Home
  •  

EventActivityProcessor Postponed Event Activity Block Size

Microsoft.AdvancedThreatAnalytics.1_9.Center.EventActivityProcessorPostponedEventActivityBlockSize.PerformanceHealth (UnitMonitor)

Performance Monitor for the Microsoft ATA 1.9 Center EventActivityProcessor Postponed Event Activity Block Size

Knowledge Base article:

Summary

The number of Network Activities of a specific type queued to be written to the database.

Should be less than the maximum-1 (default maximum: 50000)

Element properties:

TargetMicrosoft.AdvancedThreatAnalytics.1_9.Center
Parent MonitorSystem.Health.PerformanceState
CategoryPerformanceHealth
EnabledTrue
Instance NameMicrosoft ATA Center
Counter NameEventActivityProcessor Postponed Event Activity Block Size
Frequency60
Alert GenerateTrue
Alert SeverityWarning
Alert PriorityNormal
Alert Auto ResolveTrue
Monitor TypeSystem.Performance.ConsecutiveSamplesThreshold
RemotableTrue
AccessibilityPublic
Alert Message
EventActivityProcessor Postponed Event Activity Block Size Alert

Instance {0}
Object {1}
Counter {2}
Has a value {3}
At time {4}
RunAsDefault

Source Code:

<UnitMonitor ID="Microsoft.AdvancedThreatAnalytics.1_9.Center.EventActivityProcessorPostponedEventActivityBlockSize.PerformanceHealth" Accessibility="Public" Enabled="true" Target="Microsoft.AdvancedThreatAnalytics.1_9.Center" ParentMonitorID="Health!System.Health.PerformanceState" Remotable="true" Priority="Normal" TypeID="Perf!System.Performance.ConsecutiveSamplesThreshold" ConfirmDelivery="false">

  <Category>PerformanceHealth</Category>

  <AlertSettings AlertMessage="Microsoft.AdvancedThreatAnalytics.1_9.Center.EventActivityProcessorPostponedEventActivityBlockSize.PerformanceHealth.Alert">

    <AlertOnState>Warning</AlertOnState>

    <AutoResolve>true</AutoResolve>

    <AlertPriority>Normal</AlertPriority>

    <AlertSeverity>Warning</AlertSeverity>

    <AlertParameters>

      <AlertParameter1>$Data[Default='']/Context/InstanceName$</AlertParameter1>

      <AlertParameter2>$Data[Default='']/Context/ObjectName$</AlertParameter2>

      <AlertParameter3>$Data[Default='']/Context/CounterName$</AlertParameter3>

      <AlertParameter4>$Data[Default='']/Context/SampleValue$</AlertParameter4>

      <AlertParameter5>$Data[Default='']/Context/TimeSampled$</AlertParameter5>

    </AlertParameters>

  </AlertSettings>

  <OperationalStates>

    <OperationalState ID="ConditionFalse" MonitorTypeStateID="ConditionFalse" HealthState="Success"/>

    <OperationalState ID="ConditionTrue" MonitorTypeStateID="ConditionTrue" HealthState="Warning"/>

  </OperationalStates>

  <Configuration>

    <ComputerName>$Target/Host/Property[Type="Windows!Microsoft.Windows.Computer"]/NetworkName$</ComputerName>

    <CounterName>EventActivityProcessor Postponed Event Activity Block Size</CounterName>

    <ObjectName>Microsoft ATA Center</ObjectName>

    <InstanceName>nt authority\system\microsoft.tri.center</InstanceName>

    <AllInstances>false</AllInstances>

    <Frequency>60</Frequency>

    <Threshold>10000</Threshold>

    <Direction>greater</Direction>

    <NumSamples>1</NumSamples>

  </Configuration>

</UnitMonitor>