Collect crash events for Microsoft Windows 8.0 MediaPlayer.

Microsoft.Windows.8.0.MediaPlayer.Crash.EventCollection.Rule (Rule)

Knowledge Base article:

Summary

This rule collects application crash events for the Microsoft Windows Media Player 8.0. This information is collected and is exposed one or more Views and/or Reports.

Element properties:

Target	Microsoft.Windows.8.0.MediaPlayer
Category	EventCollection
Enabled	True
Event Source	DrWatson
Alert Generate	False
Remotable	True
Event Log	Application

Member Modules:

ID	Module Type	TypeId	RunAs
DataSource	DataSource	Microsoft.Windows.EventProvider	Default
WriteToDB	WriteAction	Microsoft.SystemCenter.CollectEvent	Default
WriteToDW	WriteAction	Microsoft.SystemCenter.DataWarehouse.PublishEventData	Default

Source Code:

<Rule ID="Microsoft.Windows.8.0.MediaPlayer.Crash.EventCollection.Rule" Target="Microsoft.Windows.8.0.MediaPlayer" Enabled="onEssentialMonitoring" DiscardLevel="100" ConfirmDelivery="false" Remotable="true" Priority="Normal">

  <Category>EventCollection</Category>

  <DataSources>

    <DataSource ID="DataSource" TypeID="Windows!Microsoft.Windows.EventProvider">

      <ComputerName>$Target/Host/Property[Type="Windows!Microsoft.Windows.Computer"]/NetworkName$</ComputerName>

      <LogName>Application</LogName>

      <Expression>

        <And>

          <Expression>

            <RegExExpression>

              <ValueExpression>

                <XPathQuery>Params/Param[1]</XPathQuery>

              </ValueExpression>

              <Operator>ContainsSubstring</Operator>

              <Pattern>$Target/Property[Type="IWCommon!Microsoft.Windows.MediaPlayer"]/FileName$</Pattern>

            </RegExExpression>

          </Expression>

          <Expression>

            <Or>

              <Expression>

                <And>

                  <Expression>

                    <SimpleExpression>

                      <ValueExpression>

                        <XPathQuery>PublisherName</XPathQuery>

                      </ValueExpression>

                      <Operator>Equal</Operator>

                      <ValueExpression>

                        <Value>DrWatson</Value>

                      </ValueExpression>

                    </SimpleExpression>

                  </Expression>

                  <Expression>

                    <SimpleExpression>

                      <ValueExpression>

                        <XPathQuery>EventDisplayNumber</XPathQuery>

                      </ValueExpression>

                      <Operator>Equal</Operator>

                      <ValueExpression>

                        <Value>4097</Value>

                      </ValueExpression>

                    </SimpleExpression>

                  </Expression>

                </And>

              </Expression>

              <Expression>

                <And>

                  <Expression>

                    <Or>

                      <Expression>

                        <RegExExpression>

                          <ValueExpression>

                            <XPathQuery>PublisherName</XPathQuery>

                          </ValueExpression>

                          <Operator>ContainsSubstring</Operator>

                          <Pattern>Application Error</Pattern>

                        </RegExExpression>

                      </Expression>

                      <Expression>

                        <RegExExpression>

                          <ValueExpression>

                            <XPathQuery>PublisherName</XPathQuery>

                          </ValueExpression>

                          <Operator>ContainsSubstring</Operator>

                          <Pattern>Microsoft Office</Pattern>

                        </RegExExpression>

                      </Expression>

                    </Or>

                  </Expression>

                  <Expression>

                    <SimpleExpression>

                      <ValueExpression>

                        <XPathQuery>EventDisplayNumber</XPathQuery>

                      </ValueExpression>

                      <Operator>Equal</Operator>

                      <ValueExpression>

                        <Value>1000</Value>

                      </ValueExpression>

                    </SimpleExpression>

                  </Expression>

                </And>

              </Expression>

            </Or>

          </Expression>

        </And>

      </Expression>

    </DataSource>

  </DataSources>

  <WriteActions>

    <WriteAction ID="WriteToDB" TypeID="SC!Microsoft.SystemCenter.CollectEvent"/>

    <WriteAction ID="WriteToDW" TypeID="SCDW!Microsoft.SystemCenter.DataWarehouse.PublishEventData"/>

  </WriteActions>

</Rule>