Event Filter deactivated, no events were suppressed

Veritas.EnterpriseVault.12.AdminService.Event_Filter_deactivated_no_events_suppressed.Rule (Rule)

Knowledge Base article:

Summary

Event Filter has been disabled.

Causes

Disabled by an administrator or the Admin service stopped.

Resolutions

The Enterprise Vault event filter has been disabled. While the filter was enabled it did not suppress any events.

External

Veritas Event Database

Element properties:

Target	Veritas.EnterpriseVault.12.AdminService
Category	EventCollection
Enabled	True
Alert Generate	False
Remotable	True

Member Modules:

ID	Module Type	TypeId	RunAs
DS	DataSource	Veritas.EnterpriseVault.12.EventProvider.DataSourceModuleType	Veritas.EnterpriseVault.MonitoringProfile
WriteToDB	WriteAction	Microsoft.SystemCenter.CollectEvent	Veritas.EnterpriseVault.MonitoringProfile
WriteToDW	WriteAction	Microsoft.SystemCenter.DataWarehouse.PublishEventData	Veritas.EnterpriseVault.MonitoringProfile

Source Code:

<Rule ID="Veritas.EnterpriseVault.12.AdminService.Event_Filter_deactivated_no_events_suppressed.Rule" Target="Veritas.EnterpriseVault.12.AdminService" Enabled="true" ConfirmDelivery="true" Remotable="true" Priority="Normal" DiscardLevel="100">

  <Category>EventCollection</Category>

  <DataSources>

    <DataSource ID="DS" TypeID="Veritas.EnterpriseVault.12.EventProvider.DataSourceModuleType" RunAs="EV!Veritas.EnterpriseVault.MonitoringProfile">

      <ComputerName>$Target/Host/Host/Host/Host/Property[Type="Windows!Microsoft.Windows.Computer"]/NetworkName$</ComputerName>

      <EventNumber>4258</EventNumber>

      <LogName>Application</LogName>

      <EventSourceName>Enterprise Vault</EventSourceName>

    </DataSource>

  </DataSources>

  <WriteActions>

    <WriteAction ID="WriteToDB" TypeID="SC!Microsoft.SystemCenter.CollectEvent" RunAs="EV!Veritas.EnterpriseVault.MonitoringProfile"/>

    <WriteAction ID="WriteToDW" TypeID="MSDL!Microsoft.SystemCenter.DataWarehouse.PublishEventData" RunAs="EV!Veritas.EnterpriseVault.MonitoringProfile"/>

  </WriteActions>

</Rule>