ScanTransportDisabledE

ScanTransportDisabledE_4_Rule (Rule)

Knowledge Base article:

Management Pack

Summary
The Transport Scan Job has gone into a disabled state. It is no longer scanning messages.

Causes
1. The Transport Scan Job was manually disabled in the Forefront Console. 2. The Transport Scan Job was disabled through FSCStarter. 3. The Microsoft Exchange Transport (MSExchangeTransport) service was shut down.

Resolutions
1. Manually enable the Transport Scan Job on the Forefront Administrator Console. 2. Enable the Transport Scan Job through FSCStarter. 3. Restart the Microsoft Exchange Transport (MSExchangeTransport) service.

Element properties:

Target

Microsoft.ForeFront.Exchange.Forefront_Security_for_Exchange_Server___Hub_Transport_Installation

Category

EventCollection

Enabled

True

Event_ID

2008

Event Source

FSCTransportScanner

Alert Generate

True

Alert Severity

Information

Alert Priority

Low

Remotable

True

Alert Message

ScanTransportDisabledE

$Data/EventDescription$

Event Log

Application

Comment

Mom2005ID='{51ECE2CC-A9BC-488B-806F-6F815EB0E33B}';MOM2005ComputerGroupID={F1A85322-5BE3-4AC2-8E2C-34F448DA8BE0}

Member Modules:

ID	Module Type	TypeId	RunAs
_F6DA1507_12AF_11D3_AB21_00A0C98620CE_	DataSource	Microsoft.Windows.EventProvider	Default
CollectEventData	WriteAction	Microsoft.SystemCenter.CollectEvent	Default
CollectEventDataWarehouse	WriteAction	Microsoft.SystemCenter.DataWarehouse.PublishEventData	Default
GenerateAlert	WriteAction	System.Mom.BackwardCompatibility.AlertResponse	Default

Source Code:

<Rule ID="ScanTransportDisabledE_4_Rule" Target="Microsoft.ForeFront.Exchange.Forefront_Security_for_Exchange_Server___Hub_Transport_Installation" Enabled="true" ConfirmDelivery="true" Comment="Mom2005ID='{51ECE2CC-A9BC-488B-806F-6F815EB0E33B}';MOM2005ComputerGroupID={F1A85322-5BE3-4AC2-8E2C-34F448DA8BE0}">

  <Category>EventCollection</Category>

  <DataSources>

    <DataSource ID="_F6DA1507_12AF_11D3_AB21_00A0C98620CE_" Comment="{F6DA1507-12AF-11D3-AB21-00A0C98620CE}" TypeID="WindowsLibrary!Microsoft.Windows.EventProvider">

      <ComputerName>$Target/Host/Property[Type="WindowsLibrary!Microsoft.Windows.Computer"]/NetworkName$</ComputerName>

      <LogName>Application</LogName>

      <Expression>

        <And>

          <Expression>

            <SimpleExpression>

              <ValueExpression>

                <XPathQuery Type="Integer">EventDisplayNumber</XPathQuery>

              </ValueExpression>

              <Operator>Equal</Operator>

              <ValueExpression>

                <Value>2008</Value>

              </ValueExpression>

            </SimpleExpression>

          </Expression>

          <Expression>

            <SimpleExpression>

              <ValueExpression>

                <XPathQuery Type="String">PublisherName</XPathQuery>

              </ValueExpression>

              <Operator>Equal</Operator>

              <ValueExpression>

                <Value>FSCTransportScanner</Value>

              </ValueExpression>

            </SimpleExpression>

          </Expression>

        </And>

      </Expression>

    </DataSource>

  </DataSources>

  <WriteActions>

    <WriteAction ID="GenerateAlert" TypeID="MomBackwardCompatibility!System.Mom.BackwardCompatibility.AlertResponse">

      <AlertGeneration>

        <GenerateAlert>true</GenerateAlert>

        <Owner/>

        <Description>

            $Data/EventDescription$

          </Description>

        <AlertLevel>20</AlertLevel>

        <ResolutionState/>

        <Source>

            $Data/PublisherName$

          </Source>

        <Name>ScanTransportDisabledE</Name>

        <CustomFields>

          <CustomField>Microsoft Forefront Server Security</CustomField>

          <CustomField>Forefront Security For Exchange Server</CustomField>

          <CustomField>ServicesFailure</CustomField>

          <CustomField/>

          <CustomField/>

        </CustomFields>

      </AlertGeneration>

      <InvokerType>0</InvokerType>

    </WriteAction>

    <WriteAction ID="CollectEventData" TypeID="SystemCenterLibrary!Microsoft.SystemCenter.CollectEvent"/>

    <WriteAction ID="CollectEventDataWarehouse" TypeID="DataWarehouseLibrary!Microsoft.SystemCenter.DataWarehouse.PublishEventData"/>

  </WriteActions>

</Rule>