System.CorrelatorAutoMissingCondition

System Center

Updated: August 10, 2011

Applies To: Operations Manager 2007 R2

The System.CorrelatorAutoMissingCondition condition detection module type is used to correlate two incoming data item types, to detect a specific counting and/or ordering pattern of data items. It will return items only when the specified Count value has not been reached by the end of the correlation interval period. A module of this type accepts data of any type and outputs filtered System.CorrelatorData data.

Usage

This module provides all the functionality of the System.Correlator module, except that it will output data at the end of correlation window only if the value specified in the Count parameter has not been met. The primary correlation scenarios are related-events detection and missing-related-events detection. Both of these usage scenarios are time-based and correlate the occurrence or lack of occurrence of an event pattern within a specific time delta.

Type Definition


<ConditionDetectionModuleType ID="System.CorrelatorAutoMissingCondition" Accessibility="Public" Batching="false" Stateful="true" PassThrough="false">
  <Configuration>
    <IncludeSchemaTypes>
      <SchemaType>System.ExpressionEvaluatorSchema</SchemaType>
    </IncludeSchemaTypes>
    <xsd:element name="Correlator" type="CorrelatorType" xmlns:xsd="http://www.w3.org/2001/XMLSchema" />
  </Configuration>
  <ModuleImplementation Isolation="Any">
    <Composite>
      <MemberModules>
        <ConditionDetection ID="Correlator" TypeID="System.Correlator">
          <Correlator>$Config/Correlator$</Correlator>
        </ConditionDetection>
        <ConditionDetection ID="Filter" TypeID="System.ExpressionFilter">
          <Expression>
            <Or>
              <Expression>
                <SimpleExpression>
                  <ValueExpression>
                    <XPathQuery Type="UnsignedInteger">Item0Count</XPathQuery>
                  </ValueExpression>
                  <Operator>Equal</Operator>
                  <ValueExpression>
                    <Value Type="UnsignedInteger">0</Value>
                  </ValueExpression>
                </SimpleExpression>
              </Expression>
              <Expression>
                <SimpleExpression>
                  <ValueExpression>
                    <XPathQuery Type="UnsignedInteger">Item1Count</XPathQuery>
                  </ValueExpression>
                  <Operator>Equal</Operator>
                  <ValueExpression>
                    <Value Type="UnsignedInteger">0</Value>
                  </ValueExpression>
                </SimpleExpression>
              </Expression>
              <Expression>
                <And>
                  <Expression>
                    <SimpleExpression>
                      <ValueExpression>
                        <XPathQuery Type="UnsignedInteger">Item0Count</XPathQuery>
                      </ValueExpression>
                      <Operator>Equal</Operator>
                      <ValueExpression>
                        <Value Type="UnsignedInteger">1</Value>
                      </ValueExpression>
                    </SimpleExpression>
                  </Expression>
                  <Expression>
                    <SimpleExpression>
                      <ValueExpression>
                        <XPathQuery Type="UnsignedInteger">Item1Count</XPathQuery>
                      </ValueExpression>
                      <Operator>Less</Operator>
                      <ValueExpression>
                        <Value Type="UnsignedInteger">$Config/Correlator/Count$</Value>
                      </ValueExpression>
                    </SimpleExpression>
                  </Expression>
                </And>
              </Expression>
              <Expression>
                <And>
                  <Expression>
                    <SimpleExpression>
                      <ValueExpression>
                        <Value Type="String">$Config/Correlator/CorrelationOrder$</Value>
                      </ValueExpression>
                      <Operator>Equal</Operator>
                      <ValueExpression>
                        <Value Type="String">AnyOrder</Value>
                      </ValueExpression>
                    </SimpleExpression>
                  </Expression>
                  <Expression>
                    <SimpleExpression>
                      <ValueExpression>
                        <XPathQuery Type="UnsignedInteger">Item0Count</XPathQuery>
                      </ValueExpression>
                      <Operator>Less</Operator>
                      <ValueExpression>
                        <Value Type="UnsignedInteger">$Config/Correlator/Count$</Value>
                      </ValueExpression>
                    </SimpleExpression>
                  </Expression>
                  <Expression>
                    <SimpleExpression>
                      <ValueExpression>
                        <XPathQuery Type="UnsignedInteger">Item1Count</XPathQuery>
                      </ValueExpression>
                      <Operator>Equal</Operator>
                      <ValueExpression>
                        <Value Type="UnsignedInteger">1</Value>
                      </ValueExpression>
                    </SimpleExpression>
                  </Expression>
                </And>
              </Expression>
            </Or>
          </Expression>
        </ConditionDetection>
      </MemberModules>
      <Composition>
        <Node ID="Filter">
          <Node ID="Correlator" />
        </Node>
      </Composition>
    </Composite>
  </ModuleImplementation>
  <OutputType>System.CorrelatorData</OutputType>
  <InputTypes>
    <InputType>System.BaseData</InputType>
    <InputType>System.BaseData</InputType>
  </InputTypes>
</ConditionDetectionModuleType>

Parameters

The System.CorrelatorAutoMissingCondition supports the configuration parameters described in the following table.

