Centralized Logging Service Agent No Logs Captured

Microsoft.LS.2015.Monitoring.UnitMonitor.PairedEvent.ClsAgent.CLSAGENT_E_UNABLE_TO_CAPTURE_LOGS (UnitMonitor)

Knowledge Base article:

Summary

Centralized Logging Service Agent detected that no logging is happening on the machine

Causes

Centralized Logging Service Agent is running but no logs are being received from Skype for Business Server services. This could happen if all other services are stopped on the machine.

Resolutions

Check if Skype for Business Server services are running on the machine. After checking other services, if the alert persists, please check event log for event ids 33051 or 33042 from Centralized Logging Service Agent which means logs can't be saved due to mismatched binaries and default.tmx.

Element properties:

Target

Microsoft.LS.2015.Component.ClsAgent

Parent Monitor

System.Health.AvailabilityState

Category

AvailabilityHealth

Enabled

True

Alert Generate

True

Alert Severity

Error

Alert Priority

High

Alert Auto Resolve

True

Monitor Type

Microsoft.LS.2015.MonitorType.PairedEvent.Simple

Remotable

True

Accessibility

Public

Alert Message

[Skype] Centralized Logging Service Agent detected that no logging is happening on the machine

{0}

Please see the 'Product Knowledge' and the 'Alert Context' tab on Alert Properties view for more information.

RunAs

Default

Source Code:

<UnitMonitor ID="Microsoft.LS.2015.Monitoring.UnitMonitor.PairedEvent.ClsAgent.CLSAGENT_E_UNABLE_TO_CAPTURE_LOGS" Accessibility="Public" Enabled="true" Target="Microsoft.LS.2015.Component.ClsAgent" ParentMonitorID="Health!System.Health.AvailabilityState" Remotable="true" Priority="Normal" TypeID="Microsoft.LS.2015.MonitorType.PairedEvent.Simple" ConfirmDelivery="true">

  <Category>AvailabilityHealth</Category>

  <AlertSettings AlertMessage="Alert_Centralized_Logging_Service_Agent_detected_that_no_logging_is_happening_on_the_machine">

    <AlertOnState>Error</AlertOnState>

    <AutoResolve>true</AutoResolve>

    <AlertPriority>High</AlertPriority>

    <AlertSeverity>Error</AlertSeverity>

    <AlertParameters>

      <AlertParameter1>$Data/Context/EventDescription$</AlertParameter1>

    </AlertParameters>

  </AlertSettings>

  <OperationalStates>

    <OperationalState ID="Microsoft.LS.2015.Monitoring.UnitMonitor.PairedEvent.ClsAgent.CLSAGENT_E_UNABLE_TO_CAPTURE_LOGS.Success" MonitorTypeStateID="SuccessEventRaised" HealthState="Success"/>

    <OperationalState ID="Microsoft.LS.2015.Monitoring.UnitMonitor.PairedEvent.ClsAgent.CLSAGENT_E_UNABLE_TO_CAPTURE_LOGS.Error" MonitorTypeStateID="ErrorEventRaised" HealthState="Error"/>

  </OperationalStates>

  <Configuration>

    <ComputerName>$Target/Host/Host/Host/Property[Type="Windows!Microsoft.Windows.Computer"]/NetworkName$</ComputerName>

    <LogName>Lync Server</LogName>

    <SuccessExpression>

      <Or>

        <Expression>

          <And>

            <Expression>

              <SimpleExpression>

                <ValueExpression>

                  <XPathQuery Type="UnsignedInteger">EventDisplayNumber</XPathQuery>

                </ValueExpression>

                <Operator>Equal</Operator>

                <ValueExpression>

                  <Value Type="UnsignedInteger">33044</Value>

                </ValueExpression>

              </SimpleExpression>

            </Expression>

            <Expression>

              <SimpleExpression>

                <ValueExpression>

                  <XPathQuery Type="String">PublisherName</XPathQuery>

                </ValueExpression>

                <Operator>Equal</Operator>

                <ValueExpression>

                  <Value Type="String">LS Centralized Logging Agent</Value>

                </ValueExpression>

              </SimpleExpression>

            </Expression>

          </And>

        </Expression>

        <Expression>

          <And>

            <Expression>

              <SimpleExpression>

                <ValueExpression>

                  <XPathQuery Type="UnsignedInteger">EventDisplayNumber</XPathQuery>

                </ValueExpression>

                <Operator>Equal</Operator>

                <ValueExpression>

                  <Value Type="UnsignedInteger">33002</Value>

                </ValueExpression>

              </SimpleExpression>

            </Expression>

            <Expression>

              <SimpleExpression>

                <ValueExpression>

                  <XPathQuery Type="String">PublisherName</XPathQuery>

                </ValueExpression>

                <Operator>Equal</Operator>

                <ValueExpression>

                  <Value Type="String">LS Centralized Logging Agent</Value>

                </ValueExpression>

              </SimpleExpression>

            </Expression>

          </And>

        </Expression>

      </Or>

    </SuccessExpression>

    <ErrorExpression>

      <And>

        <Expression>

          <SimpleExpression>

            <ValueExpression>

              <XPathQuery Type="UnsignedInteger">EventDisplayNumber</XPathQuery>

            </ValueExpression>

            <Operator>Equal</Operator>

            <ValueExpression>

              <Value Type="UnsignedInteger">33043</Value>

            </ValueExpression>

          </SimpleExpression>

        </Expression>

        <Expression>

          <SimpleExpression>

            <ValueExpression>

              <XPathQuery Type="String">PublisherName</XPathQuery>

            </ValueExpression>

            <Operator>Equal</Operator>

            <ValueExpression>

              <Value Type="String">LS Centralized Logging Agent</Value>

            </ValueExpression>

          </SimpleExpression>

        </Expression>

      </And>

    </ErrorExpression>

  </Configuration>

</UnitMonitor>