Home
  •  

ServiceTerminate

ServiceTerminate_3_Rule (Rule)

Knowledge Base article:

Management Pack
Summary

FSCMonitor detected that the MSExchangeTransport.exe process crashed unexpectedly. This will cause the MSExchangeTransport service to go offline.

 
Causes

1. An application exception crash on MSExchangeTransport.exe
2. The MSExchangeTransport.exe process was killed.

 
Resolutions

1. On some systems, recovery may be automated and no action is necessary.
2. If recovery is not automatic, Forefront and the related MSExchangeTransport service need to be restarted.

 
© 2006 Microsoft Corporation, all rights reserved.

Element properties:

TargetFSMPack2007_FSE.Forefront_Security_for_Exchange_Server___Hub_Transport__Mailbox__Public_Folder_Installation
CategoryEventCollection
EnabledTrue
Event SourceFSCController
Alert GenerateTrue
Alert SeverityError
Alert PriorityNormal
RemotableTrue
Alert Message
ServiceTerminate
Event LogApplication
CommentMom2005ID='{DCC3FC53-AC3B-47D9-8C9B-8AEE247893E3}';MOM2005ComputerGroupID={E5B12036-BF17-41E6-9649-E18D61E71190}

Member Modules:

ID Module Type TypeId RunAs 
_F6DA1507_12AF_11D3_AB21_00A0C98620CE_ DataSource Microsoft.Windows.EventProvider Default
GenerateAlert WriteAction System.Health.GenerateAlert Default

Source Code:

<Rule ID="ServiceTerminate_3_Rule" Comment="Mom2005ID='{DCC3FC53-AC3B-47D9-8C9B-8AEE247893E3}';MOM2005ComputerGroupID={E5B12036-BF17-41E6-9649-E18D61E71190}" Enabled="true" Target="FSMPack2007_FSE.Forefront_Security_for_Exchange_Server___Hub_Transport__Mailbox__Public_Folder_Installation" ConfirmDelivery="true" Remotable="true" Priority="Normal" DiscardLevel="100">

  <Category>EventCollection</Category>

  <DataSources>

    <DataSource ID="_F6DA1507_12AF_11D3_AB21_00A0C98620CE_" TypeID="WindowsLibrary!Microsoft.Windows.EventProvider">

      <ComputerName>$Target/Host/Property[Type="WindowsLibrary!Microsoft.Windows.Computer"]/NetworkName$</ComputerName>

      <LogName>Application</LogName>

      <Expression>

        <And>

          <Expression>

            <RegExExpression>

              <ValueExpression>

                <XPathQuery Type="Integer">EventDisplayNumber</XPathQuery>

              </ValueExpression>

              <Operator>MatchesMOM2005RegularExpression</Operator>

              <Pattern>^(5167|5168)$</Pattern>

            </RegExExpression>

          </Expression>

          <Expression>

            <SimpleExpression>

              <ValueExpression>

                <XPathQuery Type="String">PublisherName</XPathQuery>

              </ValueExpression>

              <Operator>Equal</Operator>

              <ValueExpression>

                <Value>FSCController</Value>

              </ValueExpression>

            </SimpleExpression>

          </Expression>

        </And>

      </Expression>

    </DataSource>

  </DataSources>

  <WriteActions>

    <WriteAction ID="GenerateAlert" TypeID="HealthLibrary!System.Health.GenerateAlert">

      <Priority>1</Priority>

      <Severity>2</Severity>

      <AlertName/>

      <AlertDescription/>

      <AlertOwner/>

      <AlertMessageId>$MPElement[Name="ServiceTerminate_3_Rule.AlertMessage"]$</AlertMessageId>

      <AlertParameters/>

      <Suppression/>

      <Custom1>Microsoft Forefront Server Security</Custom1>

      <Custom2>Forefront Security for Exchange Server</Custom2>

      <Custom3>ServicesFailure</Custom3>

      <Custom4/>

      <Custom5/>

      <Custom6/>

      <Custom7/>

      <Custom8/>

      <Custom9/>

      <Custom10/>

    </WriteAction>

  </WriteActions>

</Rule>