Incidentovervågning - Manglende korreleret incident med Incident

System.ApplicationLog.GenericCSVLog.MissingCorrelatedEventSingleEvent2StateMonitorType (UnitMonitorType)

Overvågning med to tilstande, knyt til manglende korrelerede og regulære incidents.

Element properties:

Member Modules:

Source Code:

<UnitMonitorType ID="System.ApplicationLog.GenericCSVLog.MissingCorrelatedEventSingleEvent2StateMonitorType" Accessibility="Public">

  <MonitorTypeStates>

    <MonitorTypeState ID="MissingCorrelatedEventRaised"/>

    <MonitorTypeState ID="EventRaised"/>

  </MonitorTypeStates>

  <Configuration>

    <IncludeSchemaTypes>

      <SchemaType>System!System.ExpressionEvaluatorSchema</SchemaType>

    </IncludeSchemaTypes>

    <xsd:element name="LogFileDirectory" type="xsd:string"/>

    <xsd:element name="LogFilePattern" type="xsd:string"/>

    <xsd:element name="LogIsUTF8" type="xsd:string"/>

    <xsd:element name="Separator" type="xsd:string"/>

    <xsd:element name="Expression" type="ExpressionType"/>

    <xsd:element name="FirstMissingCorrelatedLogFileDirectory" type="xsd:string"/>

    <xsd:element name="FirstMissingCorrelatedLogFilePattern" type="xsd:string"/>

    <xsd:element name="FirstMissingCorrelatedLogIsUTF8" type="xsd:string"/>

    <xsd:element name="FirstMissingCorrelatedSeparator" type="xsd:string"/>

    <xsd:element name="FirstMissingCorrelatedExpression" type="ExpressionType"/>

    <xsd:element name="SecondMissingCorrelatedLogFileDirectory" type="xsd:string"/>

    <xsd:element name="SecondMissingCorrelatedLogFilePattern" type="xsd:string"/>

    <xsd:element name="SecondMissingCorrelatedLogIsUTF8" type="xsd:string"/>

    <xsd:element name="SecondMissingCorrelatedSeparator" type="xsd:string"/>

    <xsd:element name="SecondMissingCorrelatedExpression" type="ExpressionType"/>

    <xsd:element name="Correlator" type="CorrelatorType"/>

  </Configuration>

  <MonitorImplementation>

    <MemberModules>

      <DataSource TypeID="System.ApplicationLog.GenericCSVLogReader" ID="DataSource">

        <LogFileDirectory>$Config/LogFileDirectory$</LogFileDirectory>

        <LogFilePattern>$Config/LogFilePattern$</LogFilePattern>

        <LogIsUTF8>$Config/LogIsUTF8$</LogIsUTF8>

        <Separator>$Config/Separator$</Separator>

      </DataSource>

      <DataSource TypeID="System.ApplicationLog.GenericCSVLogReader" ID="FirstMissingCorrelatedDataSource">

        <LogFileDirectory>$Config/FirstMissingCorrelatedLogFileDirectory$</LogFileDirectory>

        <LogFilePattern>$Config/FirstMissingCorrelatedLogFilePattern$</LogFilePattern>

        <LogIsUTF8>$Config/FirstMissingCorrelatedLogIsUTF8$</LogIsUTF8>

        <Separator>$Config/FirstMissingCorrelatedSeparator$</Separator>

      </DataSource>

      <DataSource TypeID="System.ApplicationLog.GenericCSVLogReader" ID="SecondMissingCorrelatedDataSource">

        <LogFileDirectory>$Config/SecondMissingCorrelatedLogFileDirectory$</LogFileDirectory>

        <LogFilePattern>$Config/SecondMissingCorrelatedLogFilePattern$</LogFilePattern>

        <LogIsUTF8>$Config/SecondMissingCorrelatedLogIsUTF8$</LogIsUTF8>

        <Separator>$Config/SecondMissingCorrelatedSeparator$</Separator>

      </DataSource>

      <ConditionDetection TypeID="System!System.ExpressionFilter" ID="FilterCondition">

        <Expression>$Config/Expression$</Expression>

      </ConditionDetection>

      <ConditionDetection TypeID="System!System.ExpressionFilter" ID="FirstMissingCorrelatedFilterCondition">

        <Expression>$Config/FirstMissingCorrelatedExpression$</Expression>

      </ConditionDetection>

      <ConditionDetection TypeID="System!System.ExpressionFilter" ID="SecondMissingCorrelatedFilterCondition">

        <Expression>$Config/SecondMissingCorrelatedExpression$</Expression>

      </ConditionDetection>

      <ConditionDetection TypeID="System!System.CorrelatorAutoMissingCondition" ID="MissingCorrelatedDataCondition">

        <Correlator>$Config/Correlator$</Correlator>

      </ConditionDetection>

    </MemberModules>

    <RegularDetections>

      <RegularDetection MonitorTypeStateID="MissingCorrelatedEventRaised">

        <Node ID="MissingCorrelatedDataCondition">

          <Node ID="FirstMissingCorrelatedFilterCondition">

            <Node ID="FirstMissingCorrelatedDataSource"/>

          </Node>

          <Node ID="SecondMissingCorrelatedFilterCondition">

            <Node ID="SecondMissingCorrelatedDataSource"/>

          </Node>

        </Node>

      </RegularDetection>

      <RegularDetection MonitorTypeStateID="EventRaised">

        <Node ID="FilterCondition">

          <Node ID="DataSource"/>

        </Node>

      </RegularDetection>

    </RegularDetections>

  </MonitorImplementation>

</UnitMonitorType>