OnVirusOutbreakAlert

OnVirusOutbreakAlert_1_Rule (Rule)

Element properties:

Member Modules:

Source Code:

<Rule ID="OnVirusOutbreakAlert_1_Rule" Target="Microsoft.Antigen.v9.Antigen_For_SMTP_Installation" Enabled="false" ConfirmDelivery="false" Comment="Mom2005ID='{8FAD0F71-6915-40C8-86F6-476BF7A4C80E}';MOM2005ComputerGroupID={A1AE2A6F-5844-439E-9063-79258853900A}">

  <Category>EventCollection</Category>

  <DataSources>

    <DataSource ID="_C8A2AC93_5528_4327_8170_AE15CF418789_" Comment="{C8A2AC93-5528-4327-8170-AE15CF418789}" TypeID="MomBackwardCompatibility!System.Mom.BackwardCompatibility.WmiEventProvider">

      <NameSpace>root\CIMV2\Applications\Antigen</NameSpace>

      <Query>SELECT * FROM Antigen_Alert</Query>

      <PollInterval>15</PollInterval>

      <Expression>

        <RegExExpression>

          <ValueExpression>

            <XPathQuery Type="String">Params/Param[11]</XPathQuery>

          </ValueExpression>

          <Operator>ContainsSubstring</Operator>

          <Pattern>1 (0x1)</Pattern>

        </RegExExpression>

      </Expression>

    </DataSource>

  </DataSources>

  <WriteActions>

    <WriteAction ID="GenerateAlert" TypeID="MomBackwardCompatibility!System.Mom.BackwardCompatibility.AlertResponse">

      <AlertGeneration>

        <GenerateAlert>true</GenerateAlert>

        <Owner/>

        <Description>

            $Data/EventDescription$

          </Description>

        <AlertLevel>30</AlertLevel>

        <ResolutionState/>

        <Source>

            $Data/PublisherName$

          </Source>

        <Name>OnVirusOutbreakAlert</Name>

        <ServerRole>Antigen Server</ServerRole>

        <ServerRoleInstance>$Target/Host/Property[Type="WindowsLibrary!Microsoft.Windows.Computer"]/NetbiosComputerName$</ServerRoleInstance>

        <Component>Services</Component>

        <ProblemState>1</ProblemState>

        <CustomFields>

          <CustomField>

            $Data/Params/Param[11]$

          </CustomField>

          <CustomField>

            $Data/Params/Param[12]$

          </CustomField>

          <CustomField>

            $Data/Params/Param[13]$

          </CustomField>

          <CustomField/>

          <CustomField/>

        </CustomFields>

      </AlertGeneration>

      <InvokerType>0</InvokerType>

    </WriteAction>

    <WriteAction ID="CollectEventData" TypeID="SystemCenterLibrary!Microsoft.SystemCenter.CollectEvent"/>

    <WriteAction ID="CollectEventDataWarehouse" TypeID="DataWarehouseLibrary!Microsoft.SystemCenter.DataWarehouse.PublishEventData"/>

  </WriteActions>

</Rule>