Will detect when external script (deployable) resources are called but fail to load.
This will detect events in the Application event log related to the M365 Supplemental MP script library load failure(s).
Note:This management pack makes use of several embedded ("bundled") script resources. Sometimes immediately after importing the MP, various workflows will be temporarily unable to locate the resource files upon initialization. This failure to locate the necessary file is recorded in the Windows Application event log and may trigger an alert.
Example: "Error loading PoshLibrary at path:[C:\Program Files\Microsoft Monitoring Agent\Agent\Health Service State\Resources\352\M365Library.ps1]."
The alert is usually a false positive and can be ignored or you may reset the unit monitor with Health Explorer. However, if the problem persists/returns, be sure to investigate the cause.
Log: Application
Publisher: M365 Supplemental
Event Severity/Level: any
Use the corresponding agent task to test the service functionality.
M365 Supplemental - Exchange to Exchange Mailflow Test
M365 Supplemental - Exchange to M365 Mailflow Test
M365 Supplemental - M365 to Exchange Mailflow Test
M365 Supplemental - M365 to M365 Mailflow Test
Name | Description | Default Value |
MatchCount | The number of positive matches within the designated time interval (see WithinIntervalSeconds) needed to trigger the condition detection. | 2 |
RepeatedRegExEventDisplayNumber | This is a regex value to determine which "Event ID" numbers are matched to trigger the condition detection. | 999[5-9] |
TimerResetSeconds | Monitor will resume Healthy state if no additional condidtion detection is triggered within this time. | 1800 |
WithinIntervalSeconds | The time span within which the number of matches (see MatchCount) must occur to trigger the condition detection. | 1600 |
Target | M365SMAIL.MailFlow | ||
Parent Monitor | M365SMAIL.MailFlow.Aggregate.Health.Monitor | ||
Category | AvailabilityHealth | ||
Enabled | True | ||
Alert Generate | True | ||
Alert Severity | MatchMonitorHealth | ||
Alert Priority | Normal | ||
Alert Auto Resolve | True | ||
Monitor Type | M365SL.Microsoft.Windows.RepeatedEventLogTimer2StateMonitorType_v3.MT | ||
Remotable | True | ||
Accessibility | Public | ||
Alert Message |
| ||
RunAs | Default |
<UnitMonitor ID="M365SMAIL.ScriptLibraryFailureRepeatedEventDetection.Monitor" Accessibility="Public" Enabled="true" Target="M365SMAIL.MailFlow" ParentMonitorID="M365SMAIL.MailFlow.Aggregate.Health.Monitor" Remotable="true" Priority="Normal" TypeID="M365SL!M365SL.Microsoft.Windows.RepeatedEventLogTimer2StateMonitorType_v3.MT" ConfirmDelivery="false">
<Category>AvailabilityHealth</Category>
<AlertSettings AlertMessage="M365SMAIL.ScriptLibraryFailureRepeatedEventDetection.Monitor.AlertMessage">
<AlertOnState>Error</AlertOnState>
<AutoResolve>true</AutoResolve>
<AlertPriority>Normal</AlertPriority>
<AlertSeverity>MatchMonitorHealth</AlertSeverity>
<AlertParameters>
<AlertParameter1>$Data/Context/Count$</AlertParameter1>
<AlertParameter2>$Data/Context/TimeWindowStart$</AlertParameter2>
<AlertParameter3>$Data/Context/TimeWindowEnd$</AlertParameter3>
<AlertParameter4>$Data/Context/Context/DataItem/EventDescription$</AlertParameter4>
</AlertParameters>
</AlertSettings>
<OperationalStates>
<OperationalState ID="RepeatedEventRaised" MonitorTypeStateID="RepeatedEventRaised" HealthState="Error"/>
<OperationalState ID="TimerEventRaised" MonitorTypeStateID="TimerEventRaised" HealthState="Success"/>
</OperationalStates>
<Configuration>
<!-- External PowerShell scripts often fail to load the first time upon MP deployment and workflow initialization on the agent. The agent eventually deploys the resource file and the problem quickly solves itself. This is usually not a big deal. However, excessive recurring events might indicate a persistent problem. -->
<AndExpressionFilter>
<RegExExpression>
<ValueExpression>
<XPathQuery Type="String">Params/Param[1]</XPathQuery>
</ValueExpression>
<Operator>ContainsSubstring</Operator>
<Pattern>Error loading PoshLibrary</Pattern>
</RegExExpression>
</AndExpressionFilter>
<RepeatedComputerName>$Target/Host/Host/Property[Type="Windows!Microsoft.Windows.Computer"]/PrincipalName$</RepeatedComputerName>
<RepeatedLogName>Application</RepeatedLogName>
<RepeatedLogSource>M365 Supplemental</RepeatedLogSource>
<RepeatedRegExEventDisplayNumber>999[5-9]</RepeatedRegExEventDisplayNumber>
<RepeatedRegExEventNameSpaceFromScript>MailFlow</RepeatedRegExEventNameSpaceFromScript>
<TenantName>$Target/Host/Property[Type="M365SL!M365SL.WatcherNode"]/TenantName$</TenantName>
<WithinIntervalSeconds>3600</WithinIntervalSeconds>
<MatchCount>4</MatchCount>
<TimerResetSeconds>3600</TimerResetSeconds>
</Configuration>
</UnitMonitor>