Home
  •  

ServicesStoreFailE

ServicesStoreFailE_5_Rule (Rule)

Knowledge Base article:

요약

Forefront Server Security Monitor에서 Information Store가 비정상적으로 종료되었음을 감지했습니다.

원인

Exchange Information Store에서 예기치 않은 문제가 발생했습니다.

해결 방법

1. 대상 서버의 전원이 켜져 있고 시스템이 시작되었는지 확인합니다.

2. "net start MSExchangeIS"를 실행하여 Information Store Service를 수동으로 시작합니다.

Element properties:

TargetFSMPack2007_FSE.Forefront_Security_for_Exchange_Server___Mailbox__Public_Folder_Installation
CategoryEventCollection
EnabledTrue
Event_ID1009
Event SourceFSCMonitor
Alert GenerateTrue
Alert SeverityError
Alert PriorityNormal
RemotableTrue
Alert Message
ServicesStoreFailE
Event LogApplication
CommentMom2005ID='{EAEE6844-E43B-40FB-A5D5-CD84D2483330}';MOM2005ComputerGroupID={FDF940D4-932E-42EF-9BE3-0613D4273C8D}

Member Modules:

ID Module Type TypeId RunAs 
_F6DA1507_12AF_11D3_AB21_00A0C98620CE_ DataSource Microsoft.Windows.EventProvider Default
GenerateAlert WriteAction System.Health.GenerateAlert Default

Source Code:

<Rule ID="ServicesStoreFailE_5_Rule" Comment="Mom2005ID='{EAEE6844-E43B-40FB-A5D5-CD84D2483330}';MOM2005ComputerGroupID={FDF940D4-932E-42EF-9BE3-0613D4273C8D}" Enabled="true" Target="FSMPack2007_FSE.Forefront_Security_for_Exchange_Server___Mailbox__Public_Folder_Installation" ConfirmDelivery="true" Remotable="true" Priority="Normal" DiscardLevel="100">

  <Category>EventCollection</Category>

  <DataSources>

    <DataSource ID="_F6DA1507_12AF_11D3_AB21_00A0C98620CE_" TypeID="WindowsLibrary!Microsoft.Windows.EventProvider">

      <ComputerName>$Target/Host/Property[Type="WindowsLibrary!Microsoft.Windows.Computer"]/NetworkName$</ComputerName>

      <LogName>Application</LogName>

      <Expression>

        <And>

          <Expression>

            <SimpleExpression>

              <ValueExpression>

                <XPathQuery Type="Integer">EventDisplayNumber</XPathQuery>

              </ValueExpression>

              <Operator>Equal</Operator>

              <ValueExpression>

                <Value>1009</Value>

              </ValueExpression>

            </SimpleExpression>

          </Expression>

          <Expression>

            <SimpleExpression>

              <ValueExpression>

                <XPathQuery Type="String">PublisherName</XPathQuery>

              </ValueExpression>

              <Operator>Equal</Operator>

              <ValueExpression>

                <Value>FSCMonitor</Value>

              </ValueExpression>

            </SimpleExpression>

          </Expression>

        </And>

      </Expression>

    </DataSource>

  </DataSources>

  <WriteActions>

    <WriteAction ID="GenerateAlert" TypeID="HealthLibrary!System.Health.GenerateAlert">

      <Priority>1</Priority>

      <Severity>2</Severity>

      <AlertName/>

      <AlertDescription/>

      <AlertOwner/>

      <AlertMessageId>$MPElement[Name="ServicesStoreFailE_5_Rule.AlertMessage"]$</AlertMessageId>

      <AlertParameters/>

      <Suppression/>

      <Custom1>Microsoft Forefront Server Security</Custom1>

      <Custom2>Forefront Security for Exchange Server</Custom2>

      <Custom3>ServicesFailure</Custom3>

      <Custom4/>

      <Custom5/>

      <Custom6/>

      <Custom7/>

      <Custom8/>

      <Custom9/>

      <Custom10/>

    </WriteAction>

  </WriteActions>

</Rule>