Home
  •  

Alert for event Id: 33023 ('CLSAGENT_E_SUPRESSING_COMPONENT_TRACE')

Microsoft.LS.2015.Monitoring.Rule.InfoEvent.ClsAgent.CLSAGENT_E_SUPRESSING_COMPONENT_TRACE (Rule)

Knowledge Base article:

Summary

Centralized Logging Service Agent The component tracing rate at TL_FATAL level exceeded the 'ComponentThrottleLimit' more than 'ComponentThrottleSample' number of times.

Causes

Centralized Logging Service Agent The component emits TL_FATAL trace records at a rate that exceeded the 'ComponentThrottleLimit' defined in CMS, and did it more than 'ComponentThrottleSample' number of times. This happened with the component logging at TL_FATAL level. To prevent machine overload, the CMS Agent has to completely suppress the tracing by the component.

Resolutions

Fix the component so that it will log less data at TL_FATAL level. Or, to re-enable tracing at the default level, restart the scenario.

Element properties:

TargetMicrosoft.LS.2015.Component.ClsAgent
CategoryEventCollection
EnabledTrue
Event_ID33023
Event SourceLS Centralized Logging Agent
Alert GenerateTrue
Alert SeverityWarning
Alert PriorityLow
RemotableTrue
Alert Message
[Skype] Centralized Logging Service Agent The component tracing rate at TL_FATAL level exceeded the 'ComponentThrottleLimit' more than 'ComponentThrottleSample' number of times.
{0}

Please see the 'Product Knowledge' and the 'Alert Context' tab on Alert Properties view for more information.
Event LogLync Server

Member Modules:

ID Module Type TypeId RunAs 
CollectEvent DataSource Microsoft.Windows.EventProvider Default
WriteAlert WriteAction System.Health.GenerateAlert Default
WriteToDB WriteAction Microsoft.SystemCenter.CollectEvent Default
WriteToDW WriteAction Microsoft.SystemCenter.DataWarehouse.PublishEventData Default

Source Code:

<Rule ID="Microsoft.LS.2015.Monitoring.Rule.InfoEvent.ClsAgent.CLSAGENT_E_SUPRESSING_COMPONENT_TRACE" Enabled="true" Target="Microsoft.LS.2015.Component.ClsAgent" ConfirmDelivery="false" Remotable="true" Priority="Normal" DiscardLevel="100">

  <Category>EventCollection</Category>

  <DataSources>

    <DataSource ID="CollectEvent" TypeID="Windows!Microsoft.Windows.EventProvider">

      <ComputerName>$Target/Host/Host/Host/Property[Type="Windows!Microsoft.Windows.Computer"]/NetworkName$</ComputerName>

      <LogName>Lync Server</LogName>

      <Expression>

        <And>

          <Expression>

            <SimpleExpression>

              <ValueExpression>

                <XPathQuery Type="String">PublisherName</XPathQuery>

              </ValueExpression>

              <Operator>Equal</Operator>

              <ValueExpression>

                <Value Type="String">LS Centralized Logging Agent</Value>

              </ValueExpression>

            </SimpleExpression>

          </Expression>

          <Expression>

            <SimpleExpression>

              <ValueExpression>

                <XPathQuery Type="UnsignedInteger">EventDisplayNumber</XPathQuery>

              </ValueExpression>

              <Operator>Equal</Operator>

              <ValueExpression>

                <Value Type="UnsignedInteger">33023</Value>

              </ValueExpression>

            </SimpleExpression>

          </Expression>

        </And>

      </Expression>

    </DataSource>

  </DataSources>

  <WriteActions>

    <WriteAction ID="WriteToDB" TypeID="SC!Microsoft.SystemCenter.CollectEvent"/>

    <WriteAction ID="WriteAlert" TypeID="Health!System.Health.GenerateAlert">

      <Priority>0</Priority>

      <Severity>1</Severity>

      <AlertMessageId>$MPElement[Name="Alert_Centralized_Logging_Service_Agent_The_component_tracing_rate_at_TL_FATAL_level_exceeded_the__ComponentThrottleLimit__more_than__ComponentThrottleSample__number_of_times."]$</AlertMessageId>

      <AlertParameters>

        <AlertParameter1>$Data/EventDescription$</AlertParameter1>

      </AlertParameters>

      <Suppression>

        <SuppressionValue>$Data/EventDisplayNumber$</SuppressionValue>

        <SuppressionValue>$Data/PublisherName$</SuppressionValue>

        <SuppressionValue>$Data/LoggingComputer$</SuppressionValue>

      </Suppression>

    </WriteAction>

    <WriteAction ID="WriteToDW" TypeID="SCDW!Microsoft.SystemCenter.DataWarehouse.PublishEventData"/>

  </WriteActions>

</Rule>