Two Event Log event monitor with timeout

Microsoft.SystemCenter.ManagementConfigurationService.2SingleEventLogTimed2StateUnitMonitorType (UnitMonitorType)

Monitor switching states based on one 'good' event and one 'bad' event in case bad event is not followed by a good event in a given period of time

Element properties:

Member Modules:

Overrideable Parameters:

Source Code:

<UnitMonitorType ID="Microsoft.SystemCenter.ManagementConfigurationService.2SingleEventLogTimed2StateUnitMonitorType" Accessibility="Internal">

  <MonitorTypeStates>

    <MonitorTypeState ID="SecondEventRaised" NoDetection="false"/>

    <MonitorTypeState ID="FirstEventRaisedAndNoSecondEventRaisedInTimeInterval" NoDetection="false"/>

  </MonitorTypeStates>

  <Configuration>

    <xsd:element name="FirstEventId" type="xsd:int"/>

    <xsd:element name="SecondEventId" type="xsd:int"/>

    <xsd:element name="TimeIntervalSeconds" type="xsd:int"/>

  </Configuration>

  <OverrideableParameters>

    <OverrideableParameter ID="TimeIntervalSeconds" ParameterType="int" Selector="$Config/TimeIntervalSeconds$"/>

  </OverrideableParameters>

  <MonitorImplementation>

    <MemberModules>

      <DataSource TypeID="Windows!Microsoft.Windows.BaseEventProvider" ID="SecondDataSource">

        <ComputerName>.</ComputerName>

        <LogName>Operations Manager</LogName>

      </DataSource>

      <DataSource TypeID="Windows!Microsoft.Windows.BaseEventProvider" ID="CorrelatorFirstDataSource">

        <ComputerName>.</ComputerName>

        <LogName>Operations Manager</LogName>

      </DataSource>

      <DataSource TypeID="Windows!Microsoft.Windows.BaseEventProvider" ID="CorrelatorSecondDataSource">

        <ComputerName>.</ComputerName>

        <LogName>Operations Manager</LogName>

      </DataSource>

      <ConditionDetection TypeID="System!System.ExpressionFilter" ID="CorrelatorFirstFilterCondition">

        <Expression>

          <SimpleExpression>

            <ValueExpression>

              <XPathQuery Type="Integer">EventDisplayNumber</XPathQuery>

            </ValueExpression>

            <Operator>Equal</Operator>

            <ValueExpression>

              <Value Type="Integer">$Config/FirstEventId$</Value>

            </ValueExpression>

          </SimpleExpression>

        </Expression>

      </ConditionDetection>

      <ConditionDetection TypeID="System!System.ExpressionFilter" ID="CorrelatorSecondFilterCondition">

        <Expression>

          <SimpleExpression>

            <ValueExpression>

              <XPathQuery Type="Integer">EventDisplayNumber</XPathQuery>

            </ValueExpression>

            <Operator>Equal</Operator>

            <ValueExpression>

              <Value Type="Integer">$Config/SecondEventId$</Value>

            </ValueExpression>

          </SimpleExpression>

        </Expression>

      </ConditionDetection>

      <ConditionDetection TypeID="System!System.ExpressionFilter" ID="SecondFilterCondition">

        <Expression>

          <SimpleExpression>

            <ValueExpression>

              <XPathQuery Type="Integer">EventDisplayNumber</XPathQuery>

            </ValueExpression>

            <Operator>Equal</Operator>

            <ValueExpression>

              <Value Type="Integer">$Config/SecondEventId$</Value>

            </ValueExpression>

          </SimpleExpression>

        </Expression>

      </ConditionDetection>

      <ConditionDetection TypeID="System!System.CorrelatorAutoMissingCondition" ID="MissingEventCorrelator">

        <Correlator>

          <CorrelationExpression/>

          <Count>1</Count>

          <Interval>$Config/TimeIntervalSeconds$</Interval>

          <CorrelationOrder>InSequence</CorrelationOrder>

          <CorrelationItemPolicy>First</CorrelationItemPolicy>

        </Correlator>

      </ConditionDetection>

    </MemberModules>

    <RegularDetections>

      <RegularDetection MonitorTypeStateID="SecondEventRaised">

        <Node ID="SecondFilterCondition">

          <Node ID="SecondDataSource"/>

        </Node>

      </RegularDetection>

      <RegularDetection MonitorTypeStateID="FirstEventRaisedAndNoSecondEventRaisedInTimeInterval">

        <Node ID="MissingEventCorrelator">

          <Node ID="CorrelatorFirstFilterCondition">

            <Node ID="CorrelatorFirstDataSource"/>

          </Node>

          <Node ID="CorrelatorSecondFilterCondition">

            <Node ID="CorrelatorSecondDataSource"/>

          </Node>

        </Node>

      </RegularDetection>

    </RegularDetections>

  </MonitorImplementation>

</UnitMonitorType>