﻿<ManagementPack xsi:noNamespaceSchemaLocation="c:\enlistments\momv3\private\product\sdk\server\MPInfrastructure\schema\ManagementPackSchema.xsd" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:maml="http://schemas.microsoft.com/maml/2004/10">
  <Manifest>
    <Identity>
      <ID>Demo.Syslog.MP</ID>
      <Version>1.0.0.0</Version>
    </Identity>
    <Name>Demo MP for Monitoring Syslog Messages</Name>
    <References>
      <Reference Alias="System">
        <ID>System.Library</ID>
        <Version>6.0.5000.0</Version>
        <PublicKeyToken>31bf3856ad364e35</PublicKeyToken>
      </Reference>
      <Reference Alias="SCLibrary">
        <ID>Microsoft.SystemCenter.Library</ID>
        <Version>6.0.5000.0</Version>
        <PublicKeyToken>31bf3856ad364e35</PublicKeyToken>
      </Reference>
      <Reference Alias="AppLog">
        <ID>System.ApplicationLog.Library</ID>
        <Version>6.0.5000.0</Version>
        <PublicKeyToken>31bf3856ad364e35</PublicKeyToken>
      </Reference>
      <Reference Alias="Health">
        <ID>System.Health.Library</ID>
        <Version>6.0.5000.0</Version>
        <PublicKeyToken>31bf3856ad364e35</PublicKeyToken>
      </Reference>
    </References>
  </Manifest>
  <Monitoring>
    <Rules>
      <!-- generates alerts when priorityName says severity is either emergency/alert/critical/error (in short, ignores warning/notice/info/debug) -->
      <Rule ID="Demo.Syslog.Watcher" Target="SCLibrary!Microsoft.SystemCenter.ManagementServer" Enabled="true" ConfirmDelivery="true">
        <Category>Custom</Category>
        <DataSources>
          <DataSource ID="SyslogReader" TypeID="AppLog!System.ApplicationLog.SysLogReader">
            <Port>514</Port>
          </DataSource>
        </DataSources>
        <ConditionDetection ID="Filter" TypeID="System!System.ExpressionFilter">
          <Expression>
            <SimpleExpression>
              <ValueExpression>
                <XPathQuery Type="Integer">Priority</XPathQuery>
              </ValueExpression>
              <Operator>Less</Operator>
              <ValueExpression>
                <Value>4</Value>
              </ValueExpression>
            </SimpleExpression>
          </Expression>
        </ConditionDetection>
        <WriteActions>
          <WriteAction ID="GenerateAlert" TypeID="Health!System.Health.GenerateAlert">
            <Priority>1</Priority>
            <Severity>1</Severity>
            <AlertMessageId>$MPElement[Name="Demo.Syslog.AlertMessage"]$</AlertMessageId>
            <AlertParameters>
              <AlertParameter1>$Data/Context/Message$</AlertParameter1>
            </AlertParameters>
            <Suppression>
              <SuppressionValue />
            </Suppression>
          </WriteAction>
        </WriteActions>
      </Rule>
    </Rules>
  </Monitoring>
  <Presentation>
    <StringResources>
      <StringResource ID="Demo.Syslog.AlertMessage" />
    </StringResources>
  </Presentation>
  <LanguagePacks>
    <LanguagePack ID="ENU" IsDefault="true">
      <DisplayStrings>
        <DisplayString ElementID="Demo.Syslog.MP">
          <Name>Syslog Demo MP</Name>
          <Description>Syslog DEMO MP: This Management Pack contains rules that generates alerts when certain syslog messages match a criteria.</Description>
        </DisplayString>
        <DisplayString ElementID="Demo.Syslog.AlertMessage">
          <Name>Erroneous syslog packet received.</Name>
          <Description>{0}</Description>
        </DisplayString>
      </DisplayStrings>
    </LanguagePack>
  </LanguagePacks>
</ManagementPack>
