CWA - 016 - Requests to non-exist sessions (Threshold)

CWA_016_Requests_to_non_exist_sessionsThreshold1_Rule (Rule)

Knowledge Base article:

Management Pack

Summary
This counter shows the total number of requests targeting nonexistent sessions since the Communicator Web Access virtual server was started.

Causes
This counter shows the number of requests that were targeted to sessions that were terminated or never existed. A high number could indicate an attempt to gain unauthorized access to the server.

Resolutions
Determine whether the server was recently restarted. Check the health of Live Communications Servers. Investigate whether there is an attempt to gain unauthorized access to the server.

Element properties:

Target

Microsoft.CommunicatorWebAccess.2005.Microsoft_Office_Communicator_Web_Access_Installation

Category

PerformanceHealth

Enabled

True

Instance Name

CWA - 03 - User session Service

Counter Name

CWA - 016 - Requests to non-exist sessions

Frequency

900

Alert Generate

True

Alert Severity

Error

Alert Priority

Low

Remotable

True

Alert Message

CWA - 016 - Requests to non-exist sessions (Threshold)

$Data/ObjectName$
:
$Data/CounterName$
:
$Data/InstanceName$
value =
$Data/Value$

Comment

Mom2005ID='{5C05DB2C-BE4C-4ECC-83E4-3584F4A2BCA3}';MOM2005ComputerGroupID={43A60922-2E83-45A8-873D-668E20BAF43D}

Member Modules:

ID	Module Type	TypeId	RunAs
_91FC19C5_F885_48BC_8D0F_B8D4A8055B5A_	DataSource	System.Mom.BackwardCompatibility.Performance.FilteredDataProvider	Default
DeltaThresholdFilter	ConditionDetection	System.Performance.DeltaThresholdCondition	Default
GenerateAlert	WriteAction	System.Mom.BackwardCompatibility.AlertResponse	Default

Source Code:

<Rule ID="CWA___016___Requests_to_non_exist_sessions__Threshold__1_Rule" Target="Microsoft.CommunicatorWebAccess.2005.Microsoft_Office_Communicator_Web_Access_Installation" Enabled="true" ConfirmDelivery="false" Comment="Mom2005ID='{5C05DB2C-BE4C-4ECC-83E4-3584F4A2BCA3}';MOM2005ComputerGroupID={43A60922-2E83-45A8-873D-668E20BAF43D}">

  <Category>PerformanceHealth</Category>

  <DataSources>

    <DataSource ID="_91FC19C5_F885_48BC_8D0F_B8D4A8055B5A_" Comment="{91FC19C5-F885-48BC-8D0F-B8D4A8055B5A}" TypeID="MomBackwardCompatibility!System.Mom.BackwardCompatibility.Performance.FilteredDataProvider">

      <ComputerName>$Target/Host/Property[Type="WindowsLibrary!Microsoft.Windows.Computer"]/NetworkName$</ComputerName>

      <CounterName>CWA - 016 - Requests to non-exist sessions</CounterName>

      <ObjectName>CWA - 03 - User session Service</ObjectName>

      <InstanceName>_Total</InstanceName>

      <Frequency>900</Frequency>

      <Expression/>

    </DataSource>

  </DataSources>

  <ConditionDetection ID="DeltaThresholdFilter" TypeID="PerformanceLibrary!System.Performance.DeltaThresholdCondition">

    <NumSamples>1</NumSamples>

    <Threshold>600</Threshold>

    <Operator>Greater</Operator>

  </ConditionDetection>

  <WriteActions>

    <WriteAction ID="GenerateAlert" TypeID="MomBackwardCompatibility!System.Mom.BackwardCompatibility.AlertResponse">

      <AlertGeneration>

        <GenerateAlert>true</GenerateAlert>

        <Owner/>

        <Description>

            $Data/ObjectName$

          :  

            $Data/CounterName$

          :  

            $Data/InstanceName$

           value = 

            $Data/Value$

          </Description>

        <AlertLevel>60</AlertLevel>

        <ResolutionState/>

        <Source>

            $Data/ObjectName$

          :  

            $Data/CounterName$

          :  

            $Data/InstanceName$

          </Source>

        <Name>CWA - 016 - Requests to non-exist sessions (Threshold)</Name>

      </AlertGeneration>

      <InvokerType>0</InvokerType>

    </WriteAction>

  </WriteActions>

</Rule>

CWA - 016 - Requests to non-exist sessions (Threshold)