Generic Events don't trigger Rules/Alarms — 0 event sources loaded, XPCORuleSystemManager exception (2026 R1)

MIP
1

Environment:
XProtect 2026 R1, Event Server build 26.1.19310.1 (RTM). Also reproduced on the August 2026 cumulative patch build 26.1.19972.1 — identical behavior on both.

Symptom:
Generic Events are correctly configured (verified via the built-in “Check if expression matches event string” tester, which returns Match) but never trigger any Rule or Alarm Definition. Every time the Event Server / Generic Events plugin reloads (service restart or config save), the log shows:

XPCORuleSystemManager - Updating 0 event types, 0 event groups
XPCORuleSystemManager - Updating 0 event sources from Generic Events

…regardless of how many Generic Events are actually configured and enabled. Incoming telegrams are sometimes logged as recognized (MIP:Active Event in MIP.log), confirming the plugin receives and parses them, but they never become a routable event type for Rules/Alarms.

Separately, the rule engine throws repeatedly in production on unrelated event types too:

ERROR - XPCORuleSystemManager - Failed to trigger events in rule system. The events was not process in the rule system. Events =
System.InvalidOperationException: Collection was modified; enumeration operation may not execute.
at System.Runtime.Serialization.XmlObjectSerializer.WriteObjectHandleExceptions(…)
at VideoOS.EventServer.XPCORuleSystem.XPCORuleSystemManager.TrySerializeEvent(BaseEvent bEvent, String& serializedEvent)
at VideoOS.EventServer.XPCORuleSystem.XPCORuleSystemManager.ProcessEvents(ICollection`1 baseEvents)
at VideoOS.EventServer.XPCORuleSystem.XPCORuleSystemManager.CallWithCatchTArgs,T

This has been occurring continuously since 14 May 2026 (3795+ occurrences as of today), against real production events from a Hikvision ANPR integration (Known Resident, ANPR_NoMatch). Those specific alarms still work in practice since that integration registers through a separate MIP plugin (HikServicePlugin), not Generic Events — but it shows the underlying rule-engine serialization bug is broader than just Generic Events.

Steps to reproduce:

  1. Create a Generic Event (Data source: Compatible, TCP port 1234, separator bytes 13,10), expression “YOURSTRING”, confirm Match in the built-in tester
  2. Create either a Rule or an Alarm Definition triggered by that event
  3. Send a raw TCP telegram matching the expression to port 1234
  4. Observe: nothing triggers; Application.log shows “0 event sources from Generic Events” on every plugin reload

Already tried:

  • Verified firewall/IP allowlist/separator bytes config exhaustively — all correct
  • Full Event Server service restarts — no change
  • Applied the August 2026 cumulative patch (26.1.19972.1) — bug persists identically on the patched build

Happy to provide full log excerpts or a screen share if useful.

Questions:

  1. Is this a known/tracked issue internally? Is there a case/ticket number I can reference?
  2. Is there a workaround to get Generic Events routing into Rules/Alarms in the meantime — e.g. does Analytics Events (the separate subsystem) share this same registration bug, or would that route work as a substitute?
  3. Is a fix targeted for an upcoming cumulative patch, and roughly when?
2

Please verify the setup in Management Client → Tools → Options → Generic Events. Double-check that the data source is enabled and that the sender IP address is configured correctly.

I just tested this setup and could not reproduce the issue. I am also not aware of any known issues related to this behavior.

Technically, Generic Events are not part of the MIP SDK scope. If the configuration appears correct and the issue persists, I recommend opening a Technical Support case for further investigation of the Generic Event functionality.

Support cases can be created here: Milestone Support Portal

3

You mention them and I would greatly recommend using Analytics Events instead. You could do a quick test using this sample: Analytics Event Trigger via Analytics Event Trigger via XML