Home
  •  

ServicesForefrontIMCStartFail

ServicesForefrontIMCStartFail_3_Rule (Rule)

Knowledge Base article:

요약

FSEIMC 서비스가 시작되지 않았습니다.

원인

가능한 원인은 다음과 같습니다.

1. 종속 서비스가 시작되지 않은 경우 발생하는 문제입니다.

2. 서비스(파일 또는 레지스트리 데이터)가 손상되어 발생하는 문제입니다.

3. 원본으로 사용하는 운영 체제의 문제입니다.

해결 방법

1. 대상 서버의 전원이 켜져 있고 시스템이 실행되고 있는지 확인합니다.

2. "net start FSEIMC"를 실행하여 Forefront IMC Service를 수동으로 시작합니다.

Element properties:

TargetFSMPack2007_FSE.Forefront_Security_for_Exchange_Server___Hub_Transport__Mailbox__Public_Folder_Installation
CategoryEventCollection
EnabledTrue
Event SourceService Control Manager
Alert GenerateTrue
Alert SeverityError
Alert PriorityNormal
RemotableTrue
Alert Message
ServicesForefrontIMCStartFail
Event LogSystem
CommentMom2005ID='{F7A931F8-0CAE-4255-8E80-292AA17C3755}';MOM2005ComputerGroupID={E5B12036-BF17-41E6-9649-E18D61E71190}

Member Modules:

ID Module Type TypeId RunAs 
_907D4578_146C_11D3_AB21_00A0C98620CE_ DataSource Microsoft.Windows.EventProvider Default
GenerateAlert WriteAction System.Health.GenerateAlert Default

Source Code:

<Rule ID="ServicesForefrontIMCStartFail_3_Rule" Comment="Mom2005ID='{F7A931F8-0CAE-4255-8E80-292AA17C3755}';MOM2005ComputerGroupID={E5B12036-BF17-41E6-9649-E18D61E71190}" Enabled="true" Target="FSMPack2007_FSE.Forefront_Security_for_Exchange_Server___Hub_Transport__Mailbox__Public_Folder_Installation" ConfirmDelivery="true" Remotable="true" Priority="Normal" DiscardLevel="100">

  <Category>EventCollection</Category>

  <DataSources>

    <DataSource ID="_907D4578_146C_11D3_AB21_00A0C98620CE_" TypeID="WindowsLibrary!Microsoft.Windows.EventProvider">

      <ComputerName>$Target/Host/Property[Type="WindowsLibrary!Microsoft.Windows.Computer"]/NetworkName$</ComputerName>

      <LogName>System</LogName>

      <Expression>

        <And>

          <Expression>

            <SimpleExpression>

              <ValueExpression>

                <XPathQuery Type="String">PublisherName</XPathQuery>

              </ValueExpression>

              <Operator>Equal</Operator>

              <ValueExpression>

                <Value>Service Control Manager</Value>

              </ValueExpression>

            </SimpleExpression>

          </Expression>

          <Expression>

            <RegExExpression>

              <ValueExpression>

                <XPathQuery Type="String">EventDescription</XPathQuery>

              </ValueExpression>

              <Operator>ContainsSubstring</Operator>

              <Pattern>The FSEIMC service</Pattern>

            </RegExExpression>

          </Expression>

          <Expression>

            <RegExExpression>

              <ValueExpression>

                <XPathQuery Type="Integer">EventDisplayNumber</XPathQuery>

              </ValueExpression>

              <Operator>MatchesMOM2005RegularExpression</Operator>

              <Pattern>^(7000|7001)$</Pattern>

            </RegExExpression>

          </Expression>

        </And>

      </Expression>

    </DataSource>

  </DataSources>

  <WriteActions>

    <WriteAction ID="GenerateAlert" TypeID="HealthLibrary!System.Health.GenerateAlert">

      <Priority>1</Priority>

      <Severity>2</Severity>

      <AlertName/>

      <AlertDescription/>

      <AlertOwner/>

      <AlertMessageId>$MPElement[Name="ServicesForefrontIMCStartFail_3_Rule.AlertMessage"]$</AlertMessageId>

      <AlertParameters/>

      <Suppression/>

      <Custom1>Microsoft Forefront Server Security</Custom1>

      <Custom2>Forefront Security for Exchange Server</Custom2>

      <Custom3>ServicesFailure</Custom3>

      <Custom4/>

      <Custom5/>

      <Custom6/>

      <Custom7/>

      <Custom8/>

      <Custom9/>

      <Custom10/>

    </WriteAction>

  </WriteActions>

</Rule>