<ManagementPack ContentReadable="true" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsl="http://www.w3.org/1999/XSL/Transform">
  <Manifest>
    <Identity>
      <ID>Custom.Event.Rule_Monitor.with.Schedule</ID>
      <Version>1.0.0.16</Version>
    </Identity>
    <Name>Custom.Event.Rule_Monitor.with.Schedule</Name>
    <References>
      <Reference Alias="SC">
        <ID>Microsoft.SystemCenter.Library</ID>
        <Version>6.1.7221.0</Version>
        <PublicKeyToken>31bf3856ad364e35</PublicKeyToken>
      </Reference>
      <Reference Alias="Windows">
        <ID>Microsoft.Windows.Library</ID>
        <Version>6.1.7221.0</Version>
        <PublicKeyToken>31bf3856ad364e35</PublicKeyToken>
      </Reference>
      <Reference Alias="Health">
        <ID>System.Health.Library</ID>
        <Version>6.1.7221.0</Version>
        <PublicKeyToken>31bf3856ad364e35</PublicKeyToken>
      </Reference>
      <Reference Alias="System">
        <ID>System.Library</ID>
        <Version>6.1.7221.0</Version>
        <PublicKeyToken>31bf3856ad364e35</PublicKeyToken>
      </Reference>
    </References>
  </Manifest>
  <TypeDefinitions>
    <MonitorTypes>
      <UnitMonitorType ID="Custom.Microsoft.Windows.2SingleEventLog2StateMonitorType" Accessibility="Public">
        <MonitorTypeStates>
          <MonitorTypeState ID="FirstEventRaised" NoDetection="false" />
          <MonitorTypeState ID="SecondEventRaised" NoDetection="false" />
        </MonitorTypeStates>
        <Configuration>
          <IncludeSchemaTypes>
            <SchemaType>System!System.ExpressionEvaluatorSchema</SchemaType>
          </IncludeSchemaTypes>
          <xsd:element minOccurs="1" name="FirstComputerName" type="xsd:string" />
          <xsd:element minOccurs="1" name="FirstLogName" type="xsd:string" />
          <xsd:element minOccurs="1" name="FirstExpression" type="ExpressionType" />
          <xsd:element minOccurs="1" name="SecondComputerName" type="xsd:string" />
          <xsd:element minOccurs="1" name="SecondLogName" type="xsd:string" />
          <xsd:element minOccurs="1" name="SecondExpression" type="ExpressionType" />
        </Configuration>
        <MonitorImplementation>
          <MemberModules>
            <DataSource ID="FirstDataSource" TypeID="Windows!Microsoft.Windows.BaseEventProvider">
              <ComputerName>$Config/FirstComputerName$</ComputerName>
              <LogName>$Config/FirstLogName$</LogName>
            </DataSource>
            <DataSource ID="SecondDataSource" TypeID="Windows!Microsoft.Windows.BaseEventProvider">
              <ComputerName>$Config/SecondComputerName$</ComputerName>
              <LogName>$Config/SecondLogName$</LogName>
            </DataSource>
            <ConditionDetection ID="FirstFilterCondition" TypeID="System!System.ExpressionFilter">
              <Expression>$Config/FirstExpression$</Expression>
            </ConditionDetection>
            <ConditionDetection ID="SecondFilterCondition" TypeID="System!System.ExpressionFilter">
              <Expression>$Config/SecondExpression$</Expression>
            </ConditionDetection>
            <ConditionDetection ID="OperationalScheduleCD" TypeID="System!System.SchedulerFilter">
              <SchedulerFilter>
                <ProcessDataMode>OnSchedule</ProcessDataMode>
                <Schedule>
                  <WeeklySchedule>
                    <Windows>
                      <Daily>
                        <Start>06:00</Start>
                        <End>23:00</End>
                        <DaysOfWeekMask>42</DaysOfWeekMask>
                      </Daily>
                    </Windows>
                  </WeeklySchedule>
