CWA - 003 - Forms auth logon failures (Threshold)

CWA_003_Forms_auth_logon_failuresThreshold1_Rule (Rule)

Knowledge Base article:

Management Pack

Summary
This counter shows the total number of forms logon attempts that have failed since the Communicator Web Access virtual server was started.

Causes
Failures may be caused by Active Directory connectivity problems, incorrect information supplied by users, or users who are not authorized to use Communicator Web Access. A large number could indicate abnormal logon activity.

Resolutions
Ensure Active Directory connectivity. Enable logon failure auditing if the reason for logon failures is unknown.

Element properties:

Target

Microsoft.CommunicatorWebAccess.2005.Microsoft_Office_Communicator_Web_Access_Installation

Category

PerformanceHealth

Enabled

True

Instance Name

CWA - 01 - Authentication Module

Counter Name

CWA - 003 - Forms auth logon failures

Frequency

900

Alert Generate

True

Alert Severity

Error

Alert Priority

Low

Remotable

True

Alert Message

CWA - 003 - Forms auth logon failures (Threshold)

$Data/ObjectName$
:
$Data/CounterName$
:
$Data/InstanceName$
value =
$Data/Value$

Comment

Mom2005ID='{374785D5-412B-499B-AB92-6891C9619CAA}';MOM2005ComputerGroupID={43A60922-2E83-45A8-873D-668E20BAF43D}

Member Modules:

ID	Module Type	TypeId	RunAs
_54041B4F_4354_4698_8C3D_3DD1380099E3_	DataSource	System.Mom.BackwardCompatibility.Performance.FilteredDataProvider	Default
DeltaThresholdFilter	ConditionDetection	System.Performance.DeltaThresholdCondition	Default
GenerateAlert	WriteAction	System.Mom.BackwardCompatibility.AlertResponse	Default

Source Code:

<Rule ID="CWA___003___Forms_auth_logon_failures__Threshold__1_Rule" Target="Microsoft.CommunicatorWebAccess.2005.Microsoft_Office_Communicator_Web_Access_Installation" Enabled="true" ConfirmDelivery="false" Comment="Mom2005ID='{374785D5-412B-499B-AB92-6891C9619CAA}';MOM2005ComputerGroupID={43A60922-2E83-45A8-873D-668E20BAF43D}">

  <Category>PerformanceHealth</Category>

  <DataSources>

    <DataSource ID="_54041B4F_4354_4698_8C3D_3DD1380099E3_" Comment="{54041B4F-4354-4698-8C3D-3DD1380099E3}" TypeID="MomBackwardCompatibility!System.Mom.BackwardCompatibility.Performance.FilteredDataProvider">

      <ComputerName>$Target/Host/Property[Type="WindowsLibrary!Microsoft.Windows.Computer"]/NetworkName$</ComputerName>

      <CounterName>CWA - 003 - Forms auth logon failures</CounterName>

      <ObjectName>CWA - 01 - Authentication Module</ObjectName>

      <InstanceName>_Total</InstanceName>

      <Frequency>900</Frequency>

      <Expression/>

    </DataSource>

  </DataSources>

  <ConditionDetection ID="DeltaThresholdFilter" TypeID="PerformanceLibrary!System.Performance.DeltaThresholdCondition">

    <NumSamples>2</NumSamples>

    <Threshold>500</Threshold>

    <Operator>Greater</Operator>

  </ConditionDetection>

  <WriteActions>

    <WriteAction ID="GenerateAlert" TypeID="MomBackwardCompatibility!System.Mom.BackwardCompatibility.AlertResponse">

      <AlertGeneration>

        <GenerateAlert>true</GenerateAlert>

        <Owner/>

        <Description>

            $Data/ObjectName$

          :  

            $Data/CounterName$

          :  

            $Data/InstanceName$

           value = 

            $Data/Value$

          </Description>

        <AlertLevel>40</AlertLevel>

        <ResolutionState/>

        <Source>

            $Data/ObjectName$

          :  

            $Data/CounterName$

          :  

            $Data/InstanceName$

          </Source>

        <Name>CWA - 003 - Forms auth logon failures (Threshold)</Name>

      </AlertGeneration>

      <InvokerType>0</InvokerType>

    </WriteAction>

  </WriteActions>

</Rule>

CWA - 003 - Forms auth logon failures (Threshold)