Alert for event Id: 27022 ('ReachedMaxRetryCount')

Microsoft.LS.2019.Monitoring.Rule.InfoEvent.LegalInterceptService.ReachedMaxRetryCount (Rule)

Knowledge Base article:

Summary

Sending email failed multiple times.

Causes

Email system is not configured correctly or email address is not valid.

Resolutions

Verify the email relay system is configured correctly and email address is correct.

Element properties:

Target

Microsoft.LS.2019.Component.LegalInterceptService

Category

EventCollection

Enabled

True

Event_ID

27022

Event Source

LS Legal Intercept Service

Alert Generate

True

Alert Severity

Warning

Alert Priority

Low

Remotable

True

Alert Message

[Skype] Sending email failed multiple times.

{0}

Please see the 'Product Knowledge' and the 'Alert Context' tab on Alert Properties view for more information.

Event Log

Lync Server

Member Modules:

ID	Module Type	TypeId	RunAs
CollectEvent	DataSource	Microsoft.Windows.EventProvider	Default
WriteAlert	WriteAction	System.Health.GenerateAlert	Default
WriteToDB	WriteAction	Microsoft.SystemCenter.CollectEvent	Default
WriteToDW	WriteAction	Microsoft.SystemCenter.DataWarehouse.PublishEventData	Default

Source Code:

<Rule ID="Microsoft.LS.2019.Monitoring.Rule.InfoEvent.LegalInterceptService.ReachedMaxRetryCount" Enabled="true" Target="SFBDiscovery!Microsoft.LS.2019.Component.LegalInterceptService" ConfirmDelivery="false" Remotable="true" Priority="Normal" DiscardLevel="100">

  <Category>EventCollection</Category>

  <DataSources>

    <DataSource ID="CollectEvent" TypeID="Windows!Microsoft.Windows.EventProvider">

      <ComputerName>$Target/Host/Host/Host/Property[Type="Windows!Microsoft.Windows.Computer"]/NetworkName$</ComputerName>

      <LogName>Lync Server</LogName>

      <Expression>

        <And>

          <Expression>

            <SimpleExpression>

              <ValueExpression>

                <XPathQuery Type="String">PublisherName</XPathQuery>

              </ValueExpression>

              <Operator>Equal</Operator>

              <ValueExpression>

                <Value Type="String">LS Legal Intercept Service</Value>

              </ValueExpression>

            </SimpleExpression>

          </Expression>

          <Expression>

            <SimpleExpression>

              <ValueExpression>

                <XPathQuery Type="UnsignedInteger">EventDisplayNumber</XPathQuery>

              </ValueExpression>

              <Operator>Equal</Operator>

              <ValueExpression>

                <Value Type="UnsignedInteger">27022</Value>

              </ValueExpression>

            </SimpleExpression>

          </Expression>

        </And>

      </Expression>

    </DataSource>

  </DataSources>

  <WriteActions>

    <WriteAction ID="WriteToDB" TypeID="SC!Microsoft.SystemCenter.CollectEvent"/>

    <WriteAction ID="WriteAlert" TypeID="Health!System.Health.GenerateAlert">

      <Priority>0</Priority>

      <Severity>1</Severity>

      <AlertMessageId>$MPElement[Name="Alert_Sending_email_failed_multiple_times."]$</AlertMessageId>

      <AlertParameters>

        <AlertParameter1>$Data/EventDescription$</AlertParameter1>

      </AlertParameters>

      <Suppression>

        <SuppressionValue>$Data/EventDisplayNumber$</SuppressionValue>

        <SuppressionValue>$Data/PublisherName$</SuppressionValue>

        <SuppressionValue>$Data/LoggingComputer$</SuppressionValue>

      </Suppression>

    </WriteAction>

    <WriteAction ID="WriteToDW" TypeID="SCDW!Microsoft.SystemCenter.DataWarehouse.PublishEventData"/>

  </WriteActions>

</Rule>