AzStackHci.EnvironmentChecker

1.2100.2321.143

AzStackHciStandaloneObservability/package/bin/GMA/Monitoring/Agent/initconfig/2.0/Standard/ProcessInvestigatorEventsOffline-Content.xml

                                <?xml version="1.0" encoding="utf-8"?>

<MonitoringManagement version="1.0" timestamp="2022-09-09T18:03:54.8774890Z">

  <!-- Autogenerated version comment - DO NOT REMOVE: AzSecPackShipVersion=4.22.0.2 -->

  <!-- Autogenerated version comment - DO NOT REMOVE: AzSecPackShipVersion=4.3.0.17-nia1709261429 -->

  <Events>

    <DerivedEvents>

      <!-- Process Investigator scanner -->

      <DerivedEvent source="AsmDiagnostics" duration="PT5M" eventName="AsmPiDiag" account="AuditStore" priority="Normal" deadline="PT15M" retryTimeout="PT1H" storeType="CentralBond" whereToRun="Local" retentionInDays="30">

        <Query><![CDATA[

            let ReportingIdentity=GetStaticEnvironmentVariable("MA_HEARTBEAT_IDENTITY")

            let AssetIdentity=GetStaticEnvironmentVariable("MA_AZURE_IDENTITY")

            let NodeIdentity=""

            let NodeType=""

            where EventProvider = "PILauncher" && (EventType = "Error" || EventType = "Warning" || EventPayload.contains("Analyis Results"))

            select ReportingIdentity, AssetIdentity, NodeIdentity, NodeType,

                   EventProvider, EventType, EventPayload, Truncated,

                   TotalChunks, ChunkId,

                   ChunkReference            ]]></Query>

      </DerivedEvent>

      <DerivedEvent source="AsmAlertsData" duration="PT1M" eventName="AsmPiAlert" account="AuditStore" priority="Normal" deadline="PT5M" retryTimeout="PT1H" storeType="CentralBond" whereToRun="Local" retentionInDays="30">

        <Query><![CDATA[

            let ReportingIdentity=GetStaticEnvironmentVariable("MA_HEARTBEAT_IDENTITY")

            let AssetIdentity=GetStaticEnvironmentVariable("MA_AZURE_IDENTITY")

            let NodeIdentity=""

            let NodeType=""

            where EventProvider = "PILauncher"

            select ReportingIdentity, AssetIdentity, NodeIdentity, NodeType,

                   EventProvider, EventType, EventPayload, Truncated,

                   TotalChunks, ChunkId,

                   ChunkReference            ]]></Query>

      </DerivedEvent>

    </DerivedEvents>

  </Events>

</MonitoringManagement>