Learning Module Runtime Failure

Microsoft.SystemCenter.LearningModule.FailedExecution.Alert (Rule)

This rule generates alerts when the Learning Module experiences a runtime failure.

Knowledge Base article:

Summary

Execution of the Learning Module failed. This rule generates an alert when any of the following event IDs is logged: 10118, 10119, 10120, 10121, 10122. These events occur when a read, write, or create operation fails for the following registry location:

HKLM\Software\Microsoft\Microsoft Operations Manager\3.0\Modules\Baselining\

Causes

The registry operation may have failed for one of the following reasons:

The action account doesn’t have the required permissions for these operations.
The action account used when the above registry location was initially created has the read/write permissions on this key. If the action account is changed after the installation, the new action account can’t access the registry because the new account is different than the one that initially created the registry key.

Resolutions

Try the following steps to resolve the issue:

Review the event log and find any of the above events to determine the issues that are causing the alert.
Ensure that the Action Account has read and write permissions to the registry location.

Element properties:

Target

Microsoft.SystemCenter.HealthService

Category

Alert

Enabled

True

Alert Generate

True

Alert Severity

Warning

Alert Priority

Normal

Remotable

True

Alert Message

Learning Module Failed Execution.

{0}

Event Log

Operations Manager

Member Modules:

ID	Module Type	TypeId	RunAs
DS	DataSource	Microsoft.Windows.EventProvider	Default
GenerateAlert	WriteAction	System.Health.GenerateAlert	Default

Source Code:

<Rule ID="Microsoft.SystemCenter.LearningModule.FailedExecution.Alert" Enabled="true" Target="SCLibrary!Microsoft.SystemCenter.HealthService" ConfirmDelivery="true" Remotable="true" Priority="Normal" DiscardLevel="100">

  <Category>Alert</Category>

  <DataSources>

    <DataSource ID="DS" TypeID="Windows!Microsoft.Windows.EventProvider">

      <ComputerName>$Target/Host/Property[Type="Windows!Microsoft.Windows.Computer"]/NetworkName$</ComputerName>

      <LogName>Operations Manager</LogName>

      <Expression>

        <And>

          <Expression>

            <SimpleExpression>

              <ValueExpression>

                <XPathQuery Type="String">PublisherName</XPathQuery>

              </ValueExpression>

              <Operator>Equal</Operator>

              <ValueExpression>

                <Value Type="String">Health Service Modules</Value>

              </ValueExpression>

            </SimpleExpression>

          </Expression>

          <Expression>

            <SimpleExpression>

              <ValueExpression>

                <Value Type="String">$Target/ManagementGroup/Name$</Value>

              </ValueExpression>

              <Operator>Equal</Operator>

              <ValueExpression>

                <XPathQuery Type="String">Params/Param[1]</XPathQuery>

              </ValueExpression>

            </SimpleExpression>

          </Expression>

          <Expression>

            <And>

              <Expression>

                <SimpleExpression>

                  <ValueExpression>

                    <XPathQuery Type="UnsignedInteger">EventDisplayNumber</XPathQuery>

                  </ValueExpression>

                  <Operator>GreaterEqual</Operator>

                  <ValueExpression>

                    <Value Type="UnsignedInteger">10118</Value>

                  </ValueExpression>

                </SimpleExpression>

              </Expression>

              <Expression>

                <SimpleExpression>

                  <ValueExpression>

                    <XPathQuery Type="UnsignedInteger">EventDisplayNumber</XPathQuery>

                  </ValueExpression>

                  <Operator>LessEqual</Operator>

                  <ValueExpression>

                    <Value Type="UnsignedInteger">10122</Value>

                  </ValueExpression>

                </SimpleExpression>

              </Expression>

            </And>

          </Expression>

        </And>

      </Expression>

    </DataSource>

  </DataSources>

  <WriteActions>

    <WriteAction ID="GenerateAlert" TypeID="Health!System.Health.GenerateAlert">

      <Priority>1</Priority>

      <Severity>1</Severity>

      <AlertMessageId>$MPElement[Name="Microsoft.SystemCenter.LearningModule.FailedExecution.AlertMessage"]$</AlertMessageId>

      <AlertParameters>

        <AlertParameter1>$Data/EventDescription$</AlertParameter1>

      </AlertParameters>

      <Suppression>

        <SuppressionValue/>

      </Suppression>

    </WriteAction>

  </WriteActions>

</Rule>