                  <ExcludeDates />
                </Schedule>
                <UseCurrentTime>true</UseCurrentTime>
              </SchedulerFilter>
            </ConditionDetection>
          </MemberModules>
          <RegularDetections>
            <RegularDetection MonitorTypeStateID="FirstEventRaised">
              <Node ID="OperationalScheduleCD">
                <Node ID="FirstFilterCondition">
                  <Node ID="FirstDataSource" />
                </Node>
              </Node>
            </RegularDetection>
            <RegularDetection MonitorTypeStateID="SecondEventRaised">
              <Node ID="SecondFilterCondition">
                <Node ID="SecondDataSource" />
              </Node>
            </RegularDetection>
          </RegularDetections>
        </MonitorImplementation>
      </UnitMonitorType>
    </MonitorTypes>
  </TypeDefinitions>
  <Monitoring>
    <Rules>
      <Rule ID="Custom.Event.Rule_Monitor.with.Schedule.Standard.Event.Rule.with.Alert.NO.Schedule" Enabled="true" Target="Windows!Microsoft.Windows.Server.OperatingSystem" ConfirmDelivery="true" Remotable="true" Priority="Normal" DiscardLevel="100">
        <Category>Alert</Category>
        <DataSources>
          <DataSource ID="DS" TypeID="Windows!Microsoft.Windows.EventProvider">
            <ComputerName>$Target/Host/Property[Type="Windows!Microsoft.Windows.Computer"]/NetworkName$</ComputerName>
            <LogName>Application</LogName>
            <Expression>
              <SimpleExpression>
                <ValueExpression>
                  <XPathQuery Type="UnsignedInteger">EventDisplayNumber</XPathQuery>
                </ValueExpression>
                <Operator>Equal</Operator>
                <ValueExpression>
                  <Value Type="UnsignedInteger">1000</Value>
                </ValueExpression>
              </SimpleExpression>
            </Expression>
          </DataSource>
        </DataSources>
        <WriteActions>
          <WriteAction ID="Alert" TypeID="Health!System.Health.GenerateAlert">
            <Priority>1</Priority>
            <Severity>2</Severity>
            <AlertName />
            <AlertDescription />
            <AlertOwner />
            <AlertMessageId>$MPElement[Name="Custom.Event.Rule_Monitor.with.Schedule.Standard.Event.Rule.with.Alert.NO.Schedule.AlertMessage"]$</AlertMessageId>
            <AlertParameters>
              <AlertParameter1>$Data/EventDescription$</AlertParameter1>
            </AlertParameters>
            <Suppression />
            <Custom1 />
            <Custom2 />
            <Custom3 />
            <Custom4 />
            <Custom5 />
            <Custom6 />
            <Custom7 />
            <Custom8 />
            <Custom9 />
            <Custom10 />
          </WriteAction>
        </WriteActions>
      </Rule>
      <Rule ID="Custom.Event.Rule_Monitor.with.Schedule.Standard.Event.Rule.with.Alert.WITH.Schedule" Enabled="true" Target="Windows!Microsoft.Windows.Server.OperatingSystem" ConfirmDelivery="true" Remotable="true" Priority="Normal" DiscardLevel="100">
        <Category>Alert</Category>
        <DataSources>
          <DataSource ID="DS" TypeID="Windows!Microsoft.Windows.EventProvider">
            <ComputerName>$Target/Host/Property[Type="Windows!Microsoft.Windows.Computer"]/NetworkName$</ComputerName>
            <LogName>Application</LogName>
            <Expression>
              <SimpleExpression>
                <ValueExpression>
                  <XPathQuery Type="UnsignedInteger">EventDisplayNumber</XPathQuery>
                </ValueExpression>
                <Operator>Equal</Operator>
                <ValueExpression>
