ScanManualFailedE

ScanManualFailedE_1_Rule (Rule)

Knowledge Base article:

Management Pack

Summary
A Manual Scan Job unexpectedly terminated execution prior to completion.

Causes
Manual Scan could not access the data or Forefront encountered an error trying to scan the data.

Resolutions
Implement the "ContinueManualScanOnFail" setting in Forefront (contact Microsoft Support).

Element properties:

Target

Microsoft.ForeFront.SharePoint.Forefront_Security_for_SharePoint_Installation

Category

EventCollection

Enabled

True

Event Source

FSCManualScanner

Alert Generate

True

Alert Severity

Error

Alert Priority

Low

Remotable

True

Alert Message

ScanManualFailedE

$Data/EventDescription$

Event Log

Application

Comment

Mom2005ID='{6E622A85-09FF-4E12-A97E-D31DA8E30779}';MOM2005ComputerGroupID={5E34E22D-A892-4026-A670-EB628BE392D5}

Member Modules:

ID	Module Type	TypeId	RunAs
_F6DA1507_12AF_11D3_AB21_00A0C98620CE_	DataSource	Microsoft.Windows.EventProvider	Default
CollectEventData	WriteAction	Microsoft.SystemCenter.CollectEvent	Default
CollectEventDataWarehouse	WriteAction	Microsoft.SystemCenter.DataWarehouse.PublishEventData	Default
GenerateAlert	WriteAction	System.Mom.BackwardCompatibility.AlertResponse	Default

Source Code:

<Rule ID="ScanManualFailedE_1_Rule" Target="Microsoft.ForeFront.SharePoint.Forefront_Security_for_SharePoint_Installation" Enabled="true" ConfirmDelivery="true" Comment="Mom2005ID='{6E622A85-09FF-4E12-A97E-D31DA8E30779}';MOM2005ComputerGroupID={5E34E22D-A892-4026-A670-EB628BE392D5}">

  <Category>EventCollection</Category>

  <DataSources>

    <DataSource ID="_F6DA1507_12AF_11D3_AB21_00A0C98620CE_" Comment="{F6DA1507-12AF-11D3-AB21-00A0C98620CE}" TypeID="WindowsLibrary!Microsoft.Windows.EventProvider">

      <ComputerName>$Target/Host/Property[Type="WindowsLibrary!Microsoft.Windows.Computer"]/NetworkName$</ComputerName>

      <LogName>Application</LogName>

      <Expression>

        <And>

          <Expression>

            <SimpleExpression>

              <ValueExpression>

                <XPathQuery Type="String">PublisherName</XPathQuery>

              </ValueExpression>

              <Operator>Equal</Operator>

              <ValueExpression>

                <Value>FSCManualScanner</Value>

              </ValueExpression>

            </SimpleExpression>

          </Expression>

          <Expression>

            <RegExExpression>

              <ValueExpression>

                <XPathQuery Type="Integer">EventDisplayNumber</XPathQuery>

              </ValueExpression>

              <Operator>MatchesMOM2005RegularExpression</Operator>

              <Pattern>^(5012|5014)$</Pattern>

            </RegExExpression>

          </Expression>

        </And>

      </Expression>

    </DataSource>

  </DataSources>

  <WriteActions>

    <WriteAction ID="GenerateAlert" TypeID="MomBackwardCompatibility!System.Mom.BackwardCompatibility.AlertResponse">

      <AlertGeneration>

        <GenerateAlert>true</GenerateAlert>

        <Owner/>

        <Description>

            $Data/EventDescription$

          </Description>

        <AlertLevel>40</AlertLevel>

        <ResolutionState/>

        <Source>

            $Data/PublisherName$

          </Source>

        <Name>ScanManualFailedE</Name>

        <CustomFields>

          <CustomField>Microsoft Forefront Server Security</CustomField>

          <CustomField>Forefront Security For SharePoint</CustomField>

          <CustomField>ScanJobFailure</CustomField>

          <CustomField/>

          <CustomField/>

        </CustomFields>

      </AlertGeneration>

      <InvokerType>0</InvokerType>

    </WriteAction>

    <WriteAction ID="CollectEventData" TypeID="SystemCenterLibrary!Microsoft.SystemCenter.CollectEvent"/>

    <WriteAction ID="CollectEventDataWarehouse" TypeID="DataWarehouseLibrary!Microsoft.SystemCenter.DataWarehouse.PublishEventData"/>

  </WriteActions>

</Rule>