ServicesForefrontService StateMonitor

ServicesForefrontService_StateMonitor_2_Rule (Rule)

Knowledge Base article:

요약

FSCController 서비스가 중지되었습니다.

해결 방법

다음과 같이 Exchange 서비스를 재생합니다.

1. 모든 Exchange 서비스를 중지한 다음, 모든 Forefront 서비스가 오프라인인지 확인합니다.

2. Exchange 서비스를 다시 시작합니다. Forefront가 시작되었는지 확인합니다.

Element properties:

Target	FSMPack2007_FSE.Forefront_Security_for_Exchange_Server___All_Servers_Installation
Category	EventCollection
Enabled	True
Alert Generate	True
Alert Severity	Error
Alert Priority	Low
Remotable	True
Alert Message	ServicesForefrontService_StateMonitor_2_Rule.AllertMessageBackwardCompatibility
Comment	Mom2005ID='{9BBC2B81-FD5B-4192-9444-98346264DBD3}';MOM2005ComputerGroupID={868E5B4E-34B8-4B10-9055-C4074AF41790}

Member Modules:

ID	Module Type	TypeId	RunAs
_A82B9550_241C_11D3_B2CF_00A0C92A28B4_	DataSource	System.Mom.BackwardCompatibility.FilteredEvent.DataProvider	Default
GenerateAlert	WriteAction	System.Mom.BackwardCompatibility.AlertResponse	Default

Source Code:

<Rule ID="ServicesForefrontService_StateMonitor_2_Rule" Comment="Mom2005ID='{9BBC2B81-FD5B-4192-9444-98346264DBD3}';MOM2005ComputerGroupID={868E5B4E-34B8-4B10-9055-C4074AF41790}" Enabled="true" Target="FSMPack2007_FSE.Forefront_Security_for_Exchange_Server___All_Servers_Installation" ConfirmDelivery="false" Remotable="true" Priority="Normal" DiscardLevel="100">

  <Category>EventCollection</Category>

  <DataSources>

    <DataSource ID="_A82B9550_241C_11D3_B2CF_00A0C92A28B4_" TypeID="MomBackwardCompatibility!System.Mom.BackwardCompatibility.FilteredEvent.DataProvider">

      <Expression>

        <And>

          <Expression>

            <SimpleExpression>

              <ValueExpression>

                <XPathQuery Type="Integer">EventDisplayNumber</XPathQuery>

              </ValueExpression>

              <Operator>Equal</Operator>

              <ValueExpression>

                <Value>21207</Value>

              </ValueExpression>

            </SimpleExpression>

          </Expression>

          <Expression>

            <SimpleExpression>

              <ValueExpression>

                <XPathQuery Type="String">PublisherName</XPathQuery>

              </ValueExpression>

              <Operator>Equal</Operator>

              <ValueExpression>

                <Value>Microsoft Operations Manager</Value>

              </ValueExpression>

            </SimpleExpression>

          </Expression>

          <Expression>

            <RegExExpression>

              <ValueExpression>

                <XPathQuery Type="String">Params/Param[5]</XPathQuery>

              </ValueExpression>

              <Operator>ContainsSubstring</Operator>

              <Pattern>FSCController</Pattern>

            </RegExExpression>

          </Expression>

        </And>

      </Expression>

    </DataSource>

  </DataSources>

  <WriteActions>

    <WriteAction ID="GenerateAlert" TypeID="MomBackwardCompatibility!System.Mom.BackwardCompatibility.AlertResponse">

      <AlertGeneration>

        <GenerateAlert>true</GenerateAlert>

        <Owner/>

        <Description>

								$Data/EventDescription$

							</Description>

        <AlertLevel>50</AlertLevel>

        <ResolutionState/>

        <Source>

								$Data/PublisherName$

							</Source>

        <Name>ServicesForefrontService StateMonitor</Name>

        <ServerRole>ForefrontServer</ServerRole>

        <ServerRoleInstance>$Target/Host/Property[Type="WindowsLibrary!Microsoft.Windows.Computer"]/NetbiosComputerName$</ServerRoleInstance>

        <Component>services</Component>

        <ProblemState>1</ProblemState>

        <CustomFields>

          <CustomField>Microsoft Forefront Server Security</CustomField>

          <CustomField>Forefront Security for Exchange Server</CustomField>

          <CustomField>ServicesFailure</CustomField>

          <CustomField/>

          <CustomField/>

        </CustomFields>

      </AlertGeneration>

      <InvokerType>0</InvokerType>

    </WriteAction>

  </WriteActions>

</Rule>