ServicesForefrontService StateMonitor

ServicesForefrontService_StateMonitor_2_Rule (Rule)

Knowledge Base article:

Résumé

Le service FSCController a été arrêté.

Résolution

Recyclez les services Exchange :

1. Arrêtez tous les services Exchange et vérifiez que tous les services Forefront sont hors connexion.

2. Redémarrez les services Exchange. Vérifiez que Forefront a complètement démarré.

Element properties:

Target	FSMPack2007_FSE.Forefront_Security_for_Exchange_Server___All_Servers_Installation
Category	EventCollection
Enabled	True
Alert Generate	True
Alert Severity	Error
Alert Priority	Low
Remotable	True
Alert Message	ServicesForefrontService_StateMonitor_2_Rule.AllertMessageBackwardCompatibility
Comment	Mom2005ID='{9BBC2B81-FD5B-4192-9444-98346264DBD3}';MOM2005ComputerGroupID={868E5B4E-34B8-4B10-9055-C4074AF41790}

Member Modules:

ID	Module Type	TypeId	RunAs
_A82B9550_241C_11D3_B2CF_00A0C92A28B4_	DataSource	System.Mom.BackwardCompatibility.FilteredEvent.DataProvider	Default
GenerateAlert	WriteAction	System.Mom.BackwardCompatibility.AlertResponse	Default

Source Code:

<Rule ID="ServicesForefrontService_StateMonitor_2_Rule" Comment="Mom2005ID='{9BBC2B81-FD5B-4192-9444-98346264DBD3}';MOM2005ComputerGroupID={868E5B4E-34B8-4B10-9055-C4074AF41790}" Enabled="true" Target="FSMPack2007_FSE.Forefront_Security_for_Exchange_Server___All_Servers_Installation" ConfirmDelivery="false" Remotable="true" Priority="Normal" DiscardLevel="100">

  <Category>EventCollection</Category>

  <DataSources>

    <DataSource ID="_A82B9550_241C_11D3_B2CF_00A0C92A28B4_" TypeID="MomBackwardCompatibility!System.Mom.BackwardCompatibility.FilteredEvent.DataProvider">

      <Expression>

        <And>

          <Expression>

            <SimpleExpression>

              <ValueExpression>

                <XPathQuery Type="Integer">EventDisplayNumber</XPathQuery>

              </ValueExpression>

              <Operator>Equal</Operator>

              <ValueExpression>

                <Value>21207</Value>

              </ValueExpression>

            </SimpleExpression>

          </Expression>

          <Expression>

            <SimpleExpression>

              <ValueExpression>

                <XPathQuery Type="String">PublisherName</XPathQuery>

              </ValueExpression>

              <Operator>Equal</Operator>

              <ValueExpression>

                <Value>Microsoft Operations Manager</Value>

              </ValueExpression>

            </SimpleExpression>

          </Expression>

          <Expression>

            <RegExExpression>

              <ValueExpression>

                <XPathQuery Type="String">Params/Param[5]</XPathQuery>

              </ValueExpression>

              <Operator>ContainsSubstring</Operator>

              <Pattern>FSCController</Pattern>

            </RegExExpression>

          </Expression>

        </And>

      </Expression>

    </DataSource>

  </DataSources>

  <WriteActions>

    <WriteAction ID="GenerateAlert" TypeID="MomBackwardCompatibility!System.Mom.BackwardCompatibility.AlertResponse">

      <AlertGeneration>

        <GenerateAlert>true</GenerateAlert>

        <Owner/>

        <Description>

								$Data/EventDescription$

							</Description>

        <AlertLevel>50</AlertLevel>

        <ResolutionState/>

        <Source>

								$Data/PublisherName$

							</Source>

        <Name>ServicesForefrontService StateMonitor</Name>

        <ServerRole>ForefrontServer</ServerRole>

        <ServerRoleInstance>$Target/Host/Property[Type="WindowsLibrary!Microsoft.Windows.Computer"]/NetbiosComputerName$</ServerRoleInstance>

        <Component>services</Component>

        <ProblemState>1</ProblemState>

        <CustomFields>

          <CustomField>Microsoft Forefront Server Security</CustomField>

          <CustomField>Forefront Security for Exchange Server</CustomField>

          <CustomField>ServicesFailure</CustomField>

          <CustomField/>

          <CustomField/>

        </CustomFields>

      </AlertGeneration>

      <InvokerType>0</InvokerType>

    </WriteAction>

  </WriteActions>

</Rule>