Microsoft Internet Security and Acceleration Server 2004 SDK

Filter Alert Events

When you create an application filter, you may want it to register an event for which the Microsoft Firewall service can issue an alert to the ISA Server administrator. For example, you may want to make it possible for the administrator to be notified when your filter encounters a low-memory situation on the ISA Server computer.

The steps that you need to include in the code of your filter are as follows:

  1. Register an event in ISA Server.

    The filter must define an event, which it will signal whenever it encounters a specific situation.

    The event should be registered during registration of the filter with the Firewall service because you want the administrator to be able to define alerts for this event. When the filter is unregistered, it should remove this event definition.

  2. Create an alert that will be issued for the event.

    The filter can create an alert for the event during the filter registration process using ISA Server administration COM interfaces, or the administrator can create an alert for the event, as described in the ISA Server 2004 product documentation.

  3. Call the IFPCEventDefinition::Signal method to signal the event when the specific situation is encountered.

The Data Monitor filter sample provided with the ISA Server 2004 SDK creates both an event and an alert that is issued for the event during the registration process.

Note  Uninstalling a filter should remove the events that were defined during filter installation, and any related alerts.