                  <Value Type="UnsignedInteger">1001</Value>
                </ValueExpression>
              </SimpleExpression>
            </Expression>
          </DataSource>
        </DataSources>
        <ConditionDetection ID="CD" TypeID="System!System.SchedulerFilter">
          <SchedulerFilter>
            <ProcessDataMode>OnSchedule</ProcessDataMode>
            <Schedule>
              <WeeklySchedule>
                <Windows>
                  <Daily>
                    <Start>06:00</Start>
                    <End>23:00</End>
                    <DaysOfWeekMask>42</DaysOfWeekMask>
                  </Daily>
                </Windows>
              </WeeklySchedule>
              <ExcludeDates />
            </Schedule>
            <UseCurrentTime>true</UseCurrentTime>
          </SchedulerFilter>
        </ConditionDetection>
        <WriteActions>
          <WriteAction ID="Alert" TypeID="Health!System.Health.GenerateAlert">
            <Priority>1</Priority>
            <Severity>2</Severity>
            <AlertName />
            <AlertDescription />
            <AlertOwner />
            <AlertMessageId>$MPElement[Name="Custom.Event.Rule_Monitor.with.Schedule.Standard.Event.Rule.with.Alert.WITH.Schedule.AlertMessage"]$</AlertMessageId>
            <AlertParameters>
              <AlertParameter1>$Data/EventDescription$</AlertParameter1>
            </AlertParameters>
            <Suppression />
            <Custom1 />
            <Custom2 />
            <Custom3 />
            <Custom4 />
            <Custom5 />
            <Custom6 />
            <Custom7 />
            <Custom8 />
            <Custom9 />
            <Custom10 />
          </WriteAction>
        </WriteActions>
      </Rule>
    </Rules>
    <Monitors>
      <UnitMonitor ID="Custom.Event.Rule_Monitor.with.Schedule.Standard.Event.Monitor.with.Alert.NO.Schedule" Accessibility="Internal" Enabled="true" Target="Windows!Microsoft.Windows.Server.OperatingSystem" ParentMonitorID="Health!System.Health.AvailabilityState" Remotable="true" Priority="Normal" TypeID="Windows!Microsoft.Windows.2SingleEventLog2StateMonitorType" ConfirmDelivery="true">
        <Category>AvailabilityHealth</Category>
        <AlertSettings AlertMessage="Custom.Event.Rule_Monitor.with.Schedule.Standard.Event.Monitor.with.Alert.NO.Schedule_AlertMessageResourceID">
          <AlertOnState>Warning</AlertOnState>
          <AutoResolve>true</AutoResolve>
          <AlertPriority>Normal</AlertPriority>
          <AlertSeverity>Error</AlertSeverity>
          <AlertParameters>
            <AlertParameter1>$Data/Context/EventDescription$</AlertParameter1>
          </AlertParameters>
        </AlertSettings>
        <OperationalStates>
          <OperationalState ID="FirstEventRaised" MonitorTypeStateID="FirstEventRaised" HealthState="Warning" />
          <OperationalState ID="SecondEventRaised" MonitorTypeStateID="SecondEventRaised" HealthState="Success" />
        </OperationalStates>
        <Configuration>
          <FirstComputerName>$Target/Host/Property[Type="Windows!Microsoft.Windows.Computer"]/NetworkName$</FirstComputerName>
          <FirstLogName>Application</FirstLogName>
          <FirstExpression>
            <SimpleExpression>
              <ValueExpression>
                <XPathQuery Type="UnsignedInteger">EventDisplayNumber</XPathQuery>
              </ValueExpression>
              <Operator>Equal</Operator>
              <ValueExpression>
                <Value Type="UnsignedInteger">1003</Value>
              </ValueExpression>
            </SimpleExpression>
          </FirstExpression>
