Remaining Verba Alerts

VerbaRecordingSystem.Rules.RemainingAlerts (Rule)

Element properties:

Target

VerbaRecordingSystem.VerbaServer

Category

EventCollection

Enabled

True

Alert Generate

True

Alert Severity

Error

Alert Priority

Normal

Remotable

True

Alert Message

Remaining Verba Alert

Source: {0}
Event ID: {1}
Event Category: {2}
User: {3}
Computer: {4}
Event Description: {5}
Event Data: {6}

Member Modules:

ID	Module Type	TypeId	RunAs
Microsoft.Windows.EventCollector	DataSource	Microsoft.Windows.EventCollector	Default
System.Health.GenerateAlert	WriteAction	System.Health.GenerateAlert	Default

Source Code:

<Rule ConfirmDelivery="false" DiscardLevel="100" Enabled="true" ID="VerbaRecordingSystem.Rules.RemainingAlerts" Priority="Normal" Remotable="true" Target="VerbaRecordingSystem.VerbaServer">

  <Category>EventCollection</Category>

  <DataSources>

    <DataSource ID="Microsoft.Windows.EventCollector" TypeID="Windows!Microsoft.Windows.EventCollector">

      <ComputerName>$Target/Host/Property[Type="Windows!Microsoft.Windows.Computer"]/NetworkName$</ComputerName>

      <LogName>Application</LogName>

      <AllowProxying>false</AllowProxying>

      <Expression>

        <Or>

          <Expression>

            <And>

              <Expression>

                <RegExExpression>

                  <ValueExpression>

                    <XPathQuery Type="UnsignedInteger">EventDisplayNumber</XPathQuery>

                  </ValueExpression>

                  <Operator>DoesNotMatchRegularExpression</Operator>

                  <Pattern>1|2|3|4|5|6|7|10|11|12|13|14|15|16|17|18|19|20|21|910|911|999|1001|1002|1003|1004|2001|2002|2003|3001|3002|3003|4001|4002|4003|5001|6001|7001|7002|7003|7004|7005|8001|8002|8003|9001|9002|9003|10001|10002|11001|11002|11003|11004|11005|11006|11007|11008|11009|11010|12001|12002|13001|13002|14001|14002|14003|14004|50001|50002|50003|50004|50005|15001|15002|15003|15004|15005|15006|15007|15008|15009|15010|15011|15012|15013|15014|15015|16001|16002|16003|16004|16005|17001|17002|17003|17004|17005|17006|17007|17008|17009|18001|18101|18201</Pattern>

                </RegExExpression>

              </Expression>

              <Expression>

                <SimpleExpression>

                  <ValueExpression>

                    <XPathQuery Type="String">PublisherName</XPathQuery>

                  </ValueExpression>

                  <Operator>Equal</Operator>

                  <ValueExpression>

                    <Value Type="String">Verba System Monitor</Value>

                  </ValueExpression>

                </SimpleExpression>

              </Expression>

            </And>

          </Expression>

          <Expression>

            <And>

              <Expression>

                <RegExExpression>

                  <ValueExpression>

                    <XPathQuery Type="UnsignedInteger">EventDisplayNumber</XPathQuery>

                  </ValueExpression>

                  <Operator>DoesNotMatchRegularExpression</Operator>

                  <Pattern>1|2|3|4|5|6|7|10|11|12|13|14|15|16|17|18|19|20|21|910|911|999|1001|1002|1003|1004|2001|2002|2003|3001|3002|3003|4001|4002|4003|5001|6001|7001|7002|7003|7004|7005|8001|8002|8003|9001|9002|9003|10001|10002|11001|11002|11003|11004|11005|11006|11007|11008|11009|11010|12001|12002|13001|13002|14001|14002|14003|14004|50001|50002|50003|50004|50005|15001|15002|15003|15004|15005|15006|15007|15008|15009|15010|15011|15012|15013|15014|15015|16001|16002|16003|16004|16005|17001|17002|17003|17004|17005|17006|17007|17008|17009|18001|18101|18201</Pattern>

                </RegExExpression>

              </Expression>

              <Expression>

                <SimpleExpression>

                  <ValueExpression>

                    <XPathQuery Type="String">PublisherName</XPathQuery>

                  </ValueExpression>

                  <Operator>Equal</Operator>

                  <ValueExpression>

                    <Value Type="String">Verba</Value>

                  </ValueExpression>

                </SimpleExpression>

              </Expression>

            </And>

          </Expression>

        </Or>

      </Expression>

    </DataSource>

  </DataSources>

  <WriteActions>

    <WriteAction ID="System.Health.GenerateAlert" TypeID="Health!System.Health.GenerateAlert">

      <Priority>1</Priority>

      <Severity>2</Severity>

      <AlertMessageId>$MPElement[Name="VerbaRecordingSystem.Rules.RemainingAlerts.AlertMessage"]$</AlertMessageId>

      <AlertParameters>

        <AlertParameter1>$Data/EventDescription$</AlertParameter1>

      </AlertParameters>

    </WriteAction>

  </WriteActions>

</Rule>