<parser processALL="true" trace="0" name="System log">
   <file>*System</file>
   <rules>
      <rule name="Cluster Shared Volume is no longer accessible">
         <match repeatCount="0" repeatInterval="60">Cluster Shared Volume (.*) is no longer accessible from this cluster node because of error (.*). (.*)</match>
         <event>OS_CSV_FAILED</event>
         <id>5142</id>
      </rule>
      <rule name="Cluster Shared Volume has entered a paused state">
         <match repeatCount="0" repeatInterval="60">Cluster Shared Volume (.*) has entered a paused state because of (.*). All I/O will temporarily be queued until a path to the volume is reestablished.</match>
         <event>OS_CSV_PAUSED</event>
         <id>5120</id>
      </rule>
      <rule name="Cluster Shared Volume is no longer directly accessible from this cluster node">
         <match repeatCount="0" repeatInterval="60">Cluster Shared Volume (.*) is no longer directly accessible from this cluster node.(.*)</match>
         <event>OS_CSV_REDIRECT</event>
         <id>5121</id>
      </rule>
      <rule name="The IO operation at logical block for Disk was retried.">
         <match repeatCount="0" repeatInterval="60">(.*)</match>
         <event>SYS_DISK_IO_RETRY</event>
         <id>153</id>
         <source>Disk</source>
      </rule>
      <rule name="The process has initiated the restart">
         <match repeatCount="0" repeatInterval="60">(.*)</match>
         <event>SYS_NODE_RESTART</event>
         <id>1074</id>
         <source>User32</source>
      </rule>
      <rule name="The StarWindHealthService service terminated unexpectedly">
         <match repeatCount="0" repeatInterval="60">The StarWindHealthService service terminated unexpectedly.(*)</match>
         <event>SYS_SWHEALTH_TERMINATED</event>
         <id>7031</id>
         <source>Service Control Manager</source>
      </rule>
      <rule name="Name resolution for the name pas.starwind.com timed out after none of the configured DNS servers responded.">
         <match repeatCount="0" repeatInterval="60">Name resolution for the name pas.starwind.com(.*)</match>
         <event>SYS_AGENT_DNS</event>
         <id>1014</id>
      </rule>
      <rule name="ISCSI_TGT_CONN_FAILED">
         <match repeatCount="0" repeatInterval="60">(.*)</match>
         <event>ISCSI_TGT_CONN_FAILED</event>
         <id>1</id>
         <source>iScsiPrt</source>
      </rule>
      <rule name="ISCSI_TGT_CONN_FAILED">
         <match repeatCount="0" repeatInterval="60">(.*)</match>
         <event>ISCSI_TGT_CONN_FAILED</event>
         <id>20</id>
         <source>iScsiPrt</source>
      </rule>
      <rule name="ISCSI_TGT_LOGIN_FAILED">
         <match repeatCount="0" repeatInterval="60">(.*)</match>
         <event>ISCSI_TGT_LOGIN_FAILED</event>
         <id>10</id>
         <source>iScsiPrt</source>
      </rule>
      <rule name="ISCSI_TGT_LOGIN_FAILED">
         <match repeatCount="0" repeatInterval="60">(.*)</match>
         <event>ISCSI_TGT_LOGIN_FAILED</event>
         <id>70</id>
         <source>iScsiPrt</source>
      </rule>
      <rule name="ISCSI_TGT_CONN_OK">
         <match repeatCount="0" repeatInterval="60">(.*)</match>
         <event>ISCSI_TGT_CONN_OK</event>
         <id>34</id>
         <source>iScsiPrt</source>
      </rule>
      <rule name="ISCSI_TGT_RESET">
         <match repeatCount="0" repeatInterval="60">(.*)</match>
         <event>ISCSI_TGT_RESET</event>
         <id>39</id>
         <source>iScsiPrt</source>
      </rule>
      <rule name="ISCSI_TGT_RESPOND_FAILED">
         <match repeatCount="0" repeatInterval="60">(.*)</match>
         <event>ISCSI_TGT_RESPOND_FAILED</event>
         <id>43</id>
         <source>iScsiPrt</source>
      </rule>
      <rule name="ISCSI_TGT_RESPOND_FAILED">
         <match repeatCount="0" repeatInterval="60">(.*)</match>
         <event>ISCSI_TGT_RESPOND_FAILED</event>
         <id>49</id>
         <source>iScsiPrt</source>
      </rule>
      <rule name="ISCSI_TGT_RESET_FAILED">
         <match repeatCount="0" repeatInterval="60">(.*)</match>
         <event>ISCSI_TGT_RESET_FAILED</event>
         <id>63</id>
         <source>iScsiPrt</source>
      </rule>
      <rule name="Failed to setup initiator portal. Error status is given in the dump data.">
         <match repeatCount="0" repeatInterval="60">(.*)</match>
         <event>ISCSI_PRTL_FAILED</event>
         <id>5</id>
         <source>iScsiPrt</source>
      </rule>
      <rule name="OS_NTFS_FAILED">
         <match repeatCount="0" repeatInterval="60">The description for Event ID(.*)</match>
         <event>OS_NTFS_FAILED</event>
         <id>98</id>
         <source>Microsoft-Windows-Ntfs</source>
      </rule>
      <rule name="OS_NTFS_CORRUPTED">
         <match repeatCount="0" repeatInterval="60">(.*)</match>
         <event>OS_NTFS_CORRUPTED</event>
         <id>55</id>
         <source>Ntfs</source>
      </rule>
      <rule name="OS_DISK_REMOVED">
         <match repeatCount="0" repeatInterval="60">(.*)</match>
         <event>OS_DISK_REMOVED</event>
         <id>157</id>
         <source>disk</source>
      </rule>
      <rule name="SYS_HW_ERROR">
         <match repeatCount="0" repeatInterval="60">(.*)</match>
         <event>SYS_HW_ERROR</event>
         <level>3</level>
         <source>Microsoft-Windows-WHEA-Logger</source>
      </rule>
      <rule name="SYS_HW_ERROR">
         <match repeatCount="0" repeatInterval="60">(.*)</match>
         <event>SYS_HW_ERROR</event>
         <level>2</level>
         <id>5404</id>
         <source>Server Administrator</source>
      </rule>
      <rule name="SYS_HW_WARNING">
         <match repeatCount="0" repeatInterval="60">(.*)</match>
         <event>SYS_HW_WARNING</event>
         <level>3</level>
         <id>5403</id>
         <source>Server Administrator</source>
      </rule>
      <rule name="Hot tier extend">
         <match repeatCount="0" repeatInterval="60">SSD Tier Size Required(.*) greater than Current size of the SSD tier(.*) on virtual disk (.*) on storage tier (.*)</match>
         <event>STORAGE_SPACES_HOT_TIER</event>
         <id>795</id>
         <source>StarWindHealthServiceEvent</source>
      </rule>
   </rules>
   <macros/>
</parser>