Performance collection for : UDP_AUTHENTICATION_FAILURES_SEC

Microsoft.LS.2015.Monitoring.Rule.ReportingPC.AVEdge.UDP_AUTHENTICATION_FAILURES_SEC (Rule)

Knowledge Base article:

Summary

This rule collects this performance counter for reporting/troubleshooting purposes for the counter: UDP_AUTHENTICATION_FAILURES_SEC

The per-second rate of failed attempts to authenticate with the relay over UDP.

Causes

This error occurs when there is unexpectedly high rate of message authentication failures over UDP. This could be the result of a configuration error or an attempt to misuse the A/V Edge Server.

Resolutions

If the A/V Edge Server is deployed in a load balanced array verify that the same authentication certificate is deployed on each machine. Check that the profile of network traffic to the A/V Edge Server is in line with expected usage. A network level trace can be used to determine if there is unusual amount of traffic originating from a single source. If the situation persists then enable tracing to identify the originator of messages failing authentication checks to allow further troubleshooting of the cause.

Element properties:

Target	Microsoft.LS.2015.Component.AVEdge
Category	PerformanceCollection
Enabled	True
Instance Name	LS:A/V Edge - UDP Counters
Counter Name	A/V Edge - Authentication Failures/sec
Frequency	900
Alert Generate	False
Remotable	True

Member Modules:

ID	Module Type	TypeId	RunAs
CollectPerfCounter	DataSource	System.Performance.OptimizedDataProvider	Default
WriteToDB	WriteAction	Microsoft.SystemCenter.CollectPerformanceData	Default
WriteToDW	WriteAction	Microsoft.SystemCenter.DataWarehouse.PublishPerformanceData	Default

Source Code:

<Rule ID="Microsoft.LS.2015.Monitoring.Rule.ReportingPC.AVEdge.UDP_AUTHENTICATION_FAILURES_SEC" Enabled="true" Target="Microsoft.LS.2015.Component.AVEdge" ConfirmDelivery="false" Remotable="true" Priority="Normal" DiscardLevel="100">

  <Category>PerformanceCollection</Category>

  <DataSources>

    <DataSource ID="CollectPerfCounter" TypeID="SystemPerf!System.Performance.OptimizedDataProvider">

      <ComputerName>$Target/Host/Host/Host/Property[Type="Windows!Microsoft.Windows.Computer"]/NetworkName$</ComputerName>

      <CounterName>A/V Edge - Authentication Failures/sec</CounterName>

      <ObjectName>LS:A/V Edge - UDP Counters</ObjectName>

      <InstanceName/>

      <AllInstances>true</AllInstances>

      <Frequency>900</Frequency>

      <Tolerance>5</Tolerance>

      <ToleranceType>Absolute</ToleranceType>

      <MaximumSampleSeparation>4</MaximumSampleSeparation>

    </DataSource>

  </DataSources>

  <WriteActions>

    <WriteAction ID="WriteToDB" TypeID="SC!Microsoft.SystemCenter.CollectPerformanceData"/>

    <WriteAction ID="WriteToDW" TypeID="SCDW!Microsoft.SystemCenter.DataWarehouse.PublishPerformanceData"/>

  </WriteActions>

</Rule>