do not generate state or alerts.

Element properties:

Target	Microsoft.SystemCenter.HealthService
Category	EventCollection
Enabled	True
Alert Generate	False
Remotable	True
Event Log	Operations Manager

Member Modules:

ID	Module Type	TypeId	RunAs
DS	DataSource	Microsoft.Windows.EventProvider	Default
WriteToDB	WriteAction	Microsoft.SystemCenter.CollectEvent	Default
WriteToDW	WriteAction	Microsoft.SystemCenter.DataWarehouse.PublishEventData	Default

Source Code:

<Rule ID="Microsoft.SystemCenter.HealthServiceRunAs.Failure.EventCollection" Enabled="true" Target="SCLibrary!Microsoft.SystemCenter.HealthService" ConfirmDelivery="true" Remotable="true" Priority="Normal" DiscardLevel="100">

  <Category>EventCollection</Category>

  <DataSources>

    <DataSource ID="DS" TypeID="Windows!Microsoft.Windows.EventProvider">

      <ComputerName>$Target/Host/Property[Type="Windows!Microsoft.Windows.Computer"]/NetworkName$</ComputerName>

      <LogName>Operations Manager</LogName>

      <Expression>

        <And>

          <Expression>

            <SimpleExpression>

              <ValueExpression>

                <XPathQuery Type="String">PublisherName</XPathQuery>

              </ValueExpression>

              <Operator>Equal</Operator>

              <ValueExpression>

                <Value Type="String">HealthService</Value>

              </ValueExpression>

            </SimpleExpression>

          </Expression>

          <Expression>

            <Or>

              <Expression>

                <And>

                  <Expression>

                    <SimpleExpression>

                      <ValueExpression>

                        <Value Type="String">$Target/ManagementGroup/Name$</Value>

                      </ValueExpression>

                      <Operator>Equal</Operator>

                      <ValueExpression>

                        <XPathQuery Type="String">Params/Param[1]</XPathQuery>

                      </ValueExpression>

                    </SimpleExpression>

                  </Expression>

                  <Expression>

                    <Or>

                      <Expression>

                        <SimpleExpression>

                          <ValueExpression>

                            <XPathQuery Type="UnsignedInteger">EventDisplayNumber</XPathQuery>

                          </ValueExpression>

                          <Operator>Equal</Operator>

                          <ValueExpression>

                            <Value Type="UnsignedInteger">7011</Value>

                          </ValueExpression>

                        </SimpleExpression>

                      </Expression>

                      <Expression>

                        <SimpleExpression>

                          <ValueExpression>

                            <XPathQuery Type="UnsignedInteger">EventDisplayNumber</XPathQuery>

                          </ValueExpression>

                          <Operator>Equal</Operator>

                          <ValueExpression>

                            <Value Type="UnsignedInteger">7010</Value>

                          </ValueExpression>

                        </SimpleExpression>

                      </Expression>

                    </Or>

                  </Expression>

                </And>

              </Expression>

              <Expression>

                <And>

                  <Expression>

                    <SimpleExpression>

                      <ValueExpression>

                        <XPathQuery Type="UnsignedInteger">EventDisplayNumber</XPathQuery>

                      </ValueExpression>

                      <Operator>Equal</Operator>

                      <ValueExpression>

                        <Value Type="UnsignedInteger">7002</Value>

                      </ValueExpression>

                    </SimpleExpression>

                  </Expression>

                  <Expression>

                    <SimpleExpression>

                      <ValueExpression>

                        <Value Type="String">$Target/ManagementGroup/Name$</Value>

                      </ValueExpression>

                      <Operator>Equal</Operator>

                      <ValueExpression>

                        <XPathQuery Type="String">Params/Param[3]</XPathQuery>

                      </ValueExpression>

                    </SimpleExpression>

                  </Expression>

                </And>

              </Expression>

              <Expression>

                <And>

                  <Expression>

                    <SimpleExpression>

                      <ValueExpression>

                        <XPathQuery Type="UnsignedInteger">EventDisplayNumber</XPathQuery>

                      </ValueExpression>

                      <Operator>Equal</Operator>

                      <ValueExpression>

                        <Value Type="UnsignedInteger">7000</Value>

                      </ValueExpression>

                    </SimpleExpression>

                  </Expression>

                  <Expression>

                    <SimpleExpression>

                      <ValueExpression>

                        <Value Type="String">$Target/ManagementGroup/Name$</Value>

                      </ValueExpression>

                      <Operator>Equal</Operator>

                      <ValueExpression>

                        <XPathQuery Type="String">Params/Param[5]</XPathQuery>

                      </ValueExpression>

                    </SimpleExpression>

                  </Expression>

                </And>

              </Expression>

            </Or>

          </Expression>

        </And>

      </Expression>

    </DataSource>

  </DataSources>

  <WriteActions>

    <WriteAction ID="WriteToDB" TypeID="SCLibrary!Microsoft.SystemCenter.CollectEvent"/>

    <WriteAction ID="WriteToDW" TypeID="SCDW!Microsoft.SystemCenter.DataWarehouse.PublishEventData"/>

  </WriteActions>

</Rule>