          <SecondComputerName>$Target/Host/Property[Type="Windows!Microsoft.Windows.Computer"]/NetworkName$</SecondComputerName>
          <SecondLogName>Application</SecondLogName>
          <SecondExpression>
            <SimpleExpression>
              <ValueExpression>
                <XPathQuery Type="UnsignedInteger">EventDisplayNumber</XPathQuery>
              </ValueExpression>
              <Operator>Equal</Operator>
              <ValueExpression>
                <Value Type="UnsignedInteger">1004</Value>
              </ValueExpression>
            </SimpleExpression>
          </SecondExpression>
        </Configuration>
      </UnitMonitor>
      <UnitMonitor ID="Custom.Event.Rule_Monitor.with.Schedule.Standard.Event.Monitor.with.Alert.WITH.Schedule" Accessibility="Internal" Enabled="true" Target="Windows!Microsoft.Windows.Server.OperatingSystem" ParentMonitorID="Health!System.Health.AvailabilityState" Remotable="true" Priority="Normal" TypeID="Custom.Microsoft.Windows.2SingleEventLog2StateMonitorType" ConfirmDelivery="true">
        <Category>AvailabilityHealth</Category>
        <AlertSettings AlertMessage="Custom.Event.Rule_Monitor.with.Schedule.Standard.Event.Monitor.with.Alert.WITH.Schedule_AlertMessageResourceID">
          <AlertOnState>Warning</AlertOnState>
          <AutoResolve>true</AutoResolve>
          <AlertPriority>Normal</AlertPriority>
          <AlertSeverity>Error</AlertSeverity>
          <AlertParameters>
            <AlertParameter1>$Data/Context/EventDescription$</AlertParameter1>
          </AlertParameters>
        </AlertSettings>
        <OperationalStates>
          <OperationalState ID="FirstEventRaised" MonitorTypeStateID="FirstEventRaised" HealthState="Warning" />
          <OperationalState ID="SecondEventRaised" MonitorTypeStateID="SecondEventRaised" HealthState="Success" />
        </OperationalStates>
        <Configuration>
          <FirstComputerName>$Target/Host/Property[Type="Windows!Microsoft.Windows.Computer"]/NetworkName$</FirstComputerName>
          <FirstLogName>Application</FirstLogName>
          <FirstExpression>
            <SimpleExpression>
              <ValueExpression>
                <XPathQuery Type="UnsignedInteger">EventDisplayNumber</XPathQuery>
              </ValueExpression>
              <Operator>Equal</Operator>
              <ValueExpression>
                <Value Type="UnsignedInteger">1005</Value>
              </ValueExpression>
            </SimpleExpression>
          </FirstExpression>
          <SecondComputerName>$Target/Host/Property[Type="Windows!Microsoft.Windows.Computer"]/NetworkName$</SecondComputerName>
          <SecondLogName>Application</SecondLogName>
          <SecondExpression>
            <SimpleExpression>
              <ValueExpression>
                <XPathQuery Type="UnsignedInteger">EventDisplayNumber</XPathQuery>
              </ValueExpression>
              <Operator>Equal</Operator>
              <ValueExpression>
                <Value Type="UnsignedInteger">1006</Value>
              </ValueExpression>
            </SimpleExpression>
          </SecondExpression>
        </Configuration>
      </UnitMonitor>
    </Monitors>
  </Monitoring>
  <Presentation>
    <StringResources>
      <StringResource ID="Custom.Event.Rule_Monitor.with.Schedule.Standard.Event.Monitor.with.Alert.NO.Schedule_AlertMessageResourceID" />
      <StringResource ID="Custom.Event.Rule_Monitor.with.Schedule.Standard.Event.Monitor.with.Alert.WITH.Schedule_AlertMessageResourceID" />
      <StringResource ID="Custom.Event.Rule_Monitor.with.Schedule.Standard.Event.Rule.with.Alert.NO.Schedule.AlertMessage" />
