Home
  •  

Group Refresh updates are falling behind

Group_Refresh_updates_are_falling_behind_5_Rule (Rule)

Knowledge Base article:

Summary

The No GC Logon task was unable to update all of the cached entries during its last attempt.

Sample Event:

The group membership cache refresh task is behind schedule.

Resolutions

Consider forcing a group membership cache update.

If the number of entries is greater than 500, you should have also received a companion alert “Group Cache Refresh has reached the user limit for this domain controller.” In this case, follow the instructions for that alert.

Otherwise, the replication window is too short for the number of objects in the cache, and the only option is to extend the window.

External

For more information, see:

Element properties:

TargetMicrosoft.Windows.Server.2008.AD.DomainControllerRole
CategoryEventCollection
EnabledTrue
Event_ID1670
Alert GenerateTrue
Alert SeverityWarning
Alert PriorityNormal
RemotableTrue
Alert Message
Group Refresh updates are falling behind
{0}
Event LogDirectory Service
CommentMom2005ID='{5D379572-1585-443F-8125-AE8754563A68}';MOM2005GroupID=

Member Modules:

ID Module Type TypeId RunAs 
DS DataSource Microsoft.Windows.EventProvider Default
CollectEventData WriteAction Microsoft.SystemCenter.CollectEvent Default
CollectEventDataWarehouse WriteAction Microsoft.SystemCenter.DataWarehouse.PublishEventData Default
GenerateAlert WriteAction System.Health.GenerateAlert Default

Source Code:

<Rule ID="Group_Refresh_updates_are_falling_behind_5_Rule" Comment="Mom2005ID='{5D379572-1585-443F-8125-AE8754563A68}';MOM2005GroupID=" Enabled="onEssentialMonitoring" Target="AD2008Core!Microsoft.Windows.Server.2008.AD.DomainControllerRole" ConfirmDelivery="true" Remotable="true" Priority="Normal" DiscardLevel="100">

  <Category>EventCollection</Category>

  <DataSources>

    <DataSource ID="DS" TypeID="Windows!Microsoft.Windows.EventProvider">

      <ComputerName>$Target/Host/Property[Type="Windows!Microsoft.Windows.Computer"]/NetworkName$</ComputerName>

      <LogName>Directory Service</LogName>

      <Expression>

        <And>

          <Expression>

            <SimpleExpression>

              <ValueExpression>

                <XPathQuery>EventDisplayNumber</XPathQuery>

              </ValueExpression>

              <Operator>Equal</Operator>

              <ValueExpression>

                <Value>1670</Value>

              </ValueExpression>

            </SimpleExpression>

          </Expression>

          <Expression>

            <SimpleExpression>

              <ValueExpression>

                <XPathQuery>Channel</XPathQuery>

              </ValueExpression>

              <Operator>Equal</Operator>

              <ValueExpression>

                <Value>Directory Service</Value>

              </ValueExpression>

            </SimpleExpression>

          </Expression>

        </And>

      </Expression>

    </DataSource>

  </DataSources>

  <WriteActions>

    <WriteAction ID="GenerateAlert" TypeID="SystemHealth!System.Health.GenerateAlert">

      <Priority>1</Priority>

      <Severity>1</Severity>

      <AlertOwner/>

      <AlertMessageId>$MPElement[Name="Group_Refresh_updates_are_falling_behind_5_Rule.AlertMessage"]$</AlertMessageId>

      <AlertParameters>

        <AlertParameter1>$Data/EventDescription$</AlertParameter1>

      </AlertParameters>

      <Suppression>

        <SuppressionValue/>

      </Suppression>

    </WriteAction>

    <WriteAction ID="CollectEventData" TypeID="SC!Microsoft.SystemCenter.CollectEvent"/>

    <WriteAction ID="CollectEventDataWarehouse" TypeID="SCDW!Microsoft.SystemCenter.DataWarehouse.PublishEventData"/>

  </WriteActions>

</Rule>