Home
  •  

ScanRealtimeProcessError

ScanRealtimeProcessError_3_Rule (Rule)

Knowledge Base article:

Management Pack
Summary

The "ScanRealtimeProcessPollE" event triggered an error.

 
Causes

Indicates that an "FSCRealtimeScanner.exe" process has crashed on the agent system.

 
Resolutions

“FSCRealtimeScanner.exe” will be automatically restarted by FSCController. No Action required.

 
© 2006 Microsoft Corporation, all rights reserved.

Element properties:

TargetMicrosoft.ForeFront.Exchange.Forefront_Security_for_Exchange_Server___Hub_Transport__Mailbox__Public_Folder_Installation
CategoryEventCollection
EnabledTrue
Alert GenerateTrue
Alert SeverityError
Alert PriorityLow
RemotableTrue
Alert Message
ScanRealtimeProcessError

$Data/EventDescription$
CommentMom2005ID='{19C4DEA4-D02C-4151-96D0-DD53846BC216}';MOM2005ComputerGroupID={E5B12036-BF17-41E6-9649-E18D61E71190}

Member Modules:

ID Module Type TypeId RunAs 
_F320DA51_13BF_11D3_B2CD_00A0C92A28B4_ DataSource System.Mom.BackwardCompatibility.FilteredEvent.DataProvider Default
GenerateAlert WriteAction System.Mom.BackwardCompatibility.AlertResponse Default

Source Code:

<Rule ID="ScanRealtimeProcessError_3_Rule" Target="Microsoft.ForeFront.Exchange.Forefront_Security_for_Exchange_Server___Hub_Transport__Mailbox__Public_Folder_Installation" Enabled="true" ConfirmDelivery="false" Comment="Mom2005ID='{19C4DEA4-D02C-4151-96D0-DD53846BC216}';MOM2005ComputerGroupID={E5B12036-BF17-41E6-9649-E18D61E71190}">

  <Category>EventCollection</Category>

  <DataSources>

    <DataSource ID="_F320DA51_13BF_11D3_B2CD_00A0C92A28B4_" Comment="{F320DA51-13BF-11D3-B2CD-00A0C92A28B4}" TypeID="MomBackwardCompatibility!System.Mom.BackwardCompatibility.FilteredEvent.DataProvider">

      <Expression>

        <And>

          <Expression>

            <SimpleExpression>

              <ValueExpression>

                <XPathQuery Type="Integer">EventDisplayNumber</XPathQuery>

              </ValueExpression>

              <Operator>Equal</Operator>

              <ValueExpression>

                <Value>9521</Value>

              </ValueExpression>

            </SimpleExpression>

          </Expression>

          <Expression>

            <SimpleExpression>

              <ValueExpression>

                <XPathQuery Type="String">PublisherName</XPathQuery>

              </ValueExpression>

              <Operator>Equal</Operator>

              <ValueExpression>

                <Value>Forefront Process Checker</Value>

              </ValueExpression>

            </SimpleExpression>

          </Expression>

        </And>

      </Expression>

    </DataSource>

  </DataSources>

  <WriteActions>

    <WriteAction ID="GenerateAlert" TypeID="MomBackwardCompatibility!System.Mom.BackwardCompatibility.AlertResponse">

      <AlertGeneration>

        <GenerateAlert>true</GenerateAlert>

        <Owner/>

        <Description>

            $Data/EventDescription$

          </Description>

        <AlertLevel>50</AlertLevel>

        <ResolutionState/>

        <Source>

            $Data/PublisherName$

          </Source>

        <Name>ScanRealtimeProcessError</Name>

        <CustomFields>

          <CustomField>Microsoft Forefront Server Security</CustomField>

          <CustomField>Forefront Security For Exchange Server</CustomField>

          <CustomField>ScanJobFailure</CustomField>

          <CustomField/>

          <CustomField/>

        </CustomFields>

      </AlertGeneration>

      <InvokerType>0</InvokerType>

    </WriteAction>

  </WriteActions>

</Rule>