Core Alert: CRITICAL ERROR - Monitor BizTalk NT service availability

Microsoft.BizTalk.Server.2016.MonitorBizTalkNTServiceAvailability (Rule)

Core Alert: CRITICAL ERROR - Monitor BizTalk NT service availability.

Knowledge Base article:

Summary

A BizTalk Host Instance service has gone to stopped state unexpectedly. The windows service is marked with start-up type "automatic" and is expected to be running all the time.

Causes

A BizTalk Host Instance service may be in a stopped state unexpectedly because of various reasons. Typically the reasons are: password of the service account associated with the Host Instance have expired or BizTalk Windows group membership for the service account have been changed.

Resolutions

Attempt to start the BizTalk Windows service from the Service Control Manager. Check the application event log and the system event log for additional events that may have more information on the type of the failure.

Verify that the credentials of the service account have not expired.
Verify that the service account is authorized as indicated by BizTalk security documentation.
Verify that the services on which BizTalk service depends are running or can start.

Configuration

Not Available

Additional

Not Available

External

Not Available

Element properties:

Target

Microsoft.BizTalk.Server.2016.BizTalkRuntimeRole

Category

EventCollection

Enabled

True

Event_ID

21207

Alert Generate

True

Alert Severity

Error

Alert Priority

High

Remotable

True

Alert Message

CRITICAL ERROR: Monitor BizTalk NT Service Availability

{0}

Event Log

Application

Member Modules:

ID	Module Type	TypeId	RunAs
Microsoft.BizTalk.Server.2016.MonitorBizTalkNTServiceAvailability.DataSource	DataSource	Microsoft.Windows.EventProvider	Default
GenerateAlert	WriteAction	System.Health.GenerateAlert	Default
WriteToDB	WriteAction	Microsoft.SystemCenter.CollectEvent	Default
WriteToDW	WriteAction	Microsoft.SystemCenter.DataWarehouse.PublishEventData	Default

Source Code:

<Rule ID="Microsoft.BizTalk.Server.2016.MonitorBizTalkNTServiceAvailability" Enabled="true" Target="BTSLib!Microsoft.BizTalk.Server.2016.BizTalkRuntimeRole" ConfirmDelivery="true" Remotable="true" Priority="Normal" DiscardLevel="100">

  <Category>EventCollection</Category>

  <DataSources>

    <DataSource ID="Microsoft.BizTalk.Server.2016.MonitorBizTalkNTServiceAvailability.DataSource" TypeID="Windows!Microsoft.Windows.EventProvider">

      <ComputerName>$Target/Property[Type="BTSLib!Microsoft.BizTalk.Server.2016.ServerRole"]/ComputerName$</ComputerName>

      <LogName>Application</LogName>

      <Expression>

        <And>

          <Expression>

            <SimpleExpression>

              <ValueExpression>

                <XPathQuery Type="UnsignedInteger">EventDisplayNumber</XPathQuery>

              </ValueExpression>

              <Operator>Equal</Operator>

              <ValueExpression>

                <Value Type="UnsignedInteger">21207</Value>

              </ValueExpression>

            </SimpleExpression>

          </Expression>

          <Expression>

            <RegExExpression>

              <ValueExpression>

                <XPathQuery Type="String">Params/Param[5]</XPathQuery>

              </ValueExpression>

              <Operator>ContainsSubstring</Operator>

              <Pattern>BTSSvc</Pattern>

            </RegExExpression>

          </Expression>

        </And>

      </Expression>

    </DataSource>

  </DataSources>

  <WriteActions>

    <WriteAction ID="WriteToDB" TypeID="SC!Microsoft.SystemCenter.CollectEvent"/>

    <WriteAction ID="WriteToDW" TypeID="SCDW!Microsoft.SystemCenter.DataWarehouse.PublishEventData"/>

    <WriteAction ID="GenerateAlert" TypeID="Health!System.Health.GenerateAlert">

      <Priority>2</Priority>

      <Severity>2</Severity>

      <AlertMessageId>$MPElement[Name="Microsoft.BizTalk.Server.2016.MonitorBizTalkNTServiceAvailability.AlertMessage"]$</AlertMessageId>

      <AlertParameters>

        <AlertParameter1>$Data/EventDescription$</AlertParameter1>

      </AlertParameters>

      <Suppression>

        <SuppressionValue>$Target/Property[Type="BTSLib!Microsoft.BizTalk.Server.2016.ServerRole"]/ComputerName$</SuppressionValue>

        <SuppressionValue>$Data/EventDisplayNumber$</SuppressionValue>

        <SuppressionValue>$Data/PublisherName$</SuppressionValue>

      </Suppression>

      <Custom1>Core Alerts</Custom1>

    </WriteAction>

  </WriteActions>

</Rule>