      <StringResource ID="Custom.Event.Rule_Monitor.with.Schedule.Standard.Event.Rule.with.Alert.WITH.Schedule.AlertMessage" />
    </StringResources>
  </Presentation>
  <LanguagePacks>
    <LanguagePack ID="ENU" IsDefault="true">
      <DisplayStrings>
        <DisplayString ElementID="Custom.Event.Rule_Monitor.with.Schedule">
          <Name>Custom Management Pack to Demonstrate Event Rules and Monitors with a Schedule</Name>
        </DisplayString>
        <DisplayString ElementID="Custom.Event.Rule_Monitor.with.Schedule.Standard.Event.Monitor.with.Alert.NO.Schedule">
          <Name>Stanrd Event Monitor with alert - NO Schedule</Name>
        </DisplayString>
        <DisplayString ElementID="Custom.Event.Rule_Monitor.with.Schedule.Standard.Event.Monitor.with.Alert.NO.Schedule" SubElementID="FirstEventRaised">
          <Name>FirstEventRaised</Name>
        </DisplayString>
        <DisplayString ElementID="Custom.Event.Rule_Monitor.with.Schedule.Standard.Event.Monitor.with.Alert.NO.Schedule" SubElementID="SecondEventRaised">
          <Name>SecondEventRaised</Name>
        </DisplayString>
        <DisplayString ElementID="Custom.Event.Rule_Monitor.with.Schedule.Standard.Event.Monitor.with.Alert.NO.Schedule_AlertMessageResourceID">
          <Name>Stanrd Event Monitor with alert - NO Schedule</Name>
          <Description>Event Description: {0}</Description>
        </DisplayString>
        <DisplayString ElementID="Custom.Event.Rule_Monitor.with.Schedule.Standard.Event.Monitor.with.Alert.WITH.Schedule">
          <Name>Standard Event MOnitor with Alert WITH Schedule</Name>
          <Description />
        </DisplayString>
        <DisplayString ElementID="Custom.Event.Rule_Monitor.with.Schedule.Standard.Event.Monitor.with.Alert.WITH.Schedule" SubElementID="FirstEventRaised">
          <Name>FirstEventRaised</Name>
        </DisplayString>
        <DisplayString ElementID="Custom.Event.Rule_Monitor.with.Schedule.Standard.Event.Monitor.with.Alert.WITH.Schedule" SubElementID="SecondEventRaised">
          <Name>SecondEventRaised</Name>
        </DisplayString>
        <DisplayString ElementID="Custom.Event.Rule_Monitor.with.Schedule.Standard.Event.Monitor.with.Alert.WITH.Schedule_AlertMessageResourceID">
          <Name>Standard Event MOnitor with Alert WITH Schedule</Name>
          <Description>Event Description: {0}</Description>
        </DisplayString>
        <DisplayString ElementID="Custom.Event.Rule_Monitor.with.Schedule.Standard.Event.Rule.with.Alert.NO.Schedule">
          <Name>Standard Event Rule with Alert - NO schedule</Name>
        </DisplayString>
        <DisplayString ElementID="Custom.Event.Rule_Monitor.with.Schedule.Standard.Event.Rule.with.Alert.NO.Schedule.AlertMessage">
          <Name>Simple Alerting Event Rule - No Schedule</Name>
          <Description>Event Description: {0}</Description>
        </DisplayString>
        <DisplayString ElementID="Custom.Event.Rule_Monitor.with.Schedule.Standard.Event.Rule.with.Alert.WITH.Schedule">
          <Name>Standard Event Rule with Alert - WITH schedule</Name>
          <Description />
        </DisplayString>
        <DisplayString ElementID="Custom.Event.Rule_Monitor.with.Schedule.Standard.Event.Rule.with.Alert.WITH.Schedule.AlertMessage">
          <Name>Simple Alerting Event Rule - With Schedule</Name>
          <Description>Event Description: {0}</Description>
        </DisplayString>
        <DisplayString ElementID="Custom.Microsoft.Windows.2SingleEventLog2StateMonitorType">
          <Name>Custom Microsoft Windows 2 State Single Event Log Monitor</Name>
          <Description />
        </DisplayString>
      </DisplayStrings>
    </LanguagePack>
  </LanguagePacks>
</ManagementPack>
