Home
  •  

DHCP 서버 2016 및 1709 이상의 정책 장애 조치(Failover) 시 패킷 삭제 모니터링 규칙

Microsoft.Windows.DHCPServer.10.0.Policy.FailOver.PacketDrop (Rule)

정책 패킷 삭제 이벤트가 DHCP 로그에 삽입되면 경고합니다.

Knowledge Base article:

요약

이 규칙은 Microsoft Windows Server 2016 및 1709 이상의 운영 체제를 실행 중이며 DHCP 기능이 활성화된 서버 인스턴스를 포함하는 DHCP 2016 및 1709 이상의 서버 그룹 구성원 "DHCP 2016 및 1709 이상의 서버 그룹"에서 장애 조치(Failover) 패킷 삭제 정책 파일을 확인합니다.

Element properties:

TargetMicrosoft.Windows.DHCPServer.10.0.Server
CategoryCustom
EnabledTrue
Alert GenerateTrue
Alert SeverityError
Alert PriorityNormal
RemotableTrue
Alert Message
DHCP 서버 2016 및 1709 이상의 정책 장애 조치(Failover) 시 패킷 삭제 모니터링 경고
{0} 서버에서 패킷 삭제 오류를 보고함: {1} IP: {2}

Member Modules:

ID Module Type TypeId RunAs 
LogDS1 DataSource System.ApplicationLog.GenericCSVLog.FilteredEventProvider Default
LogDS2 DataSource System.ApplicationLog.GenericCSVLog.FilteredEventProvider Default
Correlator ConditionDetection System.CorrelatorAutoCondition Default
GenerateAlert WriteAction System.Health.GenerateAlert Default

Source Code:

<Rule ID="Microsoft.Windows.DHCPServer.10.0.Policy.FailOver.PacketDrop" Enabled="true" Target="Microsoft.Windows.DHCPServer.10.0.Server" ConfirmDelivery="false" Remotable="true" Priority="Normal" DiscardLevel="100">

  <Category>Custom</Category>

  <DataSources>

    <DataSource ID="LogDS1" TypeID="AppLog!System.ApplicationLog.GenericCSVLog.FilteredEventProvider">

      <LogFileDirectory>%windir%/system32/dhcp</LogFileDirectory>

      <LogFilePattern>DhcpSrvLog-*.log</LogFilePattern>

      <LogIsUTF8>false</LogIsUTF8>

      <Separator>,</Separator>

      <Expression>

        <SimpleExpression>

          <ValueExpression>

            <XPathQuery Type="String">Params/Param[1]</XPathQuery>

          </ValueExpression>

          <Operator>Equal</Operator>

          <ValueExpression>

            <Value Type="String">10</Value>

          </ValueExpression>

        </SimpleExpression>

      </Expression>

    </DataSource>

    <DataSource ID="LogDS2" TypeID="AppLog!System.ApplicationLog.GenericCSVLog.FilteredEventProvider">

      <LogFileDirectory>%windir%/system32/dhcp</LogFileDirectory>

      <LogFilePattern>DhcpSrvLog-*.log</LogFilePattern>

      <LogIsUTF8>false</LogIsUTF8>

      <Separator>,</Separator>

      <Expression>

        <SimpleExpression>

          <ValueExpression>

            <XPathQuery Type="String">Params/Param[1]</XPathQuery>

          </ValueExpression>

          <Operator>Equal</Operator>

          <ValueExpression>

            <Value Type="String">36</Value>

          </ValueExpression>

        </SimpleExpression>

      </Expression>

    </DataSource>

  </DataSources>

  <ConditionDetection ID="Correlator" TypeID="System!System.CorrelatorAutoCondition">

    <Correlator>

      <CorrelationExpression>

        <Expression>

          <SimpleExpression>

            <ValueExpression>

              <XPathQuery>Item0:EventData/DataItem/Params/Param[7]</XPathQuery>

            </ValueExpression>

            <Operator>Equal</Operator>

            <ValueExpression>

              <Value>Item1:EventData/DataItem/Params/Param[7]</Value>

            </ValueExpression>

          </SimpleExpression>

        </Expression>

      </CorrelationExpression>

      <Count>1</Count>

      <Interval>86400</Interval>

      <CorrelationOrder>InSequence</CorrelationOrder>

      <CorrelationItemPolicy>First</CorrelationItemPolicy>

    </Correlator>

  </ConditionDetection>

  <WriteActions>

    <WriteAction ID="GenerateAlert" TypeID="Health!System.Health.GenerateAlert">

      <Priority>1</Priority>

      <Severity>2</Severity>

      <AlertMessageId>$MPElement[Name="Microsoft.Windows.DHCPServer.10.0.Policy.FailOver.PacketDrop.AlertMessage"]$</AlertMessageId>

      <AlertParameters>

        <AlertParameter1>$Target/Host/Property[Type="Windows!Microsoft.Windows.Computer"]/PrincipalName$</AlertParameter1>

        <AlertParameter2>$Data/Context/DataItem/Item1Context/DataItem/Params/Param[4]$</AlertParameter2>

        <AlertParameter3>$Data/Context/DataItem/Item0Context/DataItem/Params/Param[5]$</AlertParameter3>

      </AlertParameters>

    </WriteAction>

  </WriteActions>

</Rule>