WSRM - User Name not logged

WSRM___User_Name_not_logged_1_Rule (Rule)

Knowledge Base article:

Management Pack

Summary
Due to an error encountered by Windows System Resource Manager (WSRM), User Name will not be logged in the subsequent event logs.

Causes
Please look at the error description in event log to get more information.

Resolutions
Address the error condition and then try again. If the problem still persists, contact the WSRM administrator.

Sample Event
Windows System Resource Manager encountered the following error %1. User Name will not be logged in the subsequent event logs. Error: %1 User Action: Address the error condition, and then try again.

Element properties:

Target	Microsoft.Windows.SystemResourceManager.2003.Microsoft_Windows_System_Resource_Manager_Installation
Category	EventCollection
Enabled	True
Event_ID	119
Event Source	WSRM
Alert Generate	False
Remotable	True
Event Log	Application
Comment	Mom2005ID='{0B0C336C-BFD3-4626-B922-F48777BFAB84}';MOM2005ComputerGroupID={791B481B-0184-4791-8BE9-DEC48A385750}

Member Modules:

ID	Module Type	TypeId	RunAs
_F6DA1507_12AF_11D3_AB21_00A0C98620CE_	DataSource	Microsoft.Windows.EventProvider	Default
CollectEventData	WriteAction	Microsoft.SystemCenter.CollectEvent	Default
CollectEventDataWarehouse	WriteAction	Microsoft.SystemCenter.DataWarehouse.PublishEventData	Default
GenerateAlert	WriteAction	System.Mom.BackwardCompatibility.AlertResponse	Default

Source Code:

<Rule ID="WSRM___User_Name_not_logged_1_Rule" Target="Microsoft.Windows.SystemResourceManager.2003.Microsoft_Windows_System_Resource_Manager_Installation" Enabled="true" ConfirmDelivery="true" Comment="Mom2005ID='{0B0C336C-BFD3-4626-B922-F48777BFAB84}';MOM2005ComputerGroupID={791B481B-0184-4791-8BE9-DEC48A385750}">

  <Category>EventCollection</Category>

  <DataSources>

    <DataSource ID="_F6DA1507_12AF_11D3_AB21_00A0C98620CE_" Comment="{F6DA1507-12AF-11D3-AB21-00A0C98620CE}" TypeID="WindowsLibrary!Microsoft.Windows.EventProvider">

      <ComputerName>$Target/Host/Property[Type="WindowsLibrary!Microsoft.Windows.Computer"]/NetworkName$</ComputerName>

      <LogName>Application</LogName>

      <Expression>

        <And>

          <Expression>

            <SimpleExpression>

              <ValueExpression>

                <XPathQuery Type="Integer">EventDisplayNumber</XPathQuery>

              </ValueExpression>

              <Operator>Equal</Operator>

              <ValueExpression>

                <Value>119</Value>

              </ValueExpression>

            </SimpleExpression>

          </Expression>

          <Expression>

            <SimpleExpression>

              <ValueExpression>

                <XPathQuery Type="String">PublisherName</XPathQuery>

              </ValueExpression>

              <Operator>Equal</Operator>

              <ValueExpression>

                <Value>WSRM</Value>

              </ValueExpression>

            </SimpleExpression>

          </Expression>

        </And>

      </Expression>

    </DataSource>

  </DataSources>

  <WriteActions>

    <WriteAction ID="GenerateAlert" TypeID="MomBackwardCompatibility!System.Mom.BackwardCompatibility.AlertResponse">

      <AlertGeneration>

        <GenerateAlert>false</GenerateAlert>

        <Owner/>

        <Description>

            $Data/EventDescription$

          </Description>

        <AlertLevel>50</AlertLevel>

        <ResolutionState/>

        <Source>

            $Data/PublisherName$

          </Source>

        <Name>WSRM - User Name not logged</Name>

      </AlertGeneration>

      <InvokerType>0</InvokerType>

    </WriteAction>

    <WriteAction ID="CollectEventData" TypeID="SystemCenterLibrary!Microsoft.SystemCenter.CollectEvent"/>

    <WriteAction ID="CollectEventDataWarehouse" TypeID="DataWarehouseLibrary!Microsoft.SystemCenter.DataWarehouse.PublishEventData"/>

  </WriteActions>

</Rule>