Home
  •  

ServicesForefrontIMCStartFail

ServicesForefrontIMCStartFail_4_Rule (Rule)

Knowledge Base article:

Management Pack
Summary

The FSEIMC Service failed to start.

 
Causes

Possible causes could include:
1. A problem with a dependent service not starting.
2. A problem with service corruption (files or registry data).
3. Underlying Operating System problem.

 
Resolutions

1. Make sure the target server is powered on and running.
2. Try to start the Forefront IMC Service manually by executing "net start FSEIMC”.

 
© 2006 Microsoft Corporation, all rights reserved.

Element properties:

TargetMicrosoft.ForeFront.Exchange.Forefront_Security_for_Exchange_Server___Hub_Transport_Installation
CategoryEventCollection
EnabledTrue
Event SourceService Control Manager
Alert GenerateTrue
Alert SeverityError
Alert PriorityLow
RemotableTrue
Alert Message
ServicesForefrontIMCStartFail

$Data/EventDescription$
Event LogSystem
CommentMom2005ID='{F7A931F8-0CAE-4255-8E80-292AA17C3755}';MOM2005ComputerGroupID={F1A85322-5BE3-4AC2-8E2C-34F448DA8BE0}

Member Modules:

ID Module Type TypeId RunAs 
_907D4578_146C_11D3_AB21_00A0C98620CE_ DataSource Microsoft.Windows.EventProvider Default
CollectEventData WriteAction Microsoft.SystemCenter.CollectEvent Default
CollectEventDataWarehouse WriteAction Microsoft.SystemCenter.DataWarehouse.PublishEventData Default
GenerateAlert WriteAction System.Mom.BackwardCompatibility.AlertResponse Default

Source Code:

<Rule ID="ServicesForefrontIMCStartFail_4_Rule" Target="Microsoft.ForeFront.Exchange.Forefront_Security_for_Exchange_Server___Hub_Transport_Installation" Enabled="true" ConfirmDelivery="true" Comment="Mom2005ID='{F7A931F8-0CAE-4255-8E80-292AA17C3755}';MOM2005ComputerGroupID={F1A85322-5BE3-4AC2-8E2C-34F448DA8BE0}">

  <Category>EventCollection</Category>

  <DataSources>

    <DataSource ID="_907D4578_146C_11D3_AB21_00A0C98620CE_" Comment="{907D4578-146C-11D3-AB21-00A0C98620CE}" TypeID="WindowsLibrary!Microsoft.Windows.EventProvider">

      <ComputerName>$Target/Host/Property[Type="WindowsLibrary!Microsoft.Windows.Computer"]/NetworkName$</ComputerName>

      <LogName>System</LogName>

      <Expression>

        <And>

          <Expression>

            <SimpleExpression>

              <ValueExpression>

                <XPathQuery Type="String">PublisherName</XPathQuery>

              </ValueExpression>

              <Operator>Equal</Operator>

              <ValueExpression>

                <Value>Service Control Manager</Value>

              </ValueExpression>

            </SimpleExpression>

          </Expression>

          <Expression>

            <RegExExpression>

              <ValueExpression>

                <XPathQuery Type="String">EventDescription</XPathQuery>

              </ValueExpression>

              <Operator>ContainsSubstring</Operator>

              <Pattern>The FSEIMC service</Pattern>

            </RegExExpression>

          </Expression>

          <Expression>

            <RegExExpression>

              <ValueExpression>

                <XPathQuery Type="Integer">EventDisplayNumber</XPathQuery>

              </ValueExpression>

              <Operator>MatchesMOM2005RegularExpression</Operator>

              <Pattern>^(7000|7001)$</Pattern>

            </RegExExpression>

          </Expression>

        </And>

      </Expression>

    </DataSource>

  </DataSources>

  <WriteActions>

    <WriteAction ID="GenerateAlert" TypeID="MomBackwardCompatibility!System.Mom.BackwardCompatibility.AlertResponse">

      <AlertGeneration>

        <GenerateAlert>true</GenerateAlert>

        <Owner/>

        <Description>

            $Data/EventDescription$

          </Description>

        <AlertLevel>50</AlertLevel>

        <ResolutionState/>

        <Source>

            $Data/PublisherName$

          </Source>

        <Name>ServicesForefrontIMCStartFail</Name>

        <CustomFields>

          <CustomField>Microsoft Forefront Server Security</CustomField>

          <CustomField>Forefront Security For Exchange Server</CustomField>

          <CustomField>ServicesFailure</CustomField>

          <CustomField/>

          <CustomField/>

        </CustomFields>

      </AlertGeneration>

      <InvokerType>0</InvokerType>

    </WriteAction>

    <WriteAction ID="CollectEventData" TypeID="SystemCenterLibrary!Microsoft.SystemCenter.CollectEvent"/>

    <WriteAction ID="CollectEventDataWarehouse" TypeID="DataWarehouseLibrary!Microsoft.SystemCenter.DataWarehouse.PublishEventData"/>

  </WriteActions>

</Rule>