If you open the properties of this alert rule, you'll see that the configuration data source scans the Operations Manager log on the Management Server for event ID 11852.  Filtering on this event and comparing to the Application or System log on...

UPDATE: This has been fixed in a recent hotfix (951979).  This also fixes a number of other issues. http://support.microsoft.com/kb/951979 If you cannot apply this hotfix now for whatever reason...read on... You have probably seen this alert in your...