 

Parameter Type Overrideable Description

Correlator

CorrelatorType

False

Required parameter. Defines the configuration of the correlator module.

For more information about the Correlator parameter and how to configure its elements, see CorrelatorType.

Remarks

For remarks, see System.Correlator.

Composition

The System.CorrelatorAutoMissingCondition composite module contains the member modules described in the following table.

 

Workflow Run Order Module Type Usage

1

System.Correlator

Correlates two incoming data item types, to detect a specific counting and/or ordering pattern of data items. This module provides no filtering on the output data.

2

System.ExpressionFilter

Filters the incoming System.CorrelatorData.

Related Modules

 

Module Type Usage

System.CorrelatorCondition

Correlates two incoming data item types to detect a specific counting and/or ordering pattern of data items. Returns data only when the value specified in the Count parameter has been met.

System.CorrelatorCondition

Correlates two incoming data item types to detect a specific counting and/or ordering pattern of data items. Allows for the filtering of the output data.

External Module References

None.

Sample

The following rule generates an alert whenever a pattern of incoming data items has not met by the time the correlation window has been reached.


<Rule ID="Microsoft.Samples.AutoMissingCorrelationRule.InSequenceFirstOccurence " Enabled="true" Target="Windows!Microsoft.Windows.OperatingSystem" ConfirmDelivery="false" Remotable="true" Priority="Normal" DiscardLevel="100">
  <Category>Custom</Category>
  <DataSources>
    <DataSource ID="DS1" TypeID="Windows!Microsoft.Windows.EventProvider">
      <ComputerName>$Target/Host/Property[Type="Windows!Microsoft.Windows.Computer"]/NetworkName$</ComputerName>
      <LogName>Application</LogName>
      <Expression>
        <And>
          <Expression>
            <SimpleExpression>
              <ValueExpression>
                <XPathQuery Type="String">PublisherName</XPathQuery>
              </ValueExpression>
              <Operator>Equal</Operator>
              <ValueExpression>
                <Value Type="String">EventCreate</Value>
              </ValueExpression>
            </SimpleExpression>
          </Expression>
          <Expression>
            <SimpleExpression>
              <ValueExpression>
                <XPathQuery Type="UnsignedInteger">EventDisplayNumber</XPathQuery>
              </ValueExpression>
              <Operator>Equal</Operator>
              <ValueExpression>
                <Value Type="UnsignedInteger">101</Value>
              </ValueExpression>
            </SimpleExpression>
          </Expression>
        </And>
      </Expression>
    </DataSource>
    <DataSource ID="DS2" TypeID="Windows!Microsoft.Windows.EventProvider">
      <ComputerName>$Target/Host/Property[Type="Windows!Microsoft.Windows.Computer"]/NetworkName$</ComputerName>
      <LogName>Application</LogName>
      <Expression>
        <And>
          <Expression>
            <SimpleExpression>
              <ValueExpression>
                <XPathQuery Type="String">PublisherName</XPathQuery>
              </ValueExpression>
              <Operator>Equal</Operator>
              <ValueExpression>
                <Value Type="String">EventCreate</Value>
              </ValueExpression>
            </SimpleExpression>
          </Expression>
          <Expression>
            <SimpleExpression>
              <ValueExpression>
                <XPathQuery Type="UnsignedInteger">EventDisplayNumber</XPathQuery>
              </ValueExpression>
              <Operator>Equal</Operator>
              <ValueExpression>
                <Value Type="UnsignedInteger">102</Value>
              </ValueExpression>
            </SimpleExpression>
          </Expression>
        </And>
      </Expression>
    </DataSource>
  </DataSources>
  <ConditionDetection ID="Correlator" TypeID="System!System.CorrelatorAutoMissingCondition">
    <Correlator>
      <Count>3</Count>
      <Interval>30</Interval>
      <CorrelationOrder>InSequence</CorrelationOrder>
      <CorrelationItemPolicy>First</CorrelationItemPolicy>
    </Correlator>
  </ConditionDetection>
  <WriteActions>
    <WriteAction ID="GenerateAlert" TypeID="Health!System.Health.GenerateAlert">
      <Priority>1</Priority>
      <Severity>2</Severity>
      <AlertMessageId>$MPElement[Name="Microsoft.Samples.AutoMissingCorrelationRule.InSequenceFirstOccurence.AlertMessage"]$</AlertMessageId>
      <Suppression>
        <SuppressionValue />
      </Suppression>
    </WriteAction>
  </WriteActions>
</Rule>


Information

 

   

Module Type

ConditionDetectionModuleType

InputType

System.BaseData

Output Type

System.CorrelatorData

Implementation

Native

Library

System.Library

 
Show: