M365 Services - Script Library Failure Repeated Event Detection Monitor

M365SSVC.ScriptLibraryFailureRepeatedEventDetection.Monitor (UnitMonitor)

Will detect when external script (deployable) resources are called but fail to load.

Knowledge Base article:

Summary

This will detect events in the Application event log related to the M365 Supplemental MP script library load failure(s).

Resolutions

Note:This management pack makes use of several embedded ("bundled") script resources. Sometimes immediately after importing the MP, various workflows will be temporarily unable to locate the resource files upon initialization. This failure to locate the necessary file is recorded in the Windows Application event log and may trigger an alert.

Example: "Error loading PoshLibrary at path:[C:\Program Files\Microsoft Monitoring Agent\Agent\Health Service State\Resources\352\M365Library.ps1]."

The alert is usually a false positive and can be ignored or you may reset the unit monitor with Health Explorer. However, if the problem persists/returns, be sure to investigate the cause.

Additional

Log: Application

Publisher: M365 Supplemental

Event Severity/Level: any

Use the corresponding agent task to test the service functionality.

M365 Supplemental - Get Service Status Data

M365 Supplemental - Get Service Incident Data

External

https://MonitoringGuys.com

Overridable Parameters

Name	Description	Default Value
MatchCount	The number of positive matches within the designated time interval (see WithinIntervalSeconds) needed to trigger the condition detection.	2
RepeatedRegExEventDisplayNumber	This is a regex value to determine which "Event ID" numbers are matched to trigger the condition detection.	999[5-9]
TimerResetSeconds	Monitor will resume Healthy state if no additional condidtion detection is triggered within this time.	1800
WithinIntervalSeconds	The time span within which the number of matches (see MatchCount) must occur to trigger the condition detection.	1600

Element properties:

Target

M365SSVC.Services.Role

Parent Monitor

M365SSVC.Services.Role.Aggregate.Health.Monitor

Category

AvailabilityHealth

Enabled

True

Alert Generate

True

Alert Severity

MatchMonitorHealth

Alert Priority

Normal

Alert Auto Resolve

True

Monitor Type

M365SL.Microsoft.Windows.RepeatedEventLogTimer2StateMonitorType_v3.MT

Remotable

True

Accessibility

Public

Alert Message

M365 Services - Script Library Failure Repeated Event Detection Monitor Alert

{0} Repeated failure events detected within this time window:
Start: {1}
End: {2}

{3}

Note: External PowerShell scripts often fail to load the first time upon MP deployment and workflow initialization on the agent. The agent eventually deploys the resource file and the problem quickly solves itself. This is usually not a big deal. However, excessive recurring events might indicate a persistent problem.

RunAs

Default

Source Code:

<UnitMonitor ID="M365SSVC.ScriptLibraryFailureRepeatedEventDetection.Monitor" Accessibility="Public" Enabled="true" Target="M365SSVC.Services.Role" ParentMonitorID="M365SSVC.Services.Role.Aggregate.Health.Monitor" Remotable="true" Priority="Normal" TypeID="M365SL!M365SL.Microsoft.Windows.RepeatedEventLogTimer2StateMonitorType_v3.MT" ConfirmDelivery="false">

  <Category>AvailabilityHealth</Category>

  <AlertSettings AlertMessage="M365SSVC.ScriptLibraryFailureRepeatedEventDetection.Monitor.AlertMessage">

    <AlertOnState>Error</AlertOnState>

    <AutoResolve>true</AutoResolve>

    <AlertPriority>Normal</AlertPriority>

    <AlertSeverity>MatchMonitorHealth</AlertSeverity>

    <AlertParameters>

      <AlertParameter1>$Data/Context/Count$</AlertParameter1>

      <AlertParameter2>$Data/Context/TimeWindowStart$</AlertParameter2>

      <AlertParameter3>$Data/Context/TimeWindowEnd$</AlertParameter3>

      <AlertParameter4>$Data/Context/Context/DataItem/EventDescription$</AlertParameter4>

    </AlertParameters>

  </AlertSettings>

  <OperationalStates>

    <OperationalState ID="RepeatedEventRaised" MonitorTypeStateID="RepeatedEventRaised" HealthState="Error"/>

    <OperationalState ID="TimerEventRaised" MonitorTypeStateID="TimerEventRaised" HealthState="Success"/>

  </OperationalStates>

  <Configuration>

    <!-- External PowerShell scripts often fail to load the first time upon MP deployment and workflow initialization on the agent. The agent eventually deploys the resource file and the problem quickly solves itself. This is usually not a big deal. However, excessive recurring events might indicate a persistent problem. -->

    <AndExpressionFilter>

      <RegExExpression>

        <ValueExpression>

          <XPathQuery Type="String">Params/Param[1]</XPathQuery>

        </ValueExpression>

        <Operator>ContainsSubstring</Operator>

        <Pattern>Error loading PoshLibrary</Pattern>

      </RegExExpression>

    </AndExpressionFilter>

    <RepeatedComputerName>$Target/Host/Host/Property[Type="Windows!Microsoft.Windows.Computer"]/PrincipalName$</RepeatedComputerName>

    <RepeatedLogName>Application</RepeatedLogName>

    <RepeatedLogSource>M365 Supplemental</RepeatedLogSource>

    <RepeatedRegExEventDisplayNumber>999[5-9]</RepeatedRegExEventDisplayNumber>

    <RepeatedRegExEventNameSpaceFromScript>Services</RepeatedRegExEventNameSpaceFromScript>

    <TenantName>$Target/Host/Property[Type="M365SL!M365SL.WatcherNode"]/TenantName$</TenantName>

    <WithinIntervalSeconds>3600</WithinIntervalSeconds>

    <MatchCount>4</MatchCount>

    <TimerResetSeconds>3600</TimerResetSeconds>

  </Configuration>

</UnitMonitor>