The per-second rate of messages that could not be routed because the message domain is not configured and does not appear to belong to a federated partner.
The Access Edge Server received SIP messages with an unknown domain.
If the number is high then the Access Edge Server may be under attack.
Target | Microsoft.LS.2010.Component.AccessEdge | ||
Parent Monitor | System.Health.PerformanceState | ||
Category | PerformanceHealth | ||
Enabled | True | ||
Alert Generate | True | ||
Alert Severity | Error | ||
Alert Priority | Normal | ||
Alert Auto Resolve | True | ||
Monitor Type | Microsoft.LS.2010.Performance.Double.ConsecutiveThresholdMonitor | ||
Remotable | True | ||
Accessibility | Public | ||
Alert Message |
| ||
RunAs | Default |
<UnitMonitor ID="Microsoft.LS.2010.Monitoring.UnitMonitor.ThresholdPC.AccessEdge_PERF_EPMESSAGE_E_MSG_DOMAIN_UNKNOWN_SEC" Accessibility="Public" Enabled="true" Target="Microsoft.LS.2010.Component.AccessEdge" ParentMonitorID="Health!System.Health.PerformanceState" Remotable="true" Priority="Normal" TypeID="Microsoft.LS.2010.Performance.Double.ConsecutiveThresholdMonitor" ConfirmDelivery="false">
<Category>PerformanceHealth</Category>
<AlertSettings AlertMessage="Alert_The_per_second_rate_of_messages_that_could_not_be_routed_because_the_message_domain_is_not_configured_and_does_not_appear_to_belong_to_a_federated_partner.">
<AlertOnState>Error</AlertOnState>
<AutoResolve>true</AutoResolve>
<AlertPriority>Normal</AlertPriority>
<AlertSeverity>Error</AlertSeverity>
<AlertParameters>
<AlertParameter1>$Data/Context/SampleValue$</AlertParameter1>
</AlertParameters>
</AlertSettings>
<OperationalStates>
<OperationalState ID="Microsoft.LS.2010.Monitoring.UnitMonitor.ThresholdPC.AccessEdge_PERF_EPMESSAGE_E_MSG_DOMAIN_UNKNOWN_SEC_OverThreshold" MonitorTypeStateID="OverThreshold" HealthState="Error"/>
<OperationalState ID="Microsoft.LS.2010.Monitoring.UnitMonitor.ThresholdPC.AccessEdge_PERF_EPMESSAGE_E_MSG_DOMAIN_UNKNOWN_SEC_UnderThreshold" MonitorTypeStateID="UnderThreshold" HealthState="Success"/>
<OperationalState ID="Microsoft.LS.2010.Monitoring.UnitMonitor.ThresholdPC.AccessEdge_PERF_EPMESSAGE_E_MSG_DOMAIN_UNKNOWN_SEC_UnderThresholdOverThreshold" MonitorTypeStateID="UnderThresholdOverThreshold" HealthState="Warning"/>
</OperationalStates>
<Configuration>
<ComputerName>$Target/Host/Host/Host/Property[Type="Windows!Microsoft.Windows.Computer"]/NetworkName$</ComputerName>
<CounterName>SIP - 025 - Messages/sec Dropped Due To Unknown Domain</CounterName>
<ObjectName>LS:SIP - 09 - Access Edge Server Messages</ObjectName>
<InstanceName/>
<AllInstances>true</AllInstances>
<Frequency>60</Frequency>
<WarningThreshold>5</WarningThreshold>
<ErrorThreshold>10</ErrorThreshold>
<NumSamples>1</NumSamples>
</Configuration>
</UnitMonitor>