ServicesForefrontIMCStartFail

ServicesForefrontIMCStartFail_1_Rule (Rule)

Knowledge Base article:

Management Pack
Summary

The FSEIMC Service failed to start.

 
Causes

Possible causes could include:
1. A problem with a dependent service not starting.
2. A problem with service corruption (files or registry data).
3. Underlying Operating System problem.

 
Resolutions

1. Make sure the target server is powered on and running.
2. Try to start the Forefront IMC Service manually by executing "net start FSEIMC”.

 
© 2006 Microsoft Corporation, all rights reserved.

Element properties:

TargetFSMPack2007_FSE.Forefront_Security_for_Exchange_Server___Edge_Transport_Installation
CategoryEventCollection
EnabledTrue
Event SourceService Control Manager
Alert GenerateTrue
Alert SeverityError
Alert PriorityNormal
RemotableTrue
Alert Message
ServicesForefrontIMCStartFail
Event LogSystem
CommentMom2005ID='{F7A931F8-0CAE-4255-8E80-292AA17C3755}';MOM2005ComputerGroupID={349CABD5-7700-4732-962C-63CF8C1B3795}

Member Modules:

ID Module Type TypeId RunAs 
_907D4578_146C_11D3_AB21_00A0C98620CE_ DataSource Microsoft.Windows.EventProvider Default
GenerateAlert WriteAction System.Health.GenerateAlert Default

Source Code:

<Rule ID="ServicesForefrontIMCStartFail_1_Rule" Comment="Mom2005ID='{F7A931F8-0CAE-4255-8E80-292AA17C3755}';MOM2005ComputerGroupID={349CABD5-7700-4732-962C-63CF8C1B3795}" Enabled="true" Target="FSMPack2007_FSE.Forefront_Security_for_Exchange_Server___Edge_Transport_Installation" ConfirmDelivery="true" Remotable="true" Priority="Normal" DiscardLevel="100">
<Category>EventCollection</Category>
<DataSources>
<DataSource ID="_907D4578_146C_11D3_AB21_00A0C98620CE_" TypeID="WindowsLibrary!Microsoft.Windows.EventProvider">
<ComputerName>$Target/Host/Property[Type="WindowsLibrary!Microsoft.Windows.Computer"]/NetworkName$</ComputerName>
<LogName>System</LogName>
<Expression>
<And>
<Expression>
<SimpleExpression>
<ValueExpression>
<XPathQuery Type="String">PublisherName</XPathQuery>
</ValueExpression>
<Operator>Equal</Operator>
<ValueExpression>
<Value>Service Control Manager</Value>
</ValueExpression>
</SimpleExpression>
</Expression>
<Expression>
<RegExExpression>
<ValueExpression>
<XPathQuery Type="String">EventDescription</XPathQuery>
</ValueExpression>
<Operator>ContainsSubstring</Operator>
<Pattern>The FSEIMC service</Pattern>
</RegExExpression>
</Expression>
<Expression>
<RegExExpression>
<ValueExpression>
<XPathQuery Type="Integer">EventDisplayNumber</XPathQuery>
</ValueExpression>
<Operator>MatchesMOM2005RegularExpression</Operator>
<Pattern>^(7000|7001)$</Pattern>
</RegExExpression>
</Expression>
</And>
</Expression>
</DataSource>
</DataSources>
<WriteActions>
<WriteAction ID="GenerateAlert" TypeID="HealthLibrary!System.Health.GenerateAlert">
<Priority>1</Priority>
<Severity>2</Severity>
<AlertName/>
<AlertDescription/>
<AlertOwner/>
<AlertMessageId>$MPElement[Name="ServicesForefrontIMCStartFail_1_Rule.AlertMessage"]$</AlertMessageId>
<AlertParameters/>
<Suppression/>
<Custom1>Microsoft Forefront Server Security</Custom1>
<Custom2>Forefront Security for Exchange Server</Custom2>
<Custom3>ServicesFailure</Custom3>
<Custom4/>
<Custom5/>
<Custom6/>
<Custom7/>
<Custom8/>
<Custom9/>
<Custom10/>
</WriteAction>
</WriteActions>
</Rule>