WSRM - Process exceeded committed memory limit and terminated

WSRM___Process_exceeded_committed_memory_limit_and_terminated_1_Rule (Rule)

Knowledge Base article:

Management Pack
Summary
A process exceeded committed memory limit and it has been stopped. Depending on which process has been stopped, the process might need to be restarted manually after taking corrective measures.
 
Causes
The process exceeded its committed memory limit and as a result of this, it has been stopped.
 
Resolutions
Please contact the Windows System Resource Manager administrator to determine the reason for this error and to take corrective measures.
 
Sample Event
The process %1 with the process identifier (PID) %2 exceeded its committed memory limit of %3 megabytes. As a result, it has been stopped.

Process: %1
PID: %2
Committed memory limit (in megabytes): %3
 
© 1995-2003 Microsoft Corporation, all rights reserved.

Element properties:

TargetMicrosoft.Windows.SystemResourceManager.2003.Microsoft_Windows_System_Resource_Manager_Installation
CategoryEventCollection
EnabledTrue
Event_ID702
Event SourceWSRM
Alert GenerateFalse
RemotableTrue
Event LogApplication
CommentMom2005ID='{9DF3A420-C1AD-4745-B227-F7C2B9B1B06A}';MOM2005ComputerGroupID={791B481B-0184-4791-8BE9-DEC48A385750}

Member Modules:

ID Module Type TypeId RunAs 
_F6DA1507_12AF_11D3_AB21_00A0C98620CE_ DataSource Microsoft.Windows.EventProvider Default
CollectEventData WriteAction Microsoft.SystemCenter.CollectEvent Default
CollectEventDataWarehouse WriteAction Microsoft.SystemCenter.DataWarehouse.PublishEventData Default
GenerateAlert WriteAction System.Mom.BackwardCompatibility.AlertResponse Default

Source Code:

<Rule ID="WSRM___Process_exceeded_committed_memory_limit_and_terminated_1_Rule" Target="Microsoft.Windows.SystemResourceManager.2003.Microsoft_Windows_System_Resource_Manager_Installation" Enabled="true" ConfirmDelivery="true" Comment="Mom2005ID='{9DF3A420-C1AD-4745-B227-F7C2B9B1B06A}';MOM2005ComputerGroupID={791B481B-0184-4791-8BE9-DEC48A385750}">
<Category>EventCollection</Category>
<DataSources>
<DataSource ID="_F6DA1507_12AF_11D3_AB21_00A0C98620CE_" Comment="{F6DA1507-12AF-11D3-AB21-00A0C98620CE}" TypeID="WindowsLibrary!Microsoft.Windows.EventProvider">
<ComputerName>$Target/Host/Property[Type="WindowsLibrary!Microsoft.Windows.Computer"]/NetworkName$</ComputerName>
<LogName>Application</LogName>
<Expression>
<And>
<Expression>
<SimpleExpression>
<ValueExpression>
<XPathQuery Type="Integer">EventDisplayNumber</XPathQuery>
</ValueExpression>
<Operator>Equal</Operator>
<ValueExpression>
<Value>702</Value>
</ValueExpression>
</SimpleExpression>
</Expression>
<Expression>
<SimpleExpression>
<ValueExpression>
<XPathQuery Type="String">PublisherName</XPathQuery>
</ValueExpression>
<Operator>Equal</Operator>
<ValueExpression>
<Value>WSRM</Value>
</ValueExpression>
</SimpleExpression>
</Expression>
</And>
</Expression>
</DataSource>
</DataSources>
<WriteActions>
<WriteAction ID="GenerateAlert" TypeID="MomBackwardCompatibility!System.Mom.BackwardCompatibility.AlertResponse">
<AlertGeneration>
<GenerateAlert>false</GenerateAlert>
<Owner/>
<Description>
$Data/EventDescription$
</Description>
<AlertLevel>50</AlertLevel>
<ResolutionState/>
<Source>
$Data/PublisherName$
</Source>
<Name>WSRM - Process exceeded committed memory limit and terminated</Name>
</AlertGeneration>
<InvokerType>0</InvokerType>
</WriteAction>
<WriteAction ID="CollectEventData" TypeID="SystemCenterLibrary!Microsoft.SystemCenter.CollectEvent"/>
<WriteAction ID="CollectEventDataWarehouse" TypeID="DataWarehouseLibrary!Microsoft.SystemCenter.DataWarehouse.PublishEventData"/>
</WriteActions>
